Rotating Access Keys

[bbernays]

I am using the API module to sign requests so I can access API gateway with IAM credentials. When the keys get old and expire the API module won't refresh the keys. In order to force a key refresh I have to refresh the page which forces the entire application to re-authenticate as I am using the component.

How am I supposed to force a key refresh without requiring a page reload?

[bbernays]

@powerful23 thank you for working on this. Is there any timeline for release?

[mlabieniec]

HI @bbernays we have a pr in for this that we are hoping to get our this sprint (released next week). We still need to finish testing but if it doesn't go out this next release i think it will be in the next (we are in a rolling weekly release right now).

[powerful23]

@bbernays This should have been fixed in the pr #118 , feel free to reopen this issue if you still got that problem.

[bbernays]

@powerful23 Thank you!! I have downloaded the new release and now I am waiting for the keys to expire.

Will definitely report back if there are still issues

[bbernays]

The issue unfortunately is not fixed. After the tokens have expired I still require a refresh in order to get valid credentials to interact with my API.

It seems that the ID token from Cognito Identity is expiring and during the API call it is not refreshing the ID token to in order to get new credentials.

Now I am getting a 400 Bad Request from https://cognito-identity.us-east-1.amazonaws.com/ with the message: {"__type":"NotAuthorizedException","message":"Invalid login token. Token expired: 1516387425 >= 1516383264"}

Is there someway of extending the age of the id token from Cognito?

[powerful23]

@bbernays Thank you for your feedback. I don't know if there is a way to extend the age. We do refresh the expired credentials when calling APIs but seems like it's not working as expected. We will make more tests on that. So could you show us how to reproduce this that would help a lot.

[bbernays]

@powerful23 I will create an example this weekend showing the issue and share a working (and broken) example and code

[powerful23]

@bbernays Great! Thanks.

[bbernays]

I have created a full example on Hosted on S3

What example does:

• On component load the page makes a request to an API endpoint which uses IAM for authentication
• When you click on the button it also makes the same request

Steps to reproduce:

1. Signup
2. Login
3. Leave webpage idle for 1 hour
4. Click button

@powerful23 Let me know if you need anything else. Feel free to email me

[MatteCarra]

Thanks @bbernays
Where can I find the wrong example?
I don't understand what I'm doing wrong.
I'm using the default Authenticator with facebook federated login and using Api.get(.....).
After one hour I'm getting the same error as @bbernays
Could federated login be the problem? I will test with Cognito UserPool later or tomorrow.

[bbernays]

@MatteCarra - I am also using the default Authenticator. I am also only using Cognito UserPools.

You can check the source code for the example above here

[MatteCarra]

Yes, I've tested with both Facebook and Cognito UserPool.
With Cognito UserPool such problem does not exist and credentials renew after an hour with the cognito user pool access and id tokens, while with facebook after some time (I think an hour) the facebook token isn't renewed and I get the same error as @bbernays plus a message in the console: No credentials
@powerful23

[bbernays]

@MatteCarra Can you post an example where refresh token is working with Cognito UserPool is working?

[MatteCarra]

@bbernays My code is just as simple as yours. The only difference was that I was logging in with Facebook federated login.

@powerful23 I forgot to mention that refreshing the page won't make credentials refresh

I think I'm going to open a new issue because this is a whole different issue

[powerful23]

@bbernays Cool, I will try it today.

@MatteCarra I think that's also an issue with federation login, will look into it too.

[MatteCarra]

@powerful23 Ok thanks. I've already opened a new issue #180 because this a different problem

[bbernays]

@powerful23 Did you get a chance to test it out?

[powerful23]

@bbernays Yes, it works for me.

[bbernays]

@powerful23- Here is the screenshot of error I am getting on the example I shared above

[powerful23]

@bbernays did you use the PR #188 ? And could you turn on the debug mode so we can have more details about that error? Run window.LOG_LEVEL = 'DEBUG' in the web console. Thanks.

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.