feat(auth): Refresh Token Rotation #4043

ekjotmultani · 2025-08-22T20:13:39Z

Changed InitiateAuth API for refreshing Cognito User Pool tokens to the new GetTokensFromRefreshToken API which enables a user to rotate their refresh token if they have the feature enabled

Additionally updated the AWS Swift SDK version which fixed a bug in this API

Issue #

#4027

General Checklist

Added new tests to cover change, if needed
Build succeeds with all target using Swift Package Manager
All unit tests pass
All integration tests pass
Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)
Documentation update for the change if required
PR title conforms to conventional commit style
New or updated tests include Given When Then inline code documentation and are named accordingly testThing_condition_expectation()
If breaking change, documentation/changelog update with migration instructions

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

… enable refresh token rotation, also updated test mock clients and added unit tests

…in mock clients

…r tests

codecov · 2025-08-28T07:50:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.03%. Comparing base (5866f82) to head (d7415a4).
⚠️ Report is 3 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (5866f82) and HEAD (d7415a4). Click for more details.

HEAD has 20 uploads less than BASE

Flag BASE (5866f82) HEAD (d7415a4)

unit_tests 11 1

Storage_plugin_unit_test 1 0

Auth_plugin_unit_test 1 0

DataStore_plugin_unit_test 1 0

Logging_plugin_unit_test 1 0

API_plugin_unit_test 1 0

Geo_plugin_unit_test 1 0

PushNotifications_plugin_unit_test 1 0

AWSPluginsCore 1 0

Analytics_plugin_unit_test 1 0

Predictions_plugin_unit_test 1 0

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #4043       +/-   ##
===========================================
- Coverage   67.80%   48.03%   -19.78%     
===========================================
  Files        1129      366      -763     
  Lines       52478     8917    -43561     
===========================================
- Hits        35585     4283    -31302     
+ Misses      16893     4634    -12259

Flag	Coverage Δ
API_plugin_unit_test	`?`
AWSPluginsCore	`?`
Amplify	`48.03% <ø> (+0.08%)`	⬆️
Analytics_plugin_unit_test	`?`
Auth_plugin_unit_test	`?`
DataStore_plugin_unit_test	`?`
Geo_plugin_unit_test	`?`
Logging_plugin_unit_test	`?`
Predictions_plugin_unit_test	`?`
PushNotifications_plugin_unit_test	`?`
Storage_plugin_unit_test	`?`
unit_tests	`48.03% <ø> (-19.78%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

harsh62 · 2025-09-03T13:56:56Z

...WSCognitoAuthPlugin/Actions/RefreshAuthorizationSession/UserPool/RefreshUserPoolTokens.swift

-                refreshToken: existingTokens.refreshToken,
-                expiresIn: authenticationResult.expiresIn
+                refreshToken: authenticationResult.refreshToken ?? existingTokens.refreshToken


Suggested change

refreshToken: existingTokens.refreshToken,

expiresIn: authenticationResult.expiresIn

refreshToken: authenticationResult.refreshToken ?? existingTokens.refreshToken

guard let authenticationResult = response?.authenticationResult,

let idToken = authenticationResult.idToken,

let accessToken = authenticationResult.accessToken,

let refreshToken = authenticationResult.refreshToken. <------- change

else {

let event = RefreshSessionEvent(eventType: .throwError(.invalidTokens))

await dispatcher.send(event)

logVerbose("\(#fileID) Sending event \(event.type)", environment: environment)

return

}

let userPoolTokens = AWSCognitoUserPoolTokens(

idToken: idToken,

accessToken: accessToken,

refreshToken: refreshToken. <------- change

I don't think we should use the old refresh token at this point.. Should throw an error if the refresh token doesn't exist, as we have entered an unknown state because of missing tokens.

You are right, there's no use for the old token, this was here because its possible the user doesn't have rotation enabled but in that case the returned token would just be their one token anyways

harsh62 · 2025-09-03T14:00:59Z

...nUnitTests/ActionTests/FetchAuthSession/FetchUserPoolTokens/RefreshUserPoolTokensTests.swift

+                    return GetTokensFromRefreshTokenOutput(
+                        authenticationResult: .init(
+                            accessToken: "accessTokenNew",
+                            expiresIn: 100,
+                            idToken: "idTokenNew",
+                            refreshToken: nil))


Since the refresh token is nil, can that ever happen.. I personally think it shouldn't and this test case should throw and error instead.

You are right, while the API can return a null token we should just throw an error in that case

harsh62 · 2025-09-03T14:02:44Z

...WSCognitoAuthPlugin/Actions/RefreshAuthorizationSession/UserPool/RefreshUserPoolTokens.swift

-
-            let input = await InitiateAuthInput.refreshAuthInput(
-                username: existingSignedIndata.username,
-                refreshToken: existingTokens.refreshToken,


We should remove the implementation of refreshAuthInput method as its not longer required.

