-
Notifications
You must be signed in to change notification settings - Fork 249
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Auth] Fetch Auth Session fail after relogin #1438
Comments
Hi @jack24254029 - Can you confirm you have seen this on both iOS and Android? |
Hi @Jordan-Nelson
|
I don't see this on Android, but I will keep observe it. |
@jack24254029 Okay, thanks for that info. Are you able to reproduce this behavior, or have you only been able to observe it via the logs? |
I am not sure how to reproduce this behavior. Yes, I only able to observe it with logs on production environment. |
Okay. What is the implementation of |
No, we use a rule to generate password.
|
@jack24254029 Is it possible that this is also happening after an initial log in as well (do you have logs in that scenario), or does it only occur in the scenario you have above? It could help to know if this is only happening after the initial session expires, or it it can be observed in other scenarios. |
There is a similar issue (#1271) reported for Android, but it is being observed after the initial sign in. |
I don't have log after the initial session, but I can add it. |
@jack24254029 do you have an idea of how frequently you see this happen? Roughly what percentage of the |
Fetch auth session fail first time about two or three users pre day. |
Active users of day in my app about thirty (Android and iOS) |
@jack24254029 is Are those two separate errors you have seen, and are those the exact messages? Have you seen any others? refreshTokenLog += 'fetch auth session fail again: ${error.message}\n'; |
I only saw two errors on fetch fail first time and one error on fetch fail second times
|
@jack24254029 I am unable to reproduce this. I have run an automated test that attempts to call fetchAuthSession every 5 minutes. If fetchAuthSession fails, sign out / sign in is called, and then fetchAuthSession is called again. All failures of fetchAuthSession are logged. The app I am testing with has session token expiration set to 5 minutes and refresh token expiration set to 60 minutes. I consistently see fetchAuthSession succeed for 60 minutes until the refresh token expires. At that point the tests calls sign out / sign in, and then consistently is able to call fetchAuthSession. I do not see a second failure after sign out / sign in. This is the behavior that I would expect. Can you log the full Can you also tell me what settings you have for token expiration (session token and refresh token)? You can find this in Cognito under "General Settings" -> "App Clients". For reference, here is the integration test code I am running. testWidgets(
'should sign a user back in after session expiration',
(WidgetTester tester) async {
await signIn();
for (int i in List.generate(1000, (index) => index)) {
print('starting test $i');
AuthSession? session;
int count = 0;
while (session == null) {
count++;
try {
session = await Amplify.Auth.fetchAuthSession(
options: CognitoSessionOptions(getAWSCredentials: true),
);
print('Fetch auth session succeeded.');
} on AmplifyException catch (error) {
print(
'Fetch auth session failed - count: $count, error: ${error.message}',
);
await Amplify.Auth.signOut();
await signIn();
}
}
await Future.delayed(Duration(minutes: 5));
}
},
timeout: Timeout(Duration(days: 1)),
); |
Our case is that when a user had login the app, and did not open the app more than seven days. |
What is the refresh token expiration set to? |
I have set to the minimum possible: access 10 min, refresh 1 hours. When these were my app client configurations, this error was happening a lot. Then I reverted it app client tokens configurations to access 1 hour and refresh 24 hours and it seems to be gone or happening a lot less. When I was investigating it I found out a big delay (more than 10 minutes, my access token expiration) between the signIn event in cognito console and the SessionExpired exception being thrown when fetching credential. I couldn't find a reason why this delay happened since the fetchAuthSession call was right after the signIn call. Additionaly, I don't understand why session wasn't refreshed when getting credentials, even when it is 10+ minutes after signIn. |
I believe it's because using the refresh token to get new tokens only returns a new access and ID token, meaning the refresh token has a fixed life. And once it's expired, you can no longer get new access/ID tokens so your session must expire. If your access token life is set to 10 minutes, that means you'll be using the refresh token every 10 minutes. |
Yeah, that's totally true. What I think is strange is the fact that user just signed in and in his first try to refresh its access token (I deduced it is first try because it happens right -sequentially- after signIn) gets SessionExpired. |
@jack24254029 - Are you able to tell if the user attempted to sign in after this? Since the refresh token is set to 30 days, the user will have to re-authenticate with a username and password after 30 days. So in this case, this may be expected behavior. |
Yes, the user can sign in after this. |
Any updates on this? We have another user (Galaxy S8) which is unable to signIn because SessionExpiredException is thrown right after sign in. He tried dozens of times but same behavior keeps happening. Logs: Same behavior I explained earlier: I can see the "Password:Success" on all of his attempts at "User event history" but his Android device is not showing up in the "Device tracking log" cognito session. Actually he tried with an iPhone 11 with same user credentials and he could login normally. |
Same issue user's cannot sign-in after 1 hour. User pool settings like: 30 days, 1 hour, 1 hour. It cannot be refreshed after 1 hour. I tried 30 Days, 5min, 5min. I cannot sign-in or system cannot be refreshed after 5 minutes.
I added on SessionExpiredException catch (e) { to fetchAuthSession and tried again and no luck. It's the so critical error. How can we refresh token? Here's my function
|
Hello everyone - We have been unable to reproduce this issue. However, I am going to label this as a bug since the info provided indicates there may be a race condition present. We have recently released a new developer preview version of the Auth category (amplify_flutter v1.0.0-next.0). This new version is a full re-write of the auth category in dart. While the primary purpose of this re-write was to add support for Web and Desktop, we also implemented a new design using state machines that is intended to solve issues such as race conditions. You can read more about the developer preview release in the blog post and docs. I believe this will address the issue described above. If you are willing to experiment with this new version while it is in dev-preview we would appreciate any feedback you have. I will provide an update on this ticket once this version is out of dev-preview and is ready for production use. Let me know if you have any questions. |
@MarlonJD - Were you able to reproduce this issue consistently? If so, could you share the steps you took to reproduce it? |
Hey, i couldn't remember so much, it was so long ago, but i remember that it was solved when i closed remember me option on cognito console on AWS. Maybe you can reproduce same error with remember me option true. |
@jack24254029 - We believe that this issue has been addressed in v1.0.0 of Amplify Flutter, which is now stable. Would you please upgrade to the latest version and let us know if you still observe this issue? This release also includes web and desktop support for Auth, API, Analytics, and Storage. You can see the list of new features and bug fixes in the release notes, and see more details on how to migrate in the upgrade guide. |
OK. I will try it. Thank you very much. |
Hello @jack24254029 - I wanted to check in to see if you have had a chance to migrate to the latest version of amplify flutter. Let me know if you are facing any issues. |
I had migrated it in Dev enviroment. It looks like well. |
Great to hear. I am going to close this out. If you face any issue when moving to production, please let me know and I can re-open this. |
Description
When call
fetchAuthSession
fail first time, the app will call signout and signin then callfetchAuthSession
again, but it still fail.Categories
Steps to Reproduce
User DON'T refresh token after a week or more maybe can reproduce this behavior.
Screenshots
No response
Platforms
Environment
Dependencies
Device
(Maybe more)
OS
(Maybe more)
CLI Version
N/A
Additional Context
When
idToken
is expired, I calledfetchAuthSession
to refresh token, but sometimes had a exception, likeYour session has expired.
orSession expired could not fetch user sub
.When I got the exception on first time, I called sing out and signin then
fetchAuthSession
again, sometimes it return a exception, likeThere is no user signed in to retreive user sub
.How do I resolve this issue?
Thank you.
Code
The text was updated successfully, but these errors were encountered: