jglesner
commented
3 years ago Upon further investigation, it does appear you can create a CognitoUserSession with the id/access/refresh tokens using the amazon-cognito-identity-js package with the code below, but Amplify doesn't recognize that the session exists.
import * as AmazonCognitoIdentity from "amazon-cognito-identity-js";
// passing a valid cognito response url with authorization_code and state
Auth._oAuthHandler.handleAuthResponse(url).then((resp) => {
// using the id, access and refresh tokens provided by the AuthHandler:
const AccessToken = new AmazonCognitoIdentity.CognitoAccessToken({
AccessToken: resp.accessToken,
});
const IdToken = new AmazonCognitoIdentity.CognitoIdToken({
IdToken: resp.idToken,
});
const RefreshToken = new AmazonCognitoIdentity.CognitoRefreshToken({
RefreshToken: resp.refreshToken,
});
const sessionData = {
IdToken: IdToken,
AccessToken: AccessToken,
RefreshToken: RefreshToken,
};
const session = new AmazonCognitoIdentity.CognitoUserSession(
sessionData
);
});Once the above code completes successfully, running Auth.currentAuthenticatedUser() (code below for clarity sake) logs "Not signed in The user is not authenticated" in the console.
Auth.currentAuthenticatedUser()
.then((user) => console.log(user))
.catch((err) => console.log(`Not signed in ${err}`));
Is there anyway for amplify.auth to pick up the CognitoUserSession, or to do something similar through Amplify? This looks similar to #6555.
evcodes
Marcussx
bobthebuilder1997
chanpod
kalousmichal
DefinitelyNotANugget
AndyMeagher
Before opening, please confirm:
JavaScript Framework
React
Amplify APIs
Authentication
Amplify Categories
auth
Environment information
Describe the bug
I'm working on a straight react js mobile application using cordova, and want to use Amplify with Social Sign On. I can't reliably use deep links, and need to handle the authentication flow within the app itself. I'm able to get to the point where I receive the authorization code grant URL from Cognito. But there doesn't appear to be a way in Amplify to create the user session using the tokens provided by Cognito.
This functionality seems to have once existed in amazon-cognito-auth-js with the
parseCognitoWebResponse()method. However, there is only one reference to CognitoAuth client in Auth.ts on line 209. It does not seem that you can retrieve a CognitoAuth client from the Auth object. So it would seem this capability is no longer supported anymore.Amplify's
Auth._oAuthHandler.handleAuthResponse()function does parse a Cognito authorization code grant url against the oauth2/token endpoint, and returns the idtoken, refreshtoken and accesstoken, but thehandleAuthResponsefunction does not store these tokens or create a Cognito User Session. There does not appear to be any way to create a User Session, using these tokens, via Amplify, the amazon-cognito-identity-js library, or the AWS JS SDK v3 (Cognito Identity Provider).This issue was acknowledged by the Amplify team in a comment by @powerful23 in #825 --- there should be a way to create a session apart from having to use the urlListener, and worst case, provide tokens to Amplify to create a user session. The Amplify team coded a rudimentary capability, but it was never released out of beta. #825 seems to have been closed without any resolution.
Based on comments in #825, it may be possible to trick Amplify by pushing these tokens into storage, but that's super hacky.
Am I missing something?
Expected behavior
I would expect the Amplify Authorization library to offer some mechanism to both (1) parse the authorization code grant response from Cognito, and (2) provide a way of creating a user session with the provided tokens without the reliance on urlListener. Just having the first by itself is not helpful. The lack of being able to create a user session greatly constrains Amplify's usefulness as soon as you go offroad.
Reproduction steps
Try to create a Cognito user session without urlListener, or using
Auth._oAuthHandler.handleAuthResponse(). It doesn't appear to be possible.Code Snippet
Log output
aws-exports.js
No response
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response