Flutter AWS Cognito Token showing invalid signature

[Tapasm1212]

I am stared developing a flutter project with AWS Cognito login features. In flutter, AWS Cognito login was working fine and I am getting the access token but when checking that in API or JWT its shows the error "Invalid Signature".

I add the below code for the AWS Cognito login features. I have installed the amplify_auth_cognito: '<1.0.0' in pubspec.yaml file to create the AWS Cognito login features in the app. Login codes working fine and perfectly but the token which returns from that code shows "Invalid Signature".

`Future _signIn(LoginData data) async {
try {
SignInResult res = await Amplify.Auth.signIn(
username: data.name,
password: data.password,
);
final resp = await Amplify.Auth.fetchAuthSession(
options: CognitoSessionOptions(getAWSCredentials: true),
);
if (resp.isSignedIn) {
final sess = resp as CognitoAuthSession;
print("TOKEN FROM THE COGNITO: ${sess.userPoolTokens.accessToken}");
}
setState(() {
isSignedIn = res.isSignedIn;
});
if (isSignedIn) {
_btnController.success();
AWSConfigurationHelper().getUserDetails();

Timer(Duration(seconds: 1), () {
  _btnController.reset();
  Navigator.pushReplacementNamed(context, DeviceList.routeName);
});

}
} on AuthError catch (e) {
Alert(
context: context,
type: AlertType.error,
title: "Login Failed",
desc: e.cause.toString(), //e.toString(),
).show();

_btnController.error();

Timer(Duration(seconds: 1), () {
_btnController.reset();
});

print(e.cause);

for (final exception in e.exceptionList) {
print(exception.exception);
print(exception.detail);
}

return 'Log In Error: ' + e.toString();
}}`

My pubspec.yaml file screenshot was attached. In that file I am using amplify_auth_cognito: '<1.0.0' for the Cognito login.

I am new to this Flutter so I really need someone help to fix this problem. I have done the AWS Cognito Login features in iOS and web with the same AWS credentials but there I am not getting this type of "Invalid Signature" issue in the access token. Someone, please help me because I am not any good link where this type of issue has been discussed.

Thanks in advance

[haverchuck]

@Tapasm1212 - Is this happening with the token on both Android and iOS devices?

[Tapasm1212]

I have created this project only for Android. I have done this iOS project in native Xcode as I am very familiar with iOS mobile app development. In the iOS project, I have to use the same AWS Credential and I get the proper access token but with that same AWS Credential in the flutter android project, I am not getting the proper access token.

I am not able to understand why this token issue arises in the flutter android project. I have added the AWS Amplify file details with this.

I need some suggestions and help why this happed in the android flutter project.

Thanks

[haverchuck]

@Tapasm1212 Is this happening with a newly-created user, immediately after signin?

I've been testing this functionality been haven't been able to reproduce the bug. Any other details you could provide re: repro steps would be great (if you can't think of any that's understandable - we will continue to investigate).

[RyanHedges]

@Tapasm1212 I thought I was running into this issue too when attempting to validate my token manually. In my case I was printing the token to console, copying it, and pasting it trying to inspect it on jwt.io. Looks like mobile clients under the hood limit what's printed so I wasn't getting the entire token. I used this suggestion to be able to get the whole token, clean it up, and then I was able to see jwt.io say the signature is valid.

Not sure if that's what you're specifically running into, but putting this here for anyone else that finds this.

[haverchuck]

@Tapasm1212 Are you still having this issue?

[haverchuck]

Closing this issue as it appears to be a dupe of #120 . According to the discussion on this other issue, this problem is a caused by truncation in the logs. I believe the conversation details some solutions.

[ash1497]

@Tapasm1212 I thought I was running into this issue too when attempting to validate my token manually. In my case I was printing the token to console, copying it, and pasting it trying to inspect it on jwt.io. Looks like mobile clients under the hood limit what's printed so I wasn't getting the entire token. I used this suggestion to be able to get the whole token, clean it up, and then I was able to see jwt.io say the signature is valid.

Not sure if that's what you're specifically running into, but putting this here for anyone else that finds this.

This was EXACTLY my issue. Thank you so much for putting it out there for someone to find, I am that someone hahah.