Authentication (Cognito)

Hosted UI, token refresh, route guards, and session handling.

All frontend applications authenticate via AWS Cognito. This page defines the shared auth pattern across Angular, React, and React Native.

Configuration

typescript

import { Amplify } from "aws-amplify";
 
Amplify.configure({
  Auth: {
    Cognito: {
      userPoolId: process.env.NEXT_PUBLIC_COGNITO_USER_POOL_ID!,
      userPoolClientId: process.env.NEXT_PUBLIC_COGNITO_CLIENT_ID!,
      loginWith: {
        oauth: {
          domain: process.env.NEXT_PUBLIC_COGNITO_DOMAIN!,
          scopes: ["openid", "email", "profile"],
          redirectSignIn: ["http://localhost:3000/callback"],
          redirectSignOut: ["http://localhost:3000/"],
          responseType: "code",
        },
      },
    },
  },
});

Token lifecycle

Token	Lifetime	Storage
Access	1 hour	Memory or secure storage
ID	1 hour	Memory or secure storage
Refresh	30 days	Secure storage (httpOnly cookie preferred for web)

Route guard pattern

Every protected route must verify session before rendering:

typescript

async function requireAuth() {
  const session = await fetchAuthSession();
  if (!session.tokens?.accessToken) {
    await signInWithRedirect();
    return false;
  }
  return true;
}

Logout

typescript

async function logout() {
  await signOut({ global: true });
  // Clear local stores
  useSessionStore.getState().reset();
  router.push("/login");
}