Cognito OAuth Token Tester

A local, browser-only tool to fetch and inspect AWS Cognito OAuth tokens (id_token, access_token, refresh_token) for multiple users federated through Entra ID. It forces a fresh, per-user login on every request so the external IDP's cached session can't silently return the wrong user's token.

Run

Without installing (uses the published build):

npx cognito-oauth-token-tester

This serves the app at http://localhost:4173 (override with PORT).

From source (for development):

npm install
npm run dev

Open http://localhost:5173.

Cognito app client requirements

• Public client, no client secret.
• PKCE enabled, grant type Authorization code.
• Allowed callback URL includes http://localhost:5173 (must match the Redirect URI you enter in the app exactly).
• Allowed sign-out URL includes http://localhost:5173 (required for the logout-first flow below).
• Entra ID configured as an OIDC identity provider on the user pool; note its provider name (for identity_provider) or set an idp_identifier alias.

Entra app registration requirements (for the logout-first flow)

• A post-logout redirect URI of http://localhost:5173 registered in the Entra app registration (Authentication → Front-channel logout / redirect URIs).
• Your tenant id or domain (e.g. contoso.onmicrosoft.com), entered in the app's Entra tenant config field.

How it forces the right user

Important: Cognito does not reliably forward login_hint/prompt to a federated IdP like Entra. So those params alone do not switch users — Entra's cached SSO session silently returns whoever is already signed in. That is why this tool clears the sessions first.

Logout-first flow (default, recommended). When force fresh login is on, each Get Token click runs this sequence before authorizing:

1. Cognito sign-out (/logout) — clears the Cognito hosted-UI session.
2. Entra logout (/oauth2/v2.0/logout) — clears the Entra SSO cookie (only if an Entra tenant is configured).
3. Authorize — now Cognito re-federates and Entra is forced to prompt, so you can sign in as the user you actually picked.

The authorize request still sends (each toggleable in the UI):

• identity_provider / idp_identifier — skip the Cognito chooser, go to Entra.
• login_hint=<email> — preselect the user if your setup forwards it.
• prompt=login — request a fresh login if your setup forwards it.

If you turn force fresh login off, the app skips the logout steps and relies only on those params — which may return the cached user (see the note above).

Usage

1. Fill in Cognito Configuration (saved to localStorage), including the Entra tenant if you want the Entra session cleared.
2. Add user emails under Users.
3. Click Get Token → for a user. The app clears the cached sessions, then Entra prompts you — sign in as that user — and you return with tokens.
4. Each user gets a token card with a live expiry countdown, Refresh, auto-refresh toggle, copy buttons, and JWT decode.
5. Verify you got the right user: expand decode on the id_token and check the email/sub claims match the user you picked.

Tests

npm run test

Security note

This is a local developer/testing tool. Tokens are stored in localStorage for convenience across the redirect round-trip. Do not deploy it as-is to a shared or public host.