Cognito API InitiateAuth + REFRESH_TOKEN_AUTH does not return updated RefreshToken

[TomBell-Trove]

Describe the bug Users of our app are 401'd out 30 days after logging in.

We noticed that the token refresh request (AWSCognitoIdentityProviderService.InitiateAuth) with "AuthFlow": "REFRESH_TOKEN_AUTH" is not returning an updated refresh token. Therefore the refresh token is never updated/refreshed, and after 30 days the original refresh token was returned users are logged out no matter how often they've been refreshing their access token.

The API docs say that a new RefreshToken is meant to be returned.

This has also been noted by others, eg this StackOverflow post, and this javascript SDK issue.

To Reproduce Steps to reproduce the behavior:

1. Set refresh token expiry time to something small to test this, but larger than the access token expiry time.
2. Observe network traffic and authenticate in an app. RefreshToken will be returned.
3. Make a call after the access token has expired but before the refresh token expires. Note that the response does not include a new RefreshToken.
4. Wait for the new access token to expire, and for the original authentication's refresh token to expire.
5. Make a call. Response will be 401 and user will be unauthenticated.

Expected behavior Per docs, InitiateAuth + REFRESH_TOKEN_AUTH should return an updated RefreshToken as part of step 3 above, and step 5's should use the new refresh token to successfully get a new access token (and refresh token) and the call should succeed.

Screenshots If applicable, add screenshots to help explain your problem.

Environment(please complete the following information):

• AppSync SDK Version: 3.2.1 however this appears to be a broader API issue as it's also happening in iOS, C# and JS (at least)

Device Information (please complete the following information):

• Device: Android Emulator (API32), Pixel 3 XL (API32), iOS Simulator, unknown iOS device
• Android Version: 12 / N/A
• Specific to simulators: no

[TomBell-Trove]

Network call proof

[div5yesh]

Please note that REFRESH_TOKEN_AUTH is to get new idToken and accessTokens using a current valid refresh token, however Cognito documentation does not clearly state that. If refresh token is expired, re-login is required to get new refresh token.

The app must retain the current refresh token until expires to get new accessToken and idToken.