How to modify expiry time of the access and identity tokens for AWS Cognito User Pools
This is currently not possible to configure for your user pool. They are set to one hour for everyone.
Edit: see Mike's comment, this has recently been added.
As of August 12,2020, AWS has announced that user pools now supports customization of token expiration. Here are the steps to follow:
- Open your AWS Cognito console.
- Go to
General Settings. - Scroll down to
App clientsand click edit. - Click on
Show Detailsbutton to see the customization options like below:
Access token expiration must be between 5 minutes and 1 day. Cannot be greater than refresh token expiration.
For further detail on AWS cognito you can follow this link.
I presume the question is how to get get granular control of Cognito session termination. There is a way to do this. But first lets recap how Cognito session management works:
- Auth tokens expire after an hour.
- A new auth token may be requested upon the issuance of a refresh token.
- After 1 to 30 days, Cognito will not issue a refresh token - the number of days is configured per app, in the App Client Settings.
So what can you to to get better control of Cognito session length? The answer is to insert a filter in your http request stack that evaluates the request - if the user must be logged out for whatever reason, issue a 302 redirect to the Cognito logout endpoint (and clear your session cookies too).
This is what we do in Kubernetes with Envoy (using a proxy), and also Spring. It also allows you to wire in logic that immediately revokes access to a user before their 1 hour access token expires.
See https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html