FormidableLabs / FormidableLabs/react-native-app-auth

Not Providing sendClientId on revoke leads to successful operation even though it is failing with cognito

Open
#774 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.3k
Forks
473
PR merge metrics
No merged PRs in 30d

Description

## Issue

Hi, this is the first time, I report anything to an open source project. So I hope, I am doing it alright ^__^

When revoking a token for Cognito, it is not required to use the `sendClientId: true`-parameter. However, when failing to do so on android (I did not test it for iOS), the operation is still successful, but the token is not revoked. The expected behavior from my point of view would be that the operation fails and an error is thrown, when the token is not revoked, because of the missing parameter.

Furthermore, I noticed that the parameter is also missing in the cognito example, should it be added there?

The problem can be reproduced like this:

```js
import {authorize, refresh, revoke} from 'react-native-app-auth';

revoke(config, {tokenToRevoke: auth.refreshToken})
.then(() => {
console.log('success');
//This should not be reached, while the token is still valid
refresh(config, {
refreshToken: auth.refreshToken,
}).catch(err => {
console.log(err);
});
})
.catch(err => {
console.log(err);
console.log('fail');
});

```

Could you verify, if this is only a problem on my end or a general one? If you need more input, don't hesitate to ask =)

## Environment

* **Your Identity Provider**: `Cognito`
* **Platform that you're experiencing the issue on**: `Android`
* **Are you using Expo?** - No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.