Is it possible to revoke AWS Cognito IdToken?

Question

Is it possible to revoke AWS Cognito IdToken got after user authentication with it's username and password?

In my usecase the access to API Gateway endpoints is restricted by Cognito User Pool Authorizer which takes IdToken as an argument in request.headers.Authorizer. I am looking for way to block current user's IdToken.

In AWSJavaScriptSDK is a function globalSignOut({AccessToken}) which revokes the accessToken: http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityServiceProvider.html#globalSignOut-property

Is it possible to revoke the IdToken the same or similar way?

For interested: I've created an issue on aws-sdk-js: https://github.com/aws/aws-sdk-js/issues/1687

user_6252528 · Answer

It is not. Even if there is a documentation stating that, the minimum expiration time of 60 minutes is unacceptable if you really take the security of your application seriously.

Here is an article describing some AWS Cognito flaws: 3 things you should know before using AWS Cognito as authenticator

Is it possible to revoke AWS Cognito IdToken?

3 Answers