Amplify does not call Cognito to refresh session after idToken/accessToken expiry

[abhijeet4som1]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

None

Environment information

# Put output below this line
System:
    OS: macOS 15.5
    CPU: (12) arm64 Apple M3 Pro
    Memory: 2.51 GB / 36.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.20.2 - ~/.local/share/mise/installs/node/18.20.2/bin/node
    npm: 10.5.0 - ~/.local/share/mise/installs/node/18.20.2/bin/npm
  Browsers:
    Chrome: 136.0.7103.114
    Safari: 18.5
  npmPackages:
    @amzn/awsui-collection-hooks: ^1.0.0 => 1.0.0 
    @amzn/awsui-components-react: ^3.0.0 => 3.0.0 
    @amzn/awsui-global-styles: ^1.0.0 => 1.0.0 
    @amzn/omnia-configuration: ^1.1.0 => 1.1.0 
    @amzn/omnia-configuration-manager-service-typescript-client: 1.0.0 => 1.0.0 
    @amzn/omnia-shared-frontend-libraries: ^4.0.0 => 4.0.0 
    @emotion/babel-plugin: ^11.13.5 => 11.13.5 
    @lingui/cli: ^4.13.0 => 4.14.1 
    @lingui/macro: ^4.14.1 => 4.14.1 
    @lingui/react: ^4.14.1 => 4.14.1 
    @lingui/vite-plugin: ^4.14.1 => 4.14.1 
    @tanstack/react-query: ^4.36.1 => 4.36.1 
    @tanstack/react-query-devtools: ^4.36.1 => 4.36.1 
    @testing-library/jest-dom: ^6.6.3 => 6.6.3 
    @testing-library/react: ^16.2.0 => 16.2.0 
    @testing-library/user-event: ^14.6.1 => 14.6.1 
    @types/jest: ^29.5.14 => 29.5.14 
    @types/lodash.camelcase: ^4.3.9 => 4.3.9 
    @types/lodash.chunk: ^4.2.9 => 4.2.9 
    @types/lodash.startcase: ^4.4.9 => 4.4.9 
    @types/react: ^18.3.16 => 18.3.17 
    @types/react-dom: ^18.3.5 => 18.3.5 
    @vitejs/plugin-basic-ssl: ^1.2.0 => 1.2.0 
    @vitejs/plugin-react: ^4.3.4 => 4.3.4 
    @vitest/coverage-istanbul: ^1.6.0 => 1.6.0 
    @zodios/core: ^10.9.6 => 10.9.6 
    @zodios/react: ^10.4.5 => 10.4.5 
    autoprefixer: ^10.4.20 => 10.4.20 
    aws-amplify: ^6.14.4 => 6.14.4 
    aws-amplify/adapter-core:  undefined ()
    aws-amplify/adapter-core/internals:  undefined ()
    aws-amplify/analytics:  undefined ()
    aws-amplify/analytics/kinesis:  undefined ()
    aws-amplify/analytics/kinesis-firehose:  undefined ()
    aws-amplify/analytics/personalize:  undefined ()
    aws-amplify/analytics/pinpoint:  undefined ()
    aws-amplify/api:  undefined ()
    aws-amplify/api/internals:  undefined ()
    aws-amplify/api/server:  undefined ()
    aws-amplify/auth:  undefined ()
    aws-amplify/auth/cognito:  undefined ()
    aws-amplify/auth/cognito/server:  undefined ()
    aws-amplify/auth/enable-oauth-listener:  undefined ()
    aws-amplify/auth/server:  undefined ()
    aws-amplify/data:  undefined ()
    aws-amplify/data/server:  undefined ()
    aws-amplify/datastore:  undefined ()
    aws-amplify/in-app-messaging:  undefined ()
    aws-amplify/in-app-messaging/pinpoint:  undefined ()
    aws-amplify/push-notifications:  undefined ()
    aws-amplify/push-notifications/pinpoint:  undefined ()
    aws-amplify/storage:  undefined ()
    aws-amplify/storage/s3:  undefined ()
    aws-amplify/storage/s3/server:  undefined ()
    aws-amplify/storage/server:  undefined ()
    aws-amplify/utils:  undefined ()
    babel-plugin-macros: ^3.1.0 => 3.1.0 
    cssnano: ^7.0.6 => 7.0.6 
    jest: ^29.7.0 => 29.7.0 
    jest-environment-jsdom: ^29.7.0 => 29.7.0 
    jotai: ^2.10.3 => 2.10.4 
    lodash.camelcase: ^4.3.0 => 4.3.0 
    lodash.chunk: ^4.2.0 => 4.2.0 
    lodash.startcase: ^4.4.0 => 4.4.0 
    moment: ^2.30.1 => 2.30.1 
    prettier: 3.5.3 => 3.5.3 
    react: ^18.3.1 => 18.3.1 
    react-dom: ^18.3.1 => 18.3.1 
    react-router-dom: ^6.28.0 => 6.28.0 
    single-spa-react: ^6.0.2 => 6.0.2 
    ts-jest: ^29.2.5 => 29.2.5 
    typescript: ^5.7.2 => 5.7.2 
    uuid: ^11.1.0 => 11.1.0 (9.0.1)
    vite: ^5.4.11 => 5.4.11 
    vite-plugin-single-spa: ^0.6.1 => 0.6.1 
    vitest: ^1.6.0 => 1.6.0 
    wait-for-expect: ^3.0.2 => 3.0.2 
    xlsx: ^0.18.5 => 0.18.5 
  npmGlobalPackages:
    corepack: 0.25.2
    npm: 10.5.0

