How to modify expiry time of the access and identity tokens for AWS Cognito User Pools

I can't find any documentation which explains if and how to modify the expiry time of access and identity tokens for AWS Cognito User Pools.

The documentation specifies that by default expires 1h after the emission.

Is there a way to modify the expiry time?

Solution 1:

As of August 12,2020, AWS has announced that user pools now supports customization of token expiration. Here are the steps to follow:

Open your AWS Cognito console.
Go to General Settings.
Scroll down to App clients and click edit.
Click on Show Details button to see the customization options like below:

Access token expiration must be between 5 minutes and 1 day. Cannot be greater than refresh token expiration.

For further detail on AWS cognito you can follow this link.

Solution 2:

This is currently not possible to configure for your user pool. They are set to one hour for everyone.

Edit: see Mike's comment, this has recently been added.

Solution 3:

I presume the question is how to get get granular control of Cognito session termination. There is a way to do this. But first lets recap how Cognito session management works:

Auth tokens expire after an hour.
A new auth token may be requested upon the issuance of a refresh token.
After 1 to 30 days, Cognito will not issue a refresh token - the number of days is configured per app, in the App Client Settings.

So what can you to to get better control of Cognito session length? The answer is to insert a filter in your http request stack that evaluates the request - if the user must be logged out for whatever reason, issue a 302 redirect to the Cognito logout endpoint (and clear your session cookies too).

This is what we do in Kubernetes with Envoy (using a proxy), and also Spring. It also allows you to wire in logic that immediately revokes access to a user before their 1 hour access token expires.

See https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html

Solution 4:

Clarification: this reply is about access token (not refresh token)

You can configure token expiration from cognito console General Settings / App Clients / {your app} / Show Details / Refresh token expiration (days)

https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html

By default, the refresh token expires 30 days after your app user signs in to your user pool. When you create an app for your user pool, you can set the app's refresh token expiration (in days) to any value between 1 and 3650.

It seems that currently for the web client there is no option for something less than a day (quite strange).

If you use Mobile SDK then

https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html

The Mobile SDK for Android offers the option to change the minimum validity period of the ID and access tokens to a value between 0 and 30 minutes. See the setRefreshThreshold() method of CognitoIdentityProviderClientConfig in the AWS Mobile SDK for Android API Reference.

Solution 5:

If you are using CloudFormation template, add the following attribute and specify in days (although the official docs say that it defaults to hours) how long the access token should be valid. Here is an example where Access Token is valid for 24 days.

UserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
        ClientName: myuserpoolclient
        GenerateSecret: true
        UserPoolId: !Ref YourUserPool
        AccessTokenValidity: 24

Documentation: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html#CognitoUserPools-CreateUserPoolClient-request-AccessTokenValidity