You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
We have deployed the "qnabot-on-aws" solution and are facing a critical issue with the logout functionality. When a user logs out of the application, they are redirected to the Cognito login page. From there, they can log back in as an admin user without providing any credentials, simply by clicking the "Sign In as Admin" button. This indicates that the logout process is not effectively terminating the user's session, posing a significant security risk.
To Reproduce
Deploy the "qnabot-on-aws" solution.
Log in to the application as an admin user.
Click on the logout button.
On the Cognito login page, click the "Sign In as Admin" button.
Observe that the user is logged back in as an admin without providing any credentials.
Expected behavior
When a user logs out of the application, their session should be terminated, and they should be required to provide their credentials to log back in.
Please complete the following information about the solution:
[v6.0.1] Version: [e.g. v0.0.1]
[ us-east-1] Region: [e.g. us-east-1]
[N] Was the solution modified from the version published on this repository?
If the answer to the previous question was yes, are the changes available on GitHub?
[Y] Have you checked your service quotas for the services this solution uses?
[N] Were there any errors in the CloudWatch Logs?
The text was updated successfully, but these errors were encountered:
Describe the bug
We have deployed the "qnabot-on-aws" solution and are facing a critical issue with the logout functionality. When a user logs out of the application, they are redirected to the Cognito login page. From there, they can log back in as an admin user without providing any credentials, simply by clicking the "Sign In as Admin" button. This indicates that the logout process is not effectively terminating the user's session, posing a significant security risk.
To Reproduce
Expected behavior
When a user logs out of the application, their session should be terminated, and they should be required to provide their credentials to log back in.
Please complete the following information about the solution:
The text was updated successfully, but these errors were encountered: