Find out if a user is currently authenticated / has an active session

[antonio-masotti]

Hi,

thanks first of all for the great work you're all doing.

I am wondering if there is a way to find out if a given user is currently logged in. We have a frontend which is an Amplify App and a Backend written in PHP. In the frontend I can retrieve the currently authenticated user using Auth.currentSession (from the @aws-amplify package), but is there a way from the backend, given some parameters (username, accessToken, userPool etc...), to find out if the user making a request is also currently active?

I could not find anything in this direction in the docs but probably I'm missing / overseeing something.

Thanks a lot in advance!

[yenfryherrerafeliz]

Hi @antonio-masotti, thanks for reaching out. I am searching and gathering the right information in order to provide you the most accurate answer, so that I am going to use this thread to provide you an update as soon as I get it.

Thanks!

[yenfryherrerafeliz]

Hi @antonio-masotti, in order to continue with researching in regarding with your inquire, could you please:

• Provide more details about your backend implementation?
• Are you using aws cognito to manage your user's authentication?
• If the answer above is yes, which authentication method are you using to log in your users?
• Could you please provide any other details you think would be helpful to understand your implementation.

Thanks!

[antonio-masotti]

Hallo @yenfryherrerafeliz

Thanks a lot for your efforts!

Provide more details about your backend implementation?

The backend is just a Php Symfony (v.5) project which exposes an API. The Amplify frontend depends on this API to perform all sorts of CRUD operations and checks. Each request is authentificated and authorized using the Cognito JWT Access-Token sent with the Request by the authentificated users interacting with the Amplify frontend.

Are you using aws cognito to manage your user's authentication?

Yes we do.

If the answer above is yes, which authentication method are you using to log in your users?

I'm not quite sure, which details you need here. We have a login form where the users can enter Username and Password and we use these infos to log them in. We're not using Federated Identitities, MFA or SSO at moment (though this features are in the planing)

Could you please provide any other details you think would be helpful to understand your implementation.

The use cas, I was thinking of here, is that in some cases we generate URLs for downloading assets that contain a Cognito Token and I want them to work only if the user is currently logged in. So if someone copies that URL or even without URLs tries to replicate a Request with the Access-Token in the header but it's not the user currently logged in, then I want to deny the access. For that I need to know if the user sending the request or calling the URL is authenticated or not.