AWS cognito: Cognito refresh token doc: copy edits to token revocation/GlobalSignOut text
Summary
Editorial-only changes: fixes the misspelled API name 'AdminitiateAuth' to 'AdminInitiateAuth', corrects grammar ('will revoke' -> 'revokes', 'all current signed-in session' -> 'sessions'), and replaces en-dash with em-dash in the description of a valid access token ('valid–unaltered, unexpired, not-revoked–' -> 'valid—unaltered, unexpired, not-revoked—'). No substantive guidance, behavior, or security semantics were changed.
Security assessment
The only changed lines are typographic/grammatical fixes to already-published text about refresh token rotation, refresh token revocation, and GlobalSignOut. The revoked-token behavior (revoking a refresh token invalidates ID/access tokens issued from it) and the statement that GlobalSignOut is token-authorized so one user cannot sign out another are unchanged in substance; no new control, advisory, or vulnerability fix is introduced.
Evidence
+**InitiateAuth and AdminInitiateAuth**
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.md index 6640eec..5895e11 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.md @@ -22 +22 @@ The [GetTokensFromRefreshToken](https://docs.aws.amazon.com/cognito-user-identit -**InitiateAuth and AdminitiateAuth** +**InitiateAuth and AdminInitiateAuth** @@ -34 +34 @@ The [token endpoint](./token-endpoint.html) in user pools with a [domain](./cogn -You can optionally configure refresh token rotation in your app client. With refresh token rotation, your client can invalidate the original refresh token and issue a new refresh token with each token refresh. When this setting is enabled, each successful request in all forms of token refresh return a new ID, access, _and_ refresh token. When this setting is disabled, token-refresh requests return new access and ID tokens only and the original refresh token remains valid. The new refresh token is valid for the remaining duration of the original refresh token. You can configure [app clients](./user-pool-settings-client-apps.html) to rotate refresh tokens or to carry over the original refresh token. To allow for retries for a brief duration, you can also configure a grace period for the original refresh token of up to 60 seconds. +You can optionally configure refresh token rotation in your app client. With refresh token rotation, your client can invalidate the original refresh token and issue a new refresh token with each token refresh. When this setting is enabled, each successful request in all forms of token refresh returns a new ID, access, _and_ refresh token. When this setting is disabled, token-refresh requests return new access and ID tokens only and the original refresh token remains valid. The new refresh token is valid for the remaining duration of the original refresh token. You can configure [app clients](./user-pool-settings-client-apps.html) to rotate refresh tokens or to carry over the original refresh token. To allow for retries for a brief duration, you can also configure a grace period for the original refresh token of up to 60 seconds. @@ -160 +160 @@ You can revoke refresh tokens that belong to a user. For more information about -Revoking the refresh token will revoke all ID and access tokens that Amazon Cognito issued from refresh requests with that token. +Revoking the refresh token revokes all ID and access tokens that Amazon Cognito issued from refresh requests with that token. @@ -162 +162 @@ Revoking the refresh token will revoke all ID and access tokens that Amazon Cogn -To sign users out from all current signed-in session, revoke all of their tokens with [GlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html) or [AdminUserGlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html) API requests. After the user is signed out, the following effects happen. +To sign users out from all current signed-in sessions, revoke all of their tokens with [GlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html) or [AdminUserGlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html) API requests. After the user is signed out, the following effects happen. @@ -173 +173 @@ To sign users out from all current signed-in session, revoke all of their tokens -With refresh tokens, you can persist users' sessions in your app for a long time. Over time, your users might want to deauthorize some applications where they have stayed signed in with their refresh tokens. To sign your user out from a single session, revoke their refresh token. When your user wants to sign themself out from all authenticated sessions, generate a [GlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html) API request . Your app can present your user with a choice like **Sign out from all devices**. `GlobalSignOut` accepts a user's valid–unaltered, unexpired, not-revoked–access token. Because this API is token-authorized, one user can't use it to initiate sign-out for another user. +With refresh tokens, you can persist users' sessions in your app for a long time. Over time, your users might want to deauthorize some applications where they have stayed signed in with their refresh tokens. To sign your user out from a single session, revoke their refresh token. When your user wants to sign themself out from all authenticated sessions, generate a [GlobalSignOut](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html) API request . Your app can present your user with a choice like **Sign out from all devices**. `GlobalSignOut` accepts a user's valid—unaltered, unexpired, not-revoked—access token. Because this API is token-authorized, one user can't use it to initiate sign-out for another user.