It is already removed in this PR unless I missed something

I meant the implementation in InitiateAuthInput+Amplify.swift

harsh62 · 2025-09-03T14:05:05Z

Package.swift

@@ -9,7 +9,7 @@ let platforms: [SupportedPlatform] = [
    .watchOS(.v9)
 ]
 let dependencies: [Package.Dependency] = [
-    .package(url: "https://github.com/awslabs/aws-sdk-swift", exact: "1.5.14"),
+    .package(url: "https://github.com/awslabs/aws-sdk-swift", exact: "1.5.18"),


This is the version required for the patch SDK change?

yes the minimum

…ck for invalidTokens error in case the API returns a null token

@unchecked

…4041) * chore(build): fix build warnings for swift 6 experimental features * chore: add @unchecked Sendable conformances and nonisolated modifiers * chore: fix swiftlint errors * chore: add @preconcurrency attribute for module imports * chore: add more preconcurrency attributes * chore: add preconcurrency to model generated files * chore: fix failing unit test * chore: revert ActivityTracker changes * chore: update EndpointResolving * chore: resolve swiftlint error

…4045)

…n canary build (#4047) * chore(build): increase fastlane timeout for failing canary * update code * update code * update canaries project * update amplify dependency * revert gems to older version for dependency review failure * revert gem with incompatible license * update code * update code * update code

* chore: update Github action workflows chore: updating Github action workflows remove runtime check another update more updates update versions that are available for integration tests update versions add lowest as 18.4 test disabling parallel builds Revert "test disabling parallel builds" This reverts commit ce7eb6f. try to use the webauthn approach remove --set testing another update Update index.mjs another update try another fix another update another try final update try install simulators if needed flow run download only for xcode 16 * list available content list * try selecting xcode before * Update canary.yml

ekjotmultani added 2 commits August 22, 2025 13:13

updated RefreshUserPoolTokens to use GetTokensFromRefreshToken API to…

f386a64

… enable refresh token rotation, also updated test mock clients and added unit tests

updated authfetchsigninsession tests to use GetTokenFromRefreshToken …

9f81731

…in mock clients

ekjotmultani temporarily deployed to Fortify August 27, 2025 18:46 — with GitHub Actions Inactive

updated further tests to use new API as well as auth hub event handle…

d7415a4

…r tests

ekjotmultani temporarily deployed to Fortify August 27, 2025 22:55 — with GitHub Actions Inactive

ekjotmultani changed the title ~~updated RefreshUserPoolTokens to use GetTokensFromRefreshToken API to…~~ feat(auth): Refresh Token Rotation Aug 28, 2025

ekjotmultani marked this pull request as ready for review August 28, 2025 16:07

ekjotmultani requested a review from a team as a code owner August 28, 2025 16:07

harsh62 requested changes Sep 3, 2025

View reviewed changes

removed usage of old refresh token, updated test case to properly che…

c164905

…ck for invalidTokens error in case the API returns a null token

ekjotmultani temporarily deployed to Fortify September 3, 2025 15:37 — with GitHub Actions Inactive

thisisabhash added 4 commits September 3, 2025 09:14

chore(build): update setup-ruby github action for macos-15 runners (#…

30058c8

…4045)

chore(build): increase timeout on flaky unit tests (#4046)

56378fd

ekjotmultani temporarily deployed to Fortify September 3, 2025 16:14 — with GitHub Actions Inactive

removed refreshAuth function from initiateAuthInput

2739eee

ekjotmultani had a problem deploying to Fortify September 3, 2025 18:16 — with GitHub Actions Error

ekjotmultani temporarily deployed to Fortify September 3, 2025 18:19 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(auth): Refresh Token Rotation #4043

feat(auth): Refresh Token Rotation #4043

Uh oh!

ekjotmultani commented Aug 22, 2025 •

edited

Loading

Uh oh!

codecov bot commented Aug 28, 2025

Uh oh!

harsh62 Sep 3, 2025

Uh oh!

ekjotmultani Sep 3, 2025

Uh oh!

harsh62 Sep 3, 2025

Uh oh!

ekjotmultani Sep 3, 2025

Uh oh!

harsh62 Sep 3, 2025

Uh oh!

ekjotmultani Sep 3, 2025

Uh oh!

harsh62 Sep 3, 2025

Uh oh!

ekjotmultani Sep 3, 2025

Uh oh!

harsh62 Sep 3, 2025

Uh oh!

ekjotmultani Sep 3, 2025

Uh oh!

Uh oh!

-                refreshToken: existingTokens.refreshToken,
-                expiresIn: authenticationResult.expiresIn
-                refreshToken: authenticationResult.refreshToken ?? existingTokens.refreshToken
+guard let authenticationResult = response?.authenticationResult,
+        let idToken = authenticationResult.idToken,
+        let accessToken = authenticationResult.accessToken,
+        let refreshToken = authenticationResult.refreshToken.  <------- change
+else {
+        let event = RefreshSessionEvent(eventType: .throwError(.invalidTokens))
+        await dispatcher.send(event)
+        logVerbose("\(#fileID) Sending event \(event.type)", environment: environment)
+        return
+}
+let userPoolTokens = AWSCognitoUserPoolTokens(
+            idToken: idToken,
+            accessToken: accessToken,
+            refreshToken: refreshToken.  <------- change

feat(auth): Refresh Token Rotation #4043

Are you sure you want to change the base?

feat(auth): Refresh Token Rotation #4043

Uh oh!

Conversation

ekjotmultani commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue #

General Checklist

Uh oh!

codecov bot commented Aug 28, 2025

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ekjotmultani commented Aug 22, 2025 •

edited

Loading