Not able to get refreshToken in Amplify 6

[pranjalBild]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

None

Environment information

  System:
    OS: Linux 5.15 Ubuntu 22.04.3 LTS 22.04.3 LTS (Jammy Jellyfish)
    CPU: (16) x64 13th Gen Intel(R) Core(TM) i5-13500H
    Memory: 6.81 GB / 11.68 GB
    Container: Yes
    Shell: 5.1.16 - /bin/bash
  Binaries:
    Node: 18.20.4 - ~/.nvm/versions/node/v18.20.4/bin/node
    Yarn: 1.22.22 - ~/.nvm/versions/node/v18.20.4/bin/yarn
    npm: 10.7.0 - ~/.nvm/versions/node/v18.20.4/bin/npm
    pnpm: 9.15.4 - ~/.nvm/versions/node/v18.20.4/bin/pnpm
  npmPackages:
    @asseinfo/react-kanban: ^2.1.0 => 2.2.0 
    @handsontable/react: ^14.3.0 => 14.6.2 
    @material-ui/lab: ^4.0.0-alpha.58 => 4.0.0-alpha.61 
    @material-ui/pickers: ^3.3.10 => 3.3.11 
    @material-ui/utils: ^4.11.3 => 4.11.3 
    @types/lodash: 4.17.14 => 4.17.14 
    @types/react: ~17.0.83 => 17.0.83 
    @types/react-dom: ~17.0.26 => 17.0.26 
    @typescript-eslint/eslint-plugin: 8.21.0 => 8.21.0 
    @typescript-eslint/parser: 8.21.0 => 8.21.0 
    @vitejs/plugin-react: 4.2.1 => 4.2.1 
    axios: ^0.21.4 => 0.21.4 
    clsx: ^1.1.1 => 1.2.1 
    eslint: ^8.9.0 => 8.55.0 
    eslint-plugin-react: ^7.28.0 => 7.33.2 
    eslint-plugin-react-hooks: ^4.3.0 => 4.6.0 
    handsontable: ^14.2.0 => 14.6.2 
    prettier: ^2.7.1 => 2.8.8 
    react: ^17.0.2 => 17.0.2 
    react-calendly: ^2.2.2 => 2.2.3 
    react-canvas-draw: ^1.2.1 => 1.2.1 
    react-dom: ^17.0.2 => 17.0.2 
    react-redux: ^7.2.4 => 7.2.9 
    typescript: 5.7.3 => 5.7.3 
    uuid: ^8.3.2 => 8.3.2 
    vite: 5.0.8 => 5.0.8 
  npmGlobalPackages:
    @rollup/rollup-linux-x64-gnu: 4.25.0
    aws-amplify: 6.13.4
    corepack: 0.28.0
    eslint: 9.20.1
    lighthouse: 12.3.0
    npm: 10.7.0
    pnpm: 9.15.4
    wscat: 6.0.1
    yarn: 1.22.22

Describe the bug

We have moved from Amplify v4 to v6 for one of our projects. We are using fetchAuthSession here which returns the accessToken but not the refreshToken.
Normally this won't be an issue but there's another electron js project which leverages the first project. We are using the amazon-cognito-identity-js package on electron BE, and it expects the refresh token to be passed to it.

Before when we were using amplify v4, we sign in the user and get the refresh token using Auth.currentSession().getRefreshToken().getToken() which is then passed to electron BE. Can this be done for Amplify v6 also?

Expected behavior

fetchAuthSession should also return the refresh token in addition to access token

Reproduction steps

• Sign in the user
• Use fetchAuthSession() to get the tokens. refreshToken is not present.

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[HuiSF]

Hi @pranjalBild in Amplify JS v6, fetchAuthSession elaborately omits refresh token from the returning result as it's the most important token and expected to be used only by Amplify JS internally.

Could you give us more details about the use cases where you expect to use the refresh token directly?

[pranjalBild]

Could you give us more details about the use cases where you expect to use the refresh token directly?

We're using the older amazon-cognito-identity-js package in our electron js backend which requires the refresh token to be passed to it for certain actions.
The user signs in on the electron FE where we have configured amplify, and needs to pass the token to electron BE.
Is there any other alternative to share the session across FE and BE? If we also use amplify 6 as well for electron js backend, what would be the recommended approach here?

[mikecowgill]

I also have a use case for being able to retrieve the refresh token. We have a background service in ios / android that makes http calls when the web app is backgrounded or closed (packaged with capacitor). I need to be able to pass the refresh token to this background service from amplify but currently cannot access it. I can't use the fetchAuthSession to automatically refresh the token as amplify is no longer accessible in the backgrounded application.

[AllanZhengYP]

Hi @pranjalBild @mikecowgill

One workaround to access the refresh token would be directly from token storage. Here's the steps:

1. After user is authenticated, read the value of storage key CognitoIdentityServiceProvider.{cognito_userpool_client_id}.LastAuthUser
2. read the value of storage key CognitoIdentityServiceProvider.{cognito_userpool_client_id}.{last_authenticate_user_name}.refreshToken
3. decode the refresh token.

However this approach does not automatically notify the backend process when the user is re-authenticated. To make sure we can improve this DX, do you mind sharing what operation do you call in the backend process? Do you call any AWS services or Amplify operation?

[mikecowgill]

@AllanZhengYP I was exploring using the local storage directly and this helps as I wasn't sure what the part of the key was for {last_authenticate_user_name}.

In the backend service we are calling our own api endpoints with a mobile native http service. It will also perform the token refresh operations directly with the cognito api. (that's the idea anyways)

I don't expect we will need to automatically notify the background service if the user is re-authenticated. Once the app is in foreground again I expect to refresh the tokens and reset them for the background service again.