security - Cognito - how to refresh token using SDK when app client has secret

Question

I'm implementing backend for web application. My app client in AWS Cognito has secret, and I'm using it in InitiateAuth requests. I need username to calculate SECRET_HASH which should be used in those requests.

This SECRET_HASH works in the login/sign-in flow. Received tokens are sent to the frontend and idToken is stored in the React state and refreshToken as a cookie. If the user refresh the page the idToken is removed and new tokens should be received from the endpoint for refreshing tokens (using cookie). It's impossible because I need username for creating the SECRET_HASH.

I can store the idToken as a cookie too, but it looks like a less secure option. I can use for example Redis on the backend side to store mapping of refresh token to the username, but it looks like overengineering.

What is the best way to handle this? Should I send both tokens for refreshing or create mapping for username and refresh token on the backend side? Or maybe I'm missing something in the SDK and the REFRESH_TOKEN flow should be possible without username?

question from:https://stackoverflow.com/questions/65858353/cognito-how-to-refresh-token-using-sdk-when-app-client-has-secret

Answer 1

Waitting for answers