Describe the bug

When using fetchAuthSession({ forceRefresh: true }) with cookie-based storage (e.g., via CookieStorage or a custom implementation), Amplify correctly calls the Cognito InitiateAuth endpoint (https://cognito-idp..amazonaws.com/) with the REFRESH_TOKEN_AUTH flow only when all three tokens (idToken, accessToken, and refreshToken) are still valid.

However, as soon as both the idToken and accessToken expire, even if the refreshToken is still present and valid, Amplify does not initiate any call to Cognito to refresh the session. Instead, fetchAuthSession() silently returns undefined and does not throw an error or attempt recovery via refreshToken.

This behavior breaks expected OAuth semantics, where a valid refreshToken should be sufficient to obtain new access and ID tokens even after they expire.

Expected behavior

idToken and accessToken has expired and removed from cookies, but refreshToken is still present and valid. so it should initiate call to Cognito to refresh the session and generate new tokens.

Reproduction steps

1. Install Amplify version 6.14.4 ("aws-amplify": "^6.14.4")
2. Configure Amplify:

   Auth: {
     Cognito: {
       userPoolId: config.userPoolId,
       userPoolClientId: config.userPoolClientId,
       loginWith: {
         oauth: {
           domain: config.domain,
           scopes: ['openid', 'email', 'profile', 'aws.cognito.signin.user.admin'],
           redirectSignIn: config.redirectSignIn,
           redirectSignOut: config.redirectSignOut,
           responseType: 'code',
           providers: [{ custom: 'AmazonFederate' }]
         }
       }
     }
   }
   

3. Use CookieStorage or Custom Storage as mentioned in https://docs.amplify.aws/gen1/react/build-a-backend/auth/manage-user-session/#understand-token-management-options

import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';

Amplify.configure(amplifyConfig);
cognitoUserPoolsTokenProvider.setKeyValueStorage(tokenStorage);

4. For debugging set Cognito token expiration as:
   idToken: 5 minutes
   accessToken: 5 minutes
   refreshToken: 15 minutes

5. Call fetchAuthSession({ forceRefresh: true })

   • Called within 5 minutes that is before expiry of idToken and accessToken, it generates new tokens and are stored correctly with new extended expiration.
   • Let the idToken and accessToken expire (but refreshToken is still present and valid), now calling fetchAuthSession({ forceRefresh: true }) returns undefined, no error thrown.

Code Snippet

// Put your code below this line.
const session = await fetchAuthSession({ forceRefresh: true });
const accessToken = session.tokens?.idToken?.toString();
console.log('***** getAccessToken:', accessToken);

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

When idToken and accessToken are valid:

Once idToken and accessToken expires:

As per my code flow before making API call, I call await fetchAuthSession({ forceRefresh: true });, but it silently returns undefined.

[sarayev]

Hi @abhijeet4som1,

Thanks for reporting the issue. We couldn't reproduce the issue on our end. Could you please provide the implementation of tokenStorage you've used here:

import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';

Amplify.configure(amplifyConfig);
cognitoUserPoolsTokenProvider.setKeyValueStorage(tokenStorage);

[abhijeet4som1]

Hi @sarayev ,

Please find the storage class and Amplify configuration class.

the difference between this and Amplify Library CookieStorage is only that it allows setting idToken, accessToken and refreshToken expiry time same as config in Cognito.

