Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- An SSO session starts through managed login and lets a user access other app clients without authenticating again. A token session starts when a user signs in to an app client and receives tokens.
- You can list active sessions across devices and app clients, revoke an individual session and optionally include its linked sessions.
- SSO reuse duration is now configurable per app client, replacing the previous fixed one-hour duration. You can also cap active token sessions per user.
- Eligibility is limited to Essentials or Plus user pools. The announcement does not provide numeric prices, setting ranges or revocation propagation times.
SSO sessions and token sessions serve different purposes
An SSO, or single sign-on, session is created when a user signs in through Cognito managed login. It lets them access other app clients without authenticating again. A token session is created when a user signs in to an app client and receives tokens. The two are related, but they are not interchangeable descriptions of a login.
For example, imagine a user accessing your application on a phone and a computer. To investigate one sign-in, first identify whether the record is an SSO or token session and which app client it belongs to. This hypothetical example illustrates the check; it does not establish a fixed session count or linkage rule for every client.
What information can you inspect?
The announcement says session management can list a user’s active SSO and token sessions across all devices and app clients. Session details include session type, app client ID, device type, last activity time and location, and initial sign-in time.
You can use these fields to build an end-user session list or an administrator interface. AWS has not announced that it automatically adds a complete session-control page to your application. Treat location as a clue, rather than proof of a particular person, precise place or account abuse, and assess it alongside other information you are authorized to use.
Choose individual revocation, linked sessions or global sign-out
You can revoke an individual session on demand and optionally include its linked sessions. To end every session associated with one user, the announcement also identifies global sign-out. Decide the intended scope first so that investigating one device does not unintentionally sign that user out everywhere.
As a rollout check, record the target session type, app client, device and linked-session scope for a test user. Apply the selected action and inspect subsequent client behavior. This is a suggested preparation step, not a record of a test performed on a real user pool.
The announcement does not specify when every kind of issued token becomes unusable under different validation methods, or promise that every application request fails immediately. Confirm how your application accepts or rejects tokens against current developer documentation and its actual validation method. A revoked session alone does not prove that every request has already been blocked.
What changes about the one-hour SSO duration and session limits?
Previously, app clients reused an SSO session for a fixed one-hour duration. You can now configure that reuse duration per app client to control when authentication is required again. This setting concerns SSO reuse; the announcement does not say that it also changes every access token, refresh token or application cookie lifetime.
You can also set a maximum number of active token sessions per user. The announcement does not list permitted values, defaults, behavior at the limit or whether a changed setting immediately affects existing sessions. Confirm those details before rollout, then cover multiple devices and app clients with test users.
Check the plan, Region and management interface before rollout
Session management is available to user pools on the Essentials or Plus feature plans in all AWS Regions where Amazon Cognito is available. Check the Region you actually use. Reading in English or Chinese does not change eligibility, and broad regional availability does not imply that Lite user pools include the feature.
AWS lists the Management Console, API, AWS CLI and AWS SDKs as management interfaces, with settings also configurable through AWS CloudFormation. Use your existing administration method and confirm the required permissions, operations and setting fields in current documentation. This article does not supply unverified API names or commands.
The announcement gives no numeric price or assurance that the feature has no additional cost. Check current Cognito pricing and account terms before changing plans or estimating costs; availability does not mean a plan changes automatically. Finally, verify SSO reauthentication, targeted revocation and application-side token handling separately before expanding the rollout.
Sources
Frequently Asked Questions
Does a location change prove a new device or a compromised account?
No. The announcement lists location and device type as session details but does not specify location precision, inference methods or a unique-device identity guarantee. Use them as investigation clues and follow your organization’s authorization, security and privacy processes before drawing an account-level conclusion.
Does this update cover Cognito identity pools?
The announcement explicitly covers user-pool SSO and token sessions. It does not announce equivalent management of temporary AWS credentials from identity pools, so that scope should not be inferred.