Token Cookies duplicated after upgrading to 6.5.1 from 5.3.17

[AboulEinein]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

Next.js

Amplify APIs

Authentication

Amplify Version

v6

Amplify Categories

auth

Backend

Other

Environment information

# Put output below this line

Describe the bug

After upgrading to version 6.5.1, we encountered 403 errors related to our token management system, which relies on cookies. Upon investigation, we discovered that prior to the upgrade, the cookies' domain was set with a leading dot (e.g., .example.com). However, post-upgrade, the domain is now set without the leading dot (e.g., example.com). This change has caused duplicate cookies for users who were already logged in, resulting in the cookie size exceeding the limit permitted by CloudFront, ultimately leading to the 403 errors.

Expected behavior

Cookies to be handled correctly without any duplications.

Reproduction steps

1. Run a project with v5 with cookies set as token storage
2. Sign in
3. Run the project with v6 with cookies set as token storage
4. Open the website and inspect the cookies

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[israx]

Hello @AboulEinein. Sorry for any inconvenience using the library. Can you configure the cookies as follows?

import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';

Amplify.configure(amplify-outputs, { ssr: true });
const cookieStorage = new CookieStorage({ domain:'.example'});
cognitoUserPoolsTokenProvider.setKeyValueStorage(cookieStorage);

[AboulEinein]

@israx I can do that, but it will cause the same issue to new users that logged in after the upgrade to v6

[HuiSF]

Hi @AboulEinein what @israx suggested is correct. You need to create an instance for overriding the cookie storage.

There is another limitation however, since you are using Next.js and if you are using the prebuilt @aws-amplify/adapter-nextjs, when Amplify refreshes tokens from your server and send refresh tokens back to the client as cookies, you will not be able to set the domain attribute at this moment. An workaround is to use the generic runWithAmplifyServerContext exported from aws-amplify/adapter-core with which you can implement your own logic for setting cookies from your server and then you have a complete control of the cookie attributes. (Details see this documentation: https://docs.amplify.aws/gen1/react/build-a-backend/server-side-rendering/)

[cwomack]

@AboulEinein, just wanted to follow up on this and see if there are any further questions on this issue that we can help address. Let us know!

[cwomack]

Closing this issue as we have not heard back from you. Please review this comment above and let us know if there is any further feedback or questions. We'd be happy to reopen this issue if needed.

Thank you!