Custom CookieStorage

Types

export type SameSite = 'strict' | 'lax' | 'none';

export interface CookieStorageData {
  domain?: string;
  path?: string;

  /**
   * Expiration in days
   */
  expires?: {
    idTokenExpiryDays?: number;
    accessTokenExpiryDays?: number;
    refreshTokenExpiryDays?: number;
    defaultExpiryDays?: number;
  };
  secure?: boolean;
  sameSite?: SameSite;
}

CookieStorage

export class CookieStorage implements KeyValueStorageInterface {
  private path: string;
  private domain?: string;
  private expires?: CookieStorageData['expires'];
  private sameSite?: SameSite;
  private secure?: boolean;

  public constructor(data: CookieStorageData = {}) {
    const { path, domain, expires, sameSite, secure } = data;
    this.domain = domain;
    this.path = path || '/';
    this.expires = expires;
    this.secure = Object.prototype.hasOwnProperty.call(data, 'secure') ? secure : true;

    if (Object.prototype.hasOwnProperty.call(data, 'sameSite')) {
      if (!sameSite || !['strict', 'lax', 'none'].includes(sameSite)) {
        throw new Error('The sameSite value of cookieStorage must be "lax", "strict" or "none".');
      }
      if (sameSite === 'none' && !this.secure) {
        throw new Error('sameSite = None requires the Secure attribute in latest browser versions.');
      }
      this.sameSite = sameSite;
    }
  }

  public async setItem(key: string, value: string) {
    JsCookie.set(key, value, this.getData(key));
  }

  public async getItem(key: string) {
    const item = JsCookie.get(key);

    return item ?? null;
  }

  public async removeItem(key: string) {
    JsCookie.remove(key, this.getData(key));
  }

  public async clear() {
    const cookie = JsCookie.get();
    const promises = Object.keys(cookie).map((key) => this.removeItem(key));
    await Promise.all(promises);
  }

  private getData(key: string): CookieAttributes {
    return {
      path: this.path,
      expires: this.getExpiryDays(key),
      domain: this.domain,
      secure: this.secure,
      ...(this.sameSite && { sameSite: this.sameSite })
    };
  }

  private getExpiryDays(key: string): number {
    const { idTokenExpiryDays, accessTokenExpiryDays, refreshTokenExpiryDays, defaultExpiryDays = 365 } = this.expires ?? {};
    if (key.includes('idToken')) {
      return idTokenExpiryDays || defaultExpiryDays;
    }
    if (key.includes('accessToken')) {
      return accessTokenExpiryDays || defaultExpiryDays;
    }
    if (key.includes('refreshToken')) {
      return refreshTokenExpiryDays || defaultExpiryDays;
    }
    return defaultExpiryDays;
  }
}

Amplify Configuration:

export const configureAmplify = (config: CognitoConfig): void => {
  const amplifyConfig: ResourcesConfig = {
    Auth: {
      Cognito: {
        userPoolId: config.userPoolId,
        userPoolClientId: config.userPoolClientId,
        loginWith: {
          oauth: {
            domain: config.domain,
            scopes: ['openid', 'email', 'profile', 'aws.cognito.signin.user.admin'],
            redirectSignIn: config.redirectSignIn,
            redirectSignOut: config.redirectSignOut,
            responseType: 'code',
            providers: [{ custom: 'AmazonFederate' }]
          }
        }
      }
    }
  };
  // Configure Amplify with the environment-specific settings
  Amplify.configure(amplifyConfig);
  // For Debugging
  const tokenStorage = new CookieStorage({
    sameSite: 'none',
    expires: {
      idTokenExpiryDays: 5 / (24 * 60), // 5 minutes
      accessTokenExpiryDays: 5 / (24 * 60), // 5 minutes
      refreshTokenExpiryDays: 1 / 24 // 60 minutes
    }
  });
  cognitoUserPoolsTokenProvider.setKeyValueStorage(tokenStorage);
};

Cognito Configuration (For Debugging)

Debugging

Only difference with Amplify Library CookieStorage is that after the expiry idToken and accessToken is removed from cookies.

After Expiry

Even though a valid refreshToken is available, no request is made to refresh the idToken and accessToken using the REFRESH_TOKEN_AUTH flow after they expire.

However, prior to expiration, token refresh requests are triggered as expected, and new tokens are successfully generated.

[pranavosu]

Hey @abhijeet4som1, thanks for providing the details! We'll continue looking into this and get back to you when we have an update.

[jalapenopeppers]

Having the same issue here. Seems as if fetchAuthSession successfully refreshes cookies on the server side, but not the client side. This only occurs when the app is deployed on amplify, it does not occur locally. Both local and deployed environments use user pools, but deployed environments also use identity pools generated via CloudFormation. This refresh behavior was tested by changing both local and deployed user pools to have these same configuration options:

Note the following details from our end:

• We are using NextJS 14.2.28
• Using the following relevant packages:
  • "@aws-amplify/adapter-nextjs": "1.6.2",
  • "aws-amplify": "6.14.4",

Below are our relevant configuration options:

Amplify Server Side Auth Config

Auth: {
    Cognito: {
      userPoolId: process.env.NEXT_PUBLIC_COGNITO_USER_POOL_ID!,
      userPoolClientId: process.env.NEXT_PUBLIC_COGNITO_CLIENT_ID!,
      identityPoolId: process.env.NEXT_PUBLIC_COGNITO_IDENTITY_POOL_ID!,
      loginWith: {
        oauth: {
          domain: process.env.NEXT_PUBLIC_COGNITO_DOMAIN!,
          scopes: ["openid", "email", "profile"],
          redirectSignIn: [process.env.NEXT_PUBLIC_REDIRECT_SIGN_IN!],
          redirectSignOut: [process.env.NEXT_PUBLIC_REDIRECT_SIGN_OUT!],
          responseType: "code",
          providers: ["Google"]
        },
        username: true,
        email: true,
        phone: false,
      }
    }
  },

• Server side is configured as follows:

export const { runWithAmplifyServerContext } = createServerRunner({
  config: isLocalDev && localAmplifyConfig ? 
    localAmplifyConfig :
    prodAmplifyServerConfig,
});

Amplify Client Side Auth Config

Auth: {
    Cognito: {
      userPoolId: process.env.NEXT_PUBLIC_COGNITO_USER_POOL_ID!,
      userPoolClientId: process.env.NEXT_PUBLIC_COGNITO_CLIENT_ID!,
      identityPoolId: process.env.NEXT_PUBLIC_COGNITO_IDENTITY_POOL_ID!,
      loginWith: {
        oauth: {
          domain: process.env.NEXT_PUBLIC_COGNITO_DOMAIN!,
          scopes: ["openid", "email", "profile"],
          redirectSignIn: [process.env.NEXT_PUBLIC_REDIRECT_SIGN_IN!],
          redirectSignOut: [process.env.NEXT_PUBLIC_REDIRECT_SIGN_OUT!],
          responseType: "code",
          providers: ["Google"]
        },
        username: true,
        email: true,
        phone: false,
      },
      allowGuestAccess: true,
    }
  },

• Client side is configured as follows:

function ConfigureAmplifyClientSide() {
  if (typeof window !== "undefined") {
    if (isLocalDev && localAmplifyConfig) {
      // Configure local dev to use amplify_outputs.json to make CloudFormation stack for each dev.  
      Amplify.configure(
        localAmplifyConfig,
        { ssr: true }
      );
    } else {
      console.log('PROD CONFIG: ', prodAmplifyClientConfig);
      // Configure prod (including all hosted Amplify branches) to use custom config so we can use ENV variables
      Amplify.configure(
        {
          Auth: prodAmplifyClientConfig.Auth,
          Storage: prodAmplifyClientConfig.Storage,
        },
        { ssr: true }
      );
    }
  }

  return null;
}

export { prodAmplifyClientConfig, ConfigureAmplifyClientSide };

"use client";

import { Toaster } from "@/components/ui/toaster";
import { ThemeProvider } from "@/app/theme-provider";
import { ReactQueryClientProvider } from "@/components/QueryClientProvider";
import { DialogProvider } from "@/providers/DialogContext";
import { DialogWrapper } from "@/components/common/DialogWrapper";
import { SheetProvider } from "@/providers/SheetProvider";
import { SheetWrapper } from "@/components/common/SheetWrapper";
import { ConfigureAmplifyClientSide } from "@/lib/amplify-cognito-config";
import { AuthProvider } from "@/providers/AuthProvider";

export function ContextProvider({ children }: { children: React.ReactNode }) {
  return (
    <ThemeProvider
      attribute="class"
      defaultTheme="system"
      enableSystem
      disableTransitionOnChange
    >
      <ConfigureAmplifyClientSide />
      <ReactQueryClientProvider>
        <AuthProvider>
          <DialogProvider>
            <SheetProvider>
              <Toaster />
              {children}
              <DialogWrapper />
              <SheetWrapper />
            </SheetProvider>
          </DialogProvider>
        </AuthProvider>
      </ReactQueryClientProvider>
    </ThemeProvider>
  );
}