Client Error: TypeError: resp is undefined on transaction submission
#31
Conversation
| async function logout() { | ||
| console.log('Logout called') | ||
| clearCookies(); | ||
| setAuthenticated(false); | ||
| window.location.href = buildLogoutHref(); | ||
| } | ||
|
|
There was a problem hiding this comment.
Non-blocking, but important: would you be amenable to us adding a backlog issue to research revoking tokens as well to ensure misconfigured or browsers on compromised systems do not "get logged out" when they think they are? This peeves me in personal contexts, and it seems AWS might support it.
https://docs.aws.amazon.com/cognito/latest/developerguide/token-revocation.html
I'd like to spike and consider this, after reviving our threat model. Thoughts? /cc @Compton-NIST
There was a problem hiding this comment.
Is that not what the logout endpoint does? https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
This function redirects the user to cognito's logout URL after clearing the cookies.
There was a problem hiding this comment.
It is not clear to me if we are doing GlobalSignOut or not and like all good web technology, the answer is almost always more complicated and "well, it depends!"
aws-amplify/amplify-js#3435 (comment)
This is why I wanted to threat model and spike accordingly, since I am a little iffy on the details, I'd like to be 100% certain and proven that I was off-base. 😆
There was a problem hiding this comment.
To be clear, I am worried about the refresh tokens since those are the focus of the revocation, but their official docs are confused by AWS devs saying how Cognito operates against API calls, so maybe I am overreacting. 🤷
Fixes #30 and Fixes #29