AWS Cognito: Restrict users to a one login at a time

user_4233951 0
Viewed 3571

Is there any way to restrict users to a single [simultaneous] session?

I'd like to be able to check if the current user already has a session. If they do, then they can opt to sign that session out, before continuing.

To be clear, at the moment it is possible to login the same user from multiple browser tabs, (from the same cognito application)

cognitoUser.authenticateUser(authenticationDetails, {
  cognitoUser: this.cognitoUser,
  onSuccess: (result) => {
    this.userSession = result
    console.log('successfully logged in', result)
    // But are they already logged in somewhere else?
  },
  onFailure: (error) => {
    console.log('Login failed for some reason...')
    callback(error)
  }
}

I understand that Cognito is built with mobiles/apps in mind so this might not be possible without using a login lambda hook... ? Even then I'm not sure if it's possible without maintaining a table of logged in users...?!

amazon-cognito
2 Answers

I used the admin API - "AdminUserGlobalSignOut" for invalidating all the session tokens provided to the user before I send the login request from my lambda to Cognito.

You can refer to this link for official docs from aws.

https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html

Pro Tip - AdminUserGlobalSignOut endpoint kills the refresh token validity not the Id Token validity - so if the creds are shared at 12pm and the user signs in using another device in 5 mins or so - the first device ID token login will still work on the first device until its not expired - by default ID Token is valid for 1 hour.

user_31993510
Related