Removing a user from a group in a Cognito user pool doesn't take effect until they logout and back in

Question

We have a Cognito User Pool which is connected to an AppSync API. In the graphql.schema we limit which users can access which endpoints like this:

type Mutation {
    createProject(projectInput: CreateProjectInput!): Project!
        @aws_auth(cognito_groups: ["StandardUsers"])
}

The AppSync endpoints fire Lambdas which get the details of the Cognito user used to authenticate like this:

const cognitoIdentity: AppSyncIdentityCognito = event.identity as AppSyncIdentityCognito

const user: User = {
    id: cognitoIdentity.sub,
    username: cognitoIdentity.username,
    groups: cognitoIdentity.groups
}

We're authenticating using the Amplify JS library.

The user can happily hit the endpoint when part of the Cognito group, but if I remove them (via the AWS console) they can continue to hit the endpoint!!

If they logout and back in they are then denied access to the endpoint.

How can have an immediate "kill switch" to ensure users no longer have these privileges?

Answer 1

Cognito is a stateless authentication method by design. Once a user logs in they are given tokens for that particular session. So until these tokens expire they get all the privileges defined in these tokens. You cannot manually expire these tokens once issued, but you can blacklist them using your own implementation.

Your requirement is for stateful authentication. You will need to implement this yourself using a database and custom authorizers that check for "blacklisted" tokens.