When working offline, id/access/refresh token expiration time is not honored.

[heikeschmitz]

Description

I set the expiration time for the ID and the Access tokens to 1 day and the Refresh token to 360 days.
But when I then go and work offline, I am asked to sign back in already after 1 hour.

Note:

• I verified that the times were set correctly before and after the error occurred.
  (see screen shot attached:
  
  )

Categories

• Analytics
• API (REST)
• API (GraphQL)
• Auth
• Authenticator
• DataStore
• Storage

Steps to Reproduce

1. Set the expiration of the tokens in AWS Cognito.
   1.1 Open AWS Cognito -> User Pools
   1.2 Click on your user pool
   1.3 Select the App Integration tab.
   1.4 Scroll down to the list of app clients
   1.5 Click on your app client
   1.6 Under 'App client information', click the Edit button.
   1.7 Enter 1 day for the expiration of both, the ID token and the Access token.
   1.8 Enter 360 days for the expiration of the Refresh token.
   1.9 Click the 'Save changes' button.
2. While online, freshly sign-in to your app (if necessary sign out of it before).
3. Close the app (without signing out.)
4. Go offline (e.g., switch on Airplane mode)
5. Wait 1 hour 5 minutes.
6. While still offline, restart the app.
7. The bug: You are asked to sign in again.
   What should happen: Since only 1 hour 5 minutes passed (not 1 day or more), you should not need to sign in again.
   Why this is a problem: At this point you are offline and cannot sign in again so you are unable to work with the app offline.
   The app works fine up to roughly an hour after the sign in and only then asks for a new sign in, if offline.

Screenshots

No response

Platforms

• iOS
• Android
• Web
• macOS
• Windows
• Linux

Android Device/Emulator API Level

No response

Environment

heike@Heikes-MacBook-Pro-2 eplant_mobile_app % flutter doctor
Doctor summary (to see all details, run flutter doctor -v):
[✓] Flutter (Channel stable, 3.3.6, on macOS 11.4 20F71 darwin-x64, locale en-US)
[✓] Android toolchain - develop for Android devices (Android SDK version 33.0.0)
[✓] Xcode - develop for iOS and macOS (Xcode 13.2.1)
[✓] Chrome - develop for the web
[✓] Android Studio (version 2021.3)
[✓] VS Code (version 1.71.2)
[✓] Connected device (3 available)
[✓] HTTP Host Availability

• No issues found!

Dependencies

heike@Heikes-MacBook-Pro-2 eplant_mobile_app % flutter pub deps --no-dev --style=compact
Dart SDK 2.18.2
Flutter SDK 3.3.6
eplant_mobile_app 0.6.0+1

dependencies:
- amplify_api 0.6.6 [amplify_api_android amplify_api_ios amplify_core amplify_flutter aws_common collection flutter meta plugin_platform_interface]
- amplify_auth_cognito 0.6.6 [amplify_auth_cognito_android amplify_auth_cognito_ios amplify_core aws_common collection flutter meta plugin_platform_interface]
- amplify_authenticator 0.2.2 [amplify_auth_cognito amplify_core amplify_flutter aws_common collection flutter flutter_localizations intl]
- amplify_datastore 0.6.6 [flutter amplify_datastore_plugin_interface amplify_core plugin_platform_interface meta collection async]
- amplify_flutter 0.6.6 [amplify_core amplify_datastore_plugin_interface amplify_flutter_android amplify_flutter_ios aws_common collection flutter meta plugin_platform_interface]
- animated_text_kit 4.2.2 [flutter characters]
- connectivity_plus 3.0.2 [flutter flutter_web_plugins connectivity_plus_platform_interface js meta nm]
- cupertino_icons 1.0.5
- flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine]
- flutter_native_timezone 2.0.0 [flutter_web_plugins flutter js]
- flutter_riverpod 1.0.4 [collection flutter meta riverpod state_notifier]
- fluttertoast 8.0.9 [flutter flutter_web_plugins]
- geolocator 8.2.1 [flutter geolocator_platform_interface geolocator_android geolocator_apple geolocator_web geolocator_windows]
- intl 0.17.0 [clock path]
- jwt_decode 0.3.1
- mobile_scanner 2.0.0 [flutter flutter_web_plugins js]
- nfc_manager 3.2.0 [flutter]
- package_info_plus 1.4.3+1 [flutter package_info_plus_platform_interface package_info_plus_linux package_info_plus_macos package_info_plus_windows package_info_plus_web]
- protobuf 2.1.0 [fixnum collection meta]

