Amplify API calls fail to refresh token

[skylerrichter]

Describe the bug
After a successful sign in using Auth.federatedSignIn() I am only able to successfully make 1 API call before my security token expires. If I refresh my app after signing in the API will return a 403. If I refresh a second time Amplify will forget my credentials and I will be back on the login screen.

To Reproduce

App.js

Amplify.configure({
  Analytics: {
    disabled: true
  },
  Auth: {
    identityPoolId: 'IDENTITY_POOL_ID',
    region: 'us-east-1'
  },
  API: {
    endpoints: [
      {
        name: 'Service',
        endpoint: "https://LAMBDA_URL.execute-api.us-east-1.amazonaws.com/dev"
      }
    ]
  }
});

Login.js

_signInWithGoogle = () => {
    Google.logInAsync({
      iosClientId: 'IOS_CLIENT_ID', 
      scopes: ['profile', 'email']
    }).then((res) => {
      if (res.type === 'success') {
        Auth.federatedSignIn('google', { token: res.idToken }, { email: res.user.email })
          .then((creds) => {
            this.props.navigation.navigate('Main');
          });
      }
    });
  }

Foo.js

componentDidMount() {
  API.get('Service', '/foo').then(console.log).catch(console.log)
}

Expected behavior
Security tokens should refresh automatically as per the Amplify documentation "When using Authentication with AWS Amplify, you don’t need to refresh Amazon Cognito tokens manually. The tokens are automatically refreshed by the library when necessary."

Smartphone

• Device: Phone X Simulator (Expo)
• OS: iOS 12.1
• Version 32.0.0

[elorzafe]

@skylerrichter I reproduced the problem I marked this as a bug and try to send a pr to fix it

[elorzafe]

@skylerrichter I found the root cause of your issue.

You need to add to Auth.federatedSignIn expires_at attribute like this.

_signInWithGoogle = () => {
    Google.logInAsync({
      iosClientId: 'IOS_CLIENT_ID', 
      scopes: ['profile', 'email']
    }).then((res) => {
      if (res.type === 'success') {
        Auth.federatedSignIn('google', { token: res.idToken, expires_at:<token_expiration> }, { email: res.user.email })
          .then((creds) => {
            this.props.navigation.navigate('Main');
          });
      }
    });
  }

I will mark this as enhancement rather than bug, it should warn in case the expires_at is not there.

[elorzafe]

@skylerrichter if you need to refreshTokens you can define a refreshToken callback and configure that refreshHandlers for Auth. Following there is an example for doing this.

function refreshToken() {
    // refresh the token here and get the new token info
    // ......

    return new Promise(res, rej => {
        const data = {
            token, // the token from the provider
            expires_at, // the timestamp for the expiration
            identity_id, // optional, the identityId for the credentials
        }
        res(data);
    });
}

Auth.configure({
    refreshHandlers: {
        'developer': refreshToken // the property could be 'google', 'facebook', 'amazon', 'developer', OpenId domain
    }
})

[usmansbk]

The docs is a bit misleading. It doesn't automatically refresh the token in a non browser environment. One has to implement it.

[tomasyaya]

Hi @elorzafe I have a related question in issue 4782. I provided the callback for the refresh but it deosn't seem to work.

If you have any suggestion that would be great

[tannerabread]

Hi 👋 Closing this as resolved. There have been docs updates here and here that now display this process is not automatic for federatedSignIn outside of Facebook and Google.

Thank you!