Amplify.Auth.signOut() Fails to Sign Out Locally with UnknownServiceException in Flutter

[AntoniKwok]

Description

When calling Amplify.Auth.signOut() in the Flutter app, the sign-out process intermittently fails with an UnknownServiceException and "signedOutLocally": false. The exception message is "An unknown error occurred" with an underlying exception of UnknownSmithyHttpException. This results in the user not being signed out locally, causing further authentication and authorization errors (e.g., 403 responses, malformed authorization headers) until the app is restarted.

  if (result is CognitoSignOutResult) {
    if (result.signedOutLocally) {
      safePrint('Signed out locally.');
    } else {
      safePrint('Sign out failed: ${result.exception}');
    }
  }
  loading.value = false;
}).catchError((e) {
  safePrint('Error signing out: $e');
  AuthEvents.triggerForceLogout('Force Logout from signOut');
}); ```

### Categories

- [ ] Analytics
- [ ] API (REST)
- [ ] API (GraphQL)
- [ ] Auth
- [ ] Authenticator
- [ ] DataStore
- [ ] Notifications (Push)
- [ ] Storage

### Steps to Reproduce

I tried to implement force logout when session expired, and when force logout triggered the logout didn't work properly which can't re-login

### Screenshots

_No response_

### Platforms

- [x] iOS
- [x] Android
- [ ] Web
- [ ] macOS
- [ ] Windows
- [ ] Linux

### Flutter Version

3.24.5

### Amplify Flutter Version

1.7.0

### Deployment Method

Amplify CLI (Gen 1)

### Schema

```GraphQL

[AntoniKwok]

Additional comment : The session became expired, it's because we enabled the refresh token setting in AWS dashboard. After the setting enabled, then the session is expired and failed to logout

[harsh62]

@AntoniKwok Can you elaborate the following statement:

it's because we enabled the refresh token setting in AWS dashboard.

Are you trying to use the new refresh token feature that Cognito has released? If yes, it is not supported in Amplify yet.

[AntoniKwok]

Are you trying to use the new refresh token feature that Cognito has released? If yes, it is not supported in Amplify yet.

Hi @harsh62 , thanks for the response!

Yes, we're referring to the new refresh token behavior in Cognito, where we enabled the "Enable refresh token rotation" setting and defined a custom refresh token expiration in the Cognito App Client configuration.

After enabling that, we observed that when the session expires (due to the access or refresh token expiring), calling Amplify.Auth.signOut() intermittently fails with an UnknownServiceException and signedOutLocally: false.

Could you clarify what “not supported in Amplify yet” means in practice?

Specifically:

Does it mean Amplify will not be able to properly refresh expired sessions?

Is inability to sign out a known symptom of this incompatibility?

Are there other known issues or limitations when using this new Cognito feature with Amplify?

Thanks again!

[AntoniKwok]

Hi @harsh62 , any updates about this?

[tyllark]

Hello @AntoniKwok, per the Refresh Token Rotation Developer Guide:

Refresh token rotation isn't compatible with the authentication flow REFRESH_TOKEN_AUTH. To implement refresh token rotation, you must disable this authentication flow in your app client and design your application to submit token-refresh requests with the GetTokensFromRefreshToken API operation or the equivalent SDK method.

We have not implemented the call to GetTokensFromRefreshToken in Amplify Flutter, so enabling refresh token rotation will not provide any benefits. We have a feature request open to add support for this. Since enabling refresh token rotation will disable REFRESH_TOKEN_AUTH, this will prevent Amplify Flutter from refreshing your access tokens and may result in users being signed out more frequently.

The inability to sign out is not a known issue, but I've been able to reproduce it on my end. I'm going to mark this issue as a bug and investigate a fix. In the meantime are you able to disable refresh token rotation to get around this issue?

[AntoniKwok]

Hi @tyllark, thanks for the detailed explanation — that makes the situation much clearer.

Yes, we enabled refresh token rotation, not realizing it disables REFRESH_TOKEN_AUTH, which explains the session and sign-out issues we’re seeing. We’ll disable it for now to avoid the problem.

Appreciate your help!