transitive dependencies:
- amplify_api_android 0.6.6 [flutter]
- amplify_api_ios 0.6.6 [amplify_core flutter]
- amplify_auth_cognito_android 0.6.6 [flutter]
- amplify_auth_cognito_ios 0.6.6 [amplify_core flutter]
- amplify_core 0.6.6 [aws_common collection flutter intl json_annotation meta plugin_platform_interface uuid]
- amplify_datastore_plugin_interface 0.6.6 [amplify_core collection flutter meta]
- amplify_flutter_android 0.6.6 [flutter]
- amplify_flutter_ios 0.6.6 [amplify_core flutter]
- args 2.3.1
- async 2.9.0 [collection meta]
- aws_common 0.1.1 [async collection http meta stream_transform uuid]
- characters 1.2.1
- clock 1.1.1
- collection 1.16.0
- connectivity_plus_platform_interface 1.2.3 [flutter meta plugin_platform_interface]
- crypto 3.0.2 [typed_data]
- dbus 0.7.8 [args ffi meta xml]
- ffi 2.0.1
- fixnum 1.0.1
- flutter_localizations 0.0.0 [flutter intl characters clock collection material_color_utilities meta path vector_math]
- flutter_web_plugins 0.0.0 [flutter js characters collection material_color_utilities meta vector_math]
- geolocator_android 3.2.1 [flutter geolocator_platform_interface]
- geolocator_apple 2.2.2 [flutter geolocator_platform_interface]
- geolocator_platform_interface 4.0.6 [flutter plugin_platform_interface vector_math meta]
- geolocator_web 2.1.6 [flutter flutter_web_plugins geolocator_platform_interface]
- geolocator_windows 0.1.1 [flutter geolocator_platform_interface]
- http 0.13.5 [async http_parser meta path]
- http_parser 4.0.1 [collection source_span string_scanner typed_data]
- js 0.6.4
- json_annotation 4.6.0 [meta]
- material_color_utilities 0.1.5
- meta 1.8.0
- nm 0.5.0 [dbus]
- package_info_plus_linux 1.0.5 [package_info_plus_platform_interface flutter path]
- package_info_plus_macos 1.3.0 [flutter]
- package_info_plus_platform_interface 1.0.2 [flutter meta plugin_platform_interface]
- package_info_plus_web 1.0.5 [flutter flutter_web_plugins http meta package_info_plus_platform_interface]
- package_info_plus_windows 2.1.0 [package_info_plus_platform_interface ffi flutter win32]
- path 1.8.2
- petitparser 5.0.0 [meta]
- plugin_platform_interface 2.1.2 [meta]
- riverpod 1.0.3 [collection meta state_notifier]
- sky_engine 0.0.99
- source_span 1.9.0 [collection path term_glyph]
- state_notifier 0.7.2+1 [meta]
- stream_transform 2.0.0
- string_scanner 1.1.1 [source_span]
- term_glyph 1.2.1
- typed_data 1.3.1 [collection]
- uuid 3.0.6 [crypto]
- vector_math 2.1.2
- win32 3.0.0 [ffi]
- xml 6.1.0 [collection meta petitparser]

Device

iPhone 13 Pro Max emulator, Pixel 4 XL

OS

iOS 15.2, Android 13

Deployment Method

Amplify CLI

CLI Version

10.4.0

Additional Context

I am developing in Android Studio, on a MacBook Pro, MacOS BigSur, version 11.4 (20F71)
Use case: The app is needed in the field to communicate with NFC-enabled iot devices while being out of regular network range.

Amplify Config

const amplifyconfig = ''' {
"UserAgent": "aws-amplify-cli/2.0",
"Version": "1.0",
"api": {
"plugins": {
"awsAPIPlugin": {
"eplantmobileapp": {
"endpointType": "GraphQL",
"endpoint": "https://.appsync-api.us-west-2.amazonaws.com/graphql",
"region": "us-west-2",
"authorizationType": "AMAZON_COGNITO_USER_POOLS"
}
}
}
},
"auth": {
"plugins": {
"awsCognitoAuthPlugin": {
"UserAgent": "aws-amplify-cli/0.1.0",
"Version": "0.1.0",
"IdentityManager": {
"Default": {}
},
"CredentialsProvider": {
"CognitoIdentity": {
"Default": {
"PoolId": "us-west-2:",
"Region": "us-west-2"
}
}
},
"CognitoUserPool": {
"Default": {
"PoolId": "us-west-2_",
"AppClientId": "",
"Region": "us-west-2"
}
},
"Auth": {
"Default": {
"authenticationFlowType": "USER_SRP_AUTH",
"socialProviders": [],
"usernameAttributes": [
"EMAIL"
],
"signupAttributes": [
"EMAIL"
],
"passwordProtectionSettings": {
"passwordPolicyMinLength": 8,
"passwordPolicyCharacters": []
},
"mfaConfiguration": "OFF",
"mfaTypes": [
"SMS"
],
"verificationMechanisms": [
"EMAIL"
]
}
},
"AppSync": {
"Default": {
"ApiUrl": "https://-api.us-west-2.amazonaws.com/graphql",
"Region": "us-west-2",
"AuthMode": "AMAZON_COGNITO_USER_POOLS",
"ClientDatabasePrefix": "eplantmobileapp_AMAZON_COGNITO_USER_POOLS"
},
"eplantmobileapp_AWS_IAM": {
"ApiUrl": "https://.appsync-api.us-west-2.amazonaws.com/graphql",
"Region": "us-west-2",
"AuthMode": "AWS_IAM",
"ClientDatabasePrefix": "eplantmobileapp_AWS_IAM"
}
}
}
}
}
}''';

[Jordan-Nelson]

Hello @heikeschmitz - Thanks for taking the time to open this issue and provide detailed reproduction steps. I was able to reproduce this with the steps you provided. I will look into a fix for this issue.

[Jordan-Nelson]

Hi @heikeschmitz - I wanted to give you an update on this issue.

The Authenticator uses the fetchAuthSession API to fetch User Pool Tokens to determine a user's auth status. This API throws an Exception if User Pool Tokens OR AWS Credentials are expired. AWS Credentials will expire after one hour. This is why you are seeing this behavior after one hour. I am looking into a fix, but it will likely require breaking changes, and will not be a simple change.

We have a version of Amplify-Flutter in developer-preview that is a full re-write in Dart. Unfortunately this same issue will exist in that version. However, it might be much simpler to resolve in that version. Let me know if you would be open to using the developer-preview version if we were able to get a fix out sooner.

[heikeschmitz]

Thanks for the update, @Jordan-Nelson! If we could get a fix sooner, I would definitely be willing to try out the developer preview. How long do you think that might take? We do have paying customers now that we would have to alert of the risk of instability. So I would love to give them an expectation of what the timeline might be for the developer preview to become mainstreamed and adopted as the stable version. Do you know, even just roughly?

[Jordan-Nelson]

@heikeschmitz - I don't have an ETA on a fix at the moment. Since the fix will require a breaking change to the Auth library, we want to make sure the updates will allow customers to meet various use cases before moving forward. This is something I plan on working on over the next couple weeks and will keep you updated.

[heikeschmitz]

Ok, great - thanks for the update! Heike

…

On Fri, Dec 9, 2022 at 2:13 PM Jordan Nelson ***@***.***> wrote: @heikeschmitz <https://github.com/heikeschmitz> - I don't have an ETA on a fix at the moment. Since the fix will require a breaking change to the Auth library, we want to make sure the updates will allow customers to meet various use cases before moving forward. This is something I plan on working on over the next couple weeks and will keep you updated. — Reply to this email directly, view it on GitHub <#2398 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2DYV7ZXSWPL36SVZ257V4LWMOVKDANCNFSM6AAAAAASG7SKWQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>