Just implemented an OAuth2 authentication with AWS Cognito and came across this issue:
I am re-generating an id_token with my refresh_token using this endpoint:
/oauth2/token
grant-type: refresh_token
but when my refresh_token is expired, I don't want the user to go through the login process again. Is there any way of "refresh the refresh_token"?
Also, I don't want my refresh_token to have infinite (or 9999 years) of validity time.
What should I do? Thank you.
No you cannot get a fresh refresh token without having the user sign in again. That's the whole point of a refresh token. You can have a refresh token for a reasonable time like a month and then forcefully invalidate it if user signs out though.