Amplify-ios: Amplify.Auth.fetchAuthSession is returning expired token

[Vivek205]

Describe the bug
I have set the token expiry to 5 mins in the AWS console. I'm calling Amplify.Auth.fetchAuthSession in the ios swift application to retrieve the idToken for making API calls. But, the method is returning the same token even after 5 mins.

To Reproduce
Steps to reproduce the behavior:

1. Change token expiry to 5 mins.
2. In the ios swift app, call the method Amplify.Auth.fetchAuthSession. It will return an IdToken. Store the token somewhere.
3. Don't close the app.
4. Call the same method after 5-6 minutes. It will return the same expired token.

Expected behavior
I expect that Amplify.Auth.fetchAuthSession will return a new token once the old one is expired

Environment(please complete the following information):

• PODS

PODS:
  - Amplify (1.4.0):
    - Amplify/Default (= 1.4.0)
  - Amplify/Default (1.4.0)
  - AmplifyPlugins/AWSAPIPlugin (1.4.0):
    - AppSyncRealTimeClient (~> 1.4.0)
    - AWSCore (~> 2.18.0)
    - AWSPluginsCore (= 1.4.0)
    - ReachabilitySwift (~> 5.0.0)
  - AmplifyPlugins/AWSCognitoAuthPlugin (1.4.0):
    - AWSAuthCore (~> 2.18.0)
    - AWSCognitoIdentityProvider (~> 2.18.0)
    - AWSCognitoIdentityProviderASF (~> 2.18.0)
    - AWSCore (~> 2.18.0)
    - AWSMobileClient (~> 2.18.0)
    - AWSPluginsCore (= 1.4.0)
  - AppSyncRealTimeClient (1.4.1):
    - Starscream (~> 3.1.0)
  - AWSAuthCore (2.18.0):
    - AWSCore (= 2.18.0)
  - AWSCognito (2.18.0):
    - AWSCore (= 2.18.0)
  - AWSCognitoIdentityProvider (2.18.0):
    - AWSCognitoIdentityProviderASF (= 2.18.0)
    - AWSCore (= 2.18.0)
  - AWSCognitoIdentityProviderASF (2.18.0)
  - AWSCore (2.18.0)
  - AWSMobileClient (2.18.0):
    - AWSAuthCore (= 2.18.0)
    - AWSCognitoIdentityProvider (= 2.18.0)
    - AWSCognitoIdentityProviderASF (= 2.18.0)
    - AWSCore (= 2.18.0)
  - AWSPinpoint (2.18.0):
    - AWSCore (= 2.18.0)
  - AWSPluginsCore (1.4.0):
    - Amplify (= 1.4.0)
    - AWSCore (~> 2.18.0)
    - AWSMobileClient (~> 2.18.0)
  - AWSSNS (2.18.0):
    - AWSCore (= 2.18.0)

• Dependency Manager: Cocoapods
• Swift Version : 5.0

Device Information (please complete the following information):

• Device: All phones and simulator
• iOS Version: ios 14
• Specific to simulators: No

[valzevul]

I am facing the same issue with fetchAuthSession returning an outdating token, would be great to find a solution.

On that note, as per the docs it's better to set the expiration time at least to 7 minutes:

If the minimum for the access token and ID token is set to 5 minutes, and you are using the SDK, the refresh token will continually refresh. To see the expected behavior, set a minimum of 7 minutes instead of 5 minutes.

[Vivek205]

@valzevul , is it working after setting the expiration time to 7 minutes?

[valzevul]

@Vivek205 partly; we also had to disable device tracking in the dashboard and after that the token seems to refresh properly, however the SDK occasionally crashes on featchAuthSession as authenticationProvider turns into nil.

[royjit]

This is a bug from the underlying Cognito SDK, the token refresh was not triggered if id token expired. I have created a pull request to address this issue - https://github.com/aws-amplify/aws-sdk-ios/pull/3220

[royjit]

The change is released in the latest version of Amplify 1.4.3. Please verify that it works for you now. If you are still facing any issue feel free to open a new issue.

[Vivek205]

@royjit
I see int expiryWindow = 2 * 60; in the PR https://github.com/aws-amplify/aws-sdk-ios/pull/3220

But may I know why this expiry window is hardcoded?
I can edit the validity of the token in the Cognito user pool console, can't that value be fetched dynamically?