feat(cognito): support refresh token rotation #34360

iridescent99 · 2025-05-05T20:05:42Z

Issue # (if applicable)

Closes #34344

Reason for this change

Cognito added support for short-lived refresh tokens.

Description of changes

Added refreshTokenRotationGracePeriod property to UserPoolClient

Describe any new or updated permissions being added

NA

Description of how you validated changes

Unit + integration tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Pull request has been modified.

iridescent99 · 2025-07-30T19:59:39Z

Thanks! This okay?

leonmk-aws

Small comment, feel free to add your opinion on it

leonmk-aws · 2025-07-31T15:29:55Z

packages/aws-cdk-lib/aws-cognito/lib/user-pool-client.ts

+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html#using-the-refresh-token-rotation
+   * @default - undefined (refresh token rotation is disabled)
+   */
+  readonly refreshTokenGracePeriod?: Duration;


I think having the variable named refreshTokenRotationGracePeriod would bring visibility that this is only effective when using refresh token rotation because people could get confused that this sets a grace period when not using the refresh token rotation feature. Also I think updating the documentation to make it clear that this enables the refresh token rotation feature would be valuable (the README is very clear in that regard, but having it here as well would be important even if the link to the doc is provided).

To be more clear: before the changes of yesterday, it was very clear for the user that this field only is only effective when enabling refresh token rotation and I feel that when flattening we slightly lost this clarity and we can improve this.

That's fair, I was having doubts about the description here as well. Sorry about the name, I didnt read that correctly.

So I will change the name to refreshTokenRotationGracePeriod.
and for the description this ok?

Enables refresh token rotation when set.
Defines the grace period for the original refresh token (0-60 seconds).

Can I still push these changes after approval?

Yes, you can make changes after approval

mergify · 2025-08-04T08:51:20Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-08-04T08:51:27Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

Pull request has been modified.

aws-cdk-automation · 2025-08-06T19:55:36Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 83e770a
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

ozelalisen

Could you resolve merge conflicts?

Pull request has been modified.

ozelalisen

LGTM

mergify · 2025-08-25T08:53:08Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-08-25T08:53:15Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

Pull request has been modified.

mergify · 2025-08-25T09:32:48Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-08-25T09:33:04Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

interface

b52d6de

github-actions bot added feature-request A feature should be added or improved. p2 labels May 5, 2025

aws-cdk-automation requested a review from a team May 5, 2025 20:05

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label May 5, 2025

iridescent99 marked this pull request as draft May 5, 2025 20:05

iridescent99 changed the title ~~Draft: feat(cognito): Support for refresh token~~ feat(cognito): Support for refresh token May 5, 2025

aws-cdk-automation previously requested changes May 5, 2025

View reviewed changes

iridescent99 changed the title ~~feat(cognito): Support for refresh token~~ feat(cognito): Support refresh token rotation May 5, 2025

iridescent99 added 8 commits May 15, 2025 11:50

refresh token rotation

e4a01f1

Merge branch 'main' into cognito/refresh-token

31471b4

Add tests + readme

99b71fd

mc

8c49a97

cleanup

66d17dd

cleanup

50e0606

ok

1709d36

fixpj

a387ed9

iridescent99 changed the title ~~feat(cognito): Support refresh token rotation~~ feat(cognito): support refresh token rotation May 15, 2025

iridescent99 and others added 6 commits May 15, 2025 12:57

readonly

9b46947

Merge branch 'main' into cognito/refresh-token

bba77e7

test

df72d98

fix

457574e

linting

299ce0c

tests

c078599

iridescent99 added 5 commits May 16, 2025 19:06

fixtest

d9436d8

unittests

97d5352

tests

14e0723

Merge branch 'main' into cognito/refresh-token

ac0bef5

align

1797e9c

iridescent99 added 4 commits July 30, 2025 20:38

ok

9e69d5d

readme

d8e3479

shorten

be7a6c9

lint

ca76127

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 30, 2025

leonmk-aws previously approved these changes Jul 31, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 31, 2025

ozelalisen self-assigned this Aug 4, 2025

Merge branch 'main' into cognito/refresh-token

83e770a

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Aug 6, 2025

ozelalisen previously requested changes Aug 14, 2025

View reviewed changes

mc

ad0a2c5

propname

bd067be

ozelalisen previously approved these changes Aug 25, 2025

View reviewed changes

Merge branch 'main' into cognito/refresh-token

07162a8

ozelalisen approved these changes Aug 25, 2025

View reviewed changes

mergify bot merged commit 74f8ad9 into aws:main Aug 25, 2025
21 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Aug 25, 2025

feat(cognito): support refresh token rotation #34360

feat(cognito): support refresh token rotation #34360

Uh oh!

Conversation

iridescent99 commented May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iridescent99 commented Jul 30, 2025

Uh oh!

leonmk-aws left a comment

Choose a reason for hiding this comment

Uh oh!

leonmk-aws Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

leonmk-aws Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

iridescent99 Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ozelalisen Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Aug 4, 2025

Uh oh!

mergify bot commented Aug 4, 2025

Uh oh!

aws-cdk-automation commented Aug 6, 2025

AWS CodeBuild CI Report

Uh oh!

ozelalisen left a comment

Choose a reason for hiding this comment

Uh oh!

ozelalisen left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Aug 25, 2025

Uh oh!

mergify bot commented Aug 25, 2025

Uh oh!

mergify bot commented Aug 25, 2025

Uh oh!

Uh oh!

github-actions bot commented Aug 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

iridescent99 commented May 5, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

iridescent99 Aug 1, 2025 •

edited

Loading