Users are randomly getting logged out

[afriedmanGlacier]

Describe the bug

We believe this is similar to #3969, several times lately when opening the app, users are coming to a login screen because the fetchAuthSession throws an error or is not signed in. We've seen this several times in the past two weeks (reported by production users), but we have not been able to reproduce it in testing.

Our refresh token is set to 3 years, and each of these users logged in within the last few months. We are currently using Amplify 2.45.3. Unfortunately we do not have logs that give more info, and we cannot reproduce the issue.

We believe the connectivity is good in these cases. Restarting the app does not fix the issue.

Here is simplified code snippets. setupAmplify is called from didFinishLaunchingWithOptions

    @objc func setupAmplify() {
        do {
            try Amplify.add(plugin: AWSAPIPlugin())
            try Amplify.add(plugin: AWSCognitoAuthPlugin())
            try Amplify.add(plugin: AWSS3StoragePlugin())
            try Amplify.configure()
            
            Task {
                let signedIn = await self.fetchCurrentAuthSession()
                
                if signedIn == false {
                    //login or re-login
                }
            }
            
        } catch {
            print("Failed to initialize Amplify: \(error)")
        }

    func fetchCurrentAuthSession() async -> Bool {
        do {
            let session = try await Amplify.Auth.fetchAuthSession()
            
            if session.isSignedIn {
                await self.fetchAttributes()
                return true
            }  else { 
                //handle this case
            }
            
        } catch let error as AuthError {
            print("Fetch session failed with error \(error)")
        } catch {
            print("Unexpected error: \(error)")
        }
        
        return false
    }

Expected behavior

Stays logged in or refreshes login until refreshToken expires

Amplify Framework Version

2.45.3

Amplify Categories

Auth

Dependency manager

Swift PM

Swift version

6.0.2

CLI version

12.13.1

Xcode version

16.1

Platforms

iOS

OS Version

18.3.2

Device

iPhone 12

[afriedmanGlacier]

I realize this is difficult without logs and without a good way to reproduce!

[harsh62]

@afriedmanGlacier does your code listen to session expired events/errors?

[afriedmanGlacier]

@harsh62 Yes, we do listen to session expired events/errors, but we don't currently have any kind of logging (ie Firebase Crashlytics, etc) that would report what is happening in the field. It's possible we aren't handling session expired correctly, but from my understanding, it appears users are actually being logged out. The reason I say this is once we get a situation where fetchAuthSession fails, restarting the app (and thus running fetchAuthSession again) any number of times doesn't work. It will continue to fail and bring up the login screen. Further, I believe fetchAuthSession is supposed to refresh tokens automatically such that session is renewed anyway, right?

If we need to add logging there we can, but I'm not sure of the right place to put it where we would catch anything until we are already logged out. This seems to happen on app restart when it first tries to re-establish the session.

If it sounds like I am misunderstanding anything, or there's anything in particular I should try, please let me know!

[tylerjroach]

@afriedmanGlacier You aren't setting the globalSignOut option in signOut are you? This could be another possibility, in addition to any server side process you have that could remove user tokens.

If a user were to log in on multiple devices and sign out on one device (with global sign out = true), it would render the tokens on the other device as invalid.

I know this is probably not the case, but did want to mention it just in case.

[afriedmanGlacier]

@tylerjroach I'm actually glad you asked that. I forgot that as of a few months ago, we ARE setting the globalSignOut, but only on an intentional logout. In other words, only if they intentionally click a Log Out button (which is not on a main screen and has a verification, so it would be hard to do accidentally and without knowing). We don't have any server side process to remove user tokens.

We do have some users that have multiple devices, but the ones this happened to recently are single device users. But again, I'm glad you mentioned this possibility because I need to circle back and make sure that's what we want (tokens invalidated across all devices for that user) when someone actually does choose to logout.

I don't believe this solves our current problem, but thank you for checking!