Cookie storage limit problem with Cognito

[adilek]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React

Amplify APIs

Authentication

Amplify Categories

auth

Environment information

# Put output below this line

Not relevant

Describe the bug

When Cognito user pool client id changes, new sign-in tries to create new cookie elements. Eventually it gets larger. Then CloudFront blocks it.

One possible solution would be clearing all Cognito related cookies before new signin.

There are already two tickets for this matter. But Amplify team seems ignore them. Not customer obsessive :)

#1545
#5330 (comment)

Expected behavior

No server-side error must happen.

Reproduction steps

To reproduce:

1. Log in to your app using Cognito.
2. Change the client id in Cognito.
3. Login again.
4. Repeat 1.

After 3rd iteration you get the error message from the CloudFront.

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[haverchuck]

@adilek Are you using Cognito Hosted UI?

[adilek]

@adilek Are you using Cognito Hosted UI?

We do not use hosted UI due its limitations. Instead we use APIs from Amplify to work with Cognito.

[chrisbonifacio]

Hey @adilek 👋 thanks for raising this issue. We've opened an internal ticket with the Cognito team to see if this can be addressed on the service side or if they have any feedback/recommendations on how to mitigate it. Will respond back with any updates.

[rdsedmundo]

I'm also getting this, CloudFront error is "494 ERROR The request could not be satisfied.", for what it's worth it.

LocalStorage is not a secure option for session storage and is discouraged by OWASP, it's a shame that after several years the Amplify/Cognito teams haven't addressed this. The first issue I could find on this dates from as early as Feb 2018.

#1545
amazon-archives/amazon-cognito-identity-js#688

[rdsedmundo]

After some investigations I figured out that at least in our case, where the base tokens are not that big as we don't have lots of custom claims, that the issue is Amplify/Cognito not cleraing up device data from the storage, and it starts to pile up as you log out and log in again, especially when different accounts are used. Eventually you then hit the CloudFront limits.

The keys that keep repeating themselves are:

CognitoIdentityServiceProvider.{$USER_POOL_CLIENT_ID}.${COGNITO_USER_COGNITO_ID}.randomPasswordKey
CognitoIdentityServiceProvider.{$USER_POOL_CLIENT_ID}.${COGNITO_USER_COGNITO_ID}.deviceGroupKey
CognitoIdentityServiceProvider.{$USER_POOL_CLIENT_ID}.${COGNITO_USER_COGNITO_ID}.deviceKey

Those keys are saved even if the "Remember me" option is not checked.