Support logging out about cognito-at-edge

[vaunus]

@vigneshprabhud you need to setup a logout uri as part of your lambda logic and then do a 302 redirect and clear the cookies as part of that same lambda response.

Something like this:

const { request } = event.Records[0].cf

if (request.uri === '/logout') {
  const location = `https://${userPoolDomain}/logout?redirect_uri=${url.origin}&response_type=code&client_id=${userPoolAppId}&state=${state}`

  const response = {
    status: '302',
    headers: {
      location: [{ key: 'Location', value: location }],
      'set-cookie': [
        `cookie1=; Domain=${cookieDomain}; Expires=${new Date(0)}; Secure`,
        `cookie2=; Domain=${cookieDomain}; Expires=${new Date(0)}; Secure`
      ]
    }
  }
}

Hope that helps!

[jeandek]

Hi Vaughan, I'm glad that this package is useful for you, but I don't think what you are describing is a good fit.

Logging out and invalidating Cognito tokens should be handled by your application. For example, it can be done using the Amplify framework. You can also write your own implementation that calls the Cognito LOGOUT endpoint if you don't want or can't use Amplify, but it should live client-side. From a Lambda function, it would not be possible to clear the user's cookies.

Please tell me if I'm missing something.

[vaunus]

No problem @jeandek I will adapt our own custom lambda for these purposes then.

FYI it is definitely possible to clear cookies via the lambda. I already have this working via my POC lambda. Just set Expires=Thu Jan 01 1970 00:00:00 GMT+0000 (Coordinated Universal Time); or some other date in the past. I believe this is how cookies are expired server side anyway.

Anyway, I will close the issue for now, thanks for getting back to me 👍🏻

[jeandek]

TIL, I did not know about expiring cookies from the server.

I discussed your request with the team and we agreed that it could be a useful feature to have in some environments. The implementation you described in the original post also would not increase the package's complexity unreasonably. If you're willing to submit a PR, we'd be happy to review it.

[vigneshprabhud]

@vaunus I have the same problem as you mentioned. How did to manage to clear cookies and redirect to logout url of Cognito? Is there a snippet that you could share? thanks.