Serverless Stack

anyone know what cognito's refresh token behavior is upon a password change (called from Amplify)? will it invalidate any refresh token that may be floating around?

I don't know off the top of my head, but am wondering if there if a flag/param that you would be able to pass through the SDK that would allow you to optionally refresh all outstanding tokens

You'd need to call the invalidation method from sdk (if you enabled invalidation in the Pool)

Funnily enough, there are two of those..  RevokeToken and GlobalSignOut.
Revoke straight up revokes the refresh token and all access tokens related.
Sign out revokes refresh token, logs you out from device sessions, but does not invalidate access token.

Guess you're looking for this one:
<https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html>

cool. thank you! i think revocation/invalidation belong to the cognito clients and not the user pool