I Tried Out Cognito's Newly Added Support for Forced Session Revocation

Amazon Cognito user pools can now force-revoke specific sessions chosen from a list. On the Essentials plan, I tried both admin IAM-authenticated and access-token revocation and confirmed revoked tokens no longer work with Cognito APIs.

Amazon Cognito AWS アップデート認証認可 AWS CLI

suzuki.ryo

2026.11.13

This page has been translated by machine translation. View original

Introduction

On November 11, 2026, Amazon Cognito user pools gained the ability to forcibly revoke sessions.

In addition to the existing operation that revokes all of a user's tokens when an incident such as a lost device occurs, you can now list sessions and revoke only a specific session.

Enabling Session Tracking

For verification, I used AWS CLI 2.40.1 and created an Essentials-plan user pool and an app client in the Tokyo region.

aws cognito-idp create-user-pool \
  --pool-name <pool-name> \
  --user-pool-tier ESSENTIALS

aws cognito-idp create-user-pool-client \
  --user-pool-id <user-pool-id> \
  --client-name <client-name> \
  --no-generate-secret \
  --explicit-auth-flows ALLOW_USER_PASSWORD_AUTH ALLOW_REFRESH_TOKEN_AUTH

Session tracking is off by default. It can be enabled only for user pools on the Essentials or Plus plan; the Lite plan is not supported. In user pools where a Pre Token Generation trigger adds its own sid claim, sessions are not tracked even if tracking is enabled. Enable it with the following command.

aws cognito-idp set-user-pool-session-configuration \
  --user-pool-id <user-pool-id> \
  --user-session-tracking ENABLED \
  --token-session MaxPerUser=20

This command replaces the entire configuration, so you cannot omit --token-session even if you are not changing it. Here I specified 20, the same as the default value. For a user pool that already has a different value set, specify the current value.

Signing In and Listing Sessions

I created the test user with admin-create-user and made the password permanent with admin-set-user-password --permanent. I signed in with the same user three times via the initiate-auth API, and a token session was created each time. Hereafter, I'll call them token sessions A, B, and C, in order from the first sign-in.

aws cognito-idp initiate-auth \
  --client-id <client-id> \
  --auth-flow USER_PASSWORD_AUTH \
  --auth-parameters USERNAME=testuser1,PASSWORD=<password>

Get the list with admin-list-user-sessions.

aws cognito-idp admin-list-user-sessions \
  --user-pool-id <user-pool-id> \
  --username testuser1

{
    "Sessions": [
        {
            "SessionId": "tknoba4eiihr6yj9gqz3a1ys22wo",
            "SessionType": "TOKEN",
            "ClientId": "1example23456789abcdefghij",
            "CreateDate": "2026-11-13T02:38:30.995000+09:00",
            "LastActiveDate": "2026-11-13T02:38:30.995000+09:00",
            "DeviceType": "aws-cli 2, Linux",
            "LastIPAddress": "203.0.113.10",
            "LastLocation": {
                "City": "Yokohama",
                "Country": "Japan"
            },
            "IsCurrentSession": false
        },
        {
            "SessionId": "tknmgg3d7gn7wgz1hg5v5a0nslot",
            "SessionType": "TOKEN",
            "ClientId": "1example23456789abcdefghij",
            "CreateDate": "2026-11-13T02:38:33.796000+09:00",
            "LastActiveDate": "2026-11-13T02:38:33.796000+09:00",
            "DeviceType": "aws-cli 2, Linux",
            "LastIPAddress": "203.0.113.10",
            "LastLocation": {
                "City": "Yokohama",
                "Country": "Japan"
            },
            "IsCurrentSession": false
        },
        {
            "SessionId": "tknwzjaxloc19unujct3hsko60fc",
            "SessionType": "TOKEN",
            "ClientId": "1example23456789abcdefghij",
            "CreateDate": "2026-11-13T02:38:36.497000+09:00",
            "LastActiveDate": "2026-11-13T02:38:36.497000+09:00",
            "DeviceType": "aws-cli 2, Linux",
            "LastIPAddress": "203.0.113.10",
            "LastLocation": {
                "City": "Yokohama",
                "Country": "Japan"
            },
            "IsCurrentSession": false
        }
    ]
}

Because I signed in three times from the same device, the device type, IP address, and location information were the same for all three entries. The sid claim in each of the access tokens for A, B, and C matched the corresponding SessionId in the list.

Revoking Sessions

Previously, you could revoke all of a user's tokens with AdminUserGlobalSignOut. If tracking is enabled, this operation also revokes all token sessions and SSO sessions. The newly added revocation APIs let you revoke only a specific session, identified by the session ID in the list.

Revocation by an Administrator

Before revocation, get-user with token session A's access token succeeded, and refreshing the tokens with the refresh token also succeeded. Next, using the administrator's IAM authentication, I ran admin-revoke-user-session, specifying the username and session ID, to revoke A. The command succeeded with no output.

aws cognito-idp admin-revoke-user-session \
  --user-pool-id <user-pool-id> \
  --username testuser1 \
  --session-id tknoba4eiihr6yj9gqz3a1ys22wo

After revocation, both get-user with A's access token and token refresh with the refresh token failed.

aws cognito-idp get-user \
  --access-token <A のアクセストークン> \
  --no-sign-request

aws: [ERROR]: An error occurred (NotAuthorizedException) when calling the GetUser operation: Access Token has been revoked

aws cognito-idp initiate-auth \
  --client-id <client-id> \
  --auth-flow REFRESH_TOKEN_AUTH \
  --auth-parameters REFRESH_TOKEN=<A のリフレッシュトークン> \
  --no-sign-request

aws: [ERROR]: An error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Refresh Token has been revoked

A also disappeared from the list.

aws cognito-idp admin-list-user-sessions \
  --user-pool-id <user-pool-id> \
  --username testuser1 \
  --query 'Sessions[].{SessionId:SessionId,SessionType:SessionType}'

[
    {
        "SessionId": "tknmgg3d7gn7wgz1hg5v5a0nslot",
        "SessionType": "TOKEN"
    },
    {
        "SessionId": "tknwzjaxloc19unujct3hsko60fc",
        "SessionType": "TOKEN"
    }
]

Revocation by the User Themselves

revoke-user-session is called with the user's own access token. IAM authentication is not required. Using token session B's access token, I revoked another session, C, of the same user.

aws cognito-idp revoke-user-session \
  --access-token <B のアクセストークン> \
  --session-id tknwzjaxloc19unujct3hsko60fc \
  --no-sign-request

get-user with C's access token failed with Access Token has been revoked. Refreshing tokens with the refresh token failed with Refresh Token has been revoked. Both are the same errors as for A.

When I tried to revoke B's own session using B's access token, it was rejected with a ForbiddenException.

aws: [ERROR]: An error occurred (ForbiddenException) when calling the RevokeUserSession operation: The current session cannot be revoked with RevokeUserSession.

Since the session of the access token used for the call cannot be revoked, this API cannot be used for an app's sign-out button. When I finally retrieved the list, only B remained.

Summary

Cognito's session management has been strengthened, making it possible to view a user's sessions and forcibly revoke specific sessions.

Because a user can revoke their other sessions with their own access token, this can also serve as a way for a user who notices suspicious activity to stop those sessions themselves.

However, revoked tokens become invalid immediately only when verified through Cognito APIs. Note that JWT libraries that verify only the signature and expiration will still judge revoked tokens as valid.