@vardario/cognito-client 0.1.9 → 0.2.0

package/README.md

@@ -0,0 +1,3 @@
+# Cognito Client
+
+A lightweight cognito client implementation which support SRP authentication.

package/lib/cognito-client.d.ts

@@ -1,4 +1,3 @@
-import { SessionStorage } from "./session-storage/index.js";
 export interface UserAttribute {
     Name: string;
     Value: string;
@@ -23,7 +22,7 @@ export interface OAuth2Props {
     /**
      * Response type.
      */
-    responseType: "code";
+    responseType: 'code';
 }
 export interface CognitoClientProps {
     /**
@@ -40,21 +39,6 @@ export interface CognitoClientProps {
      * If not defined the endpoint will be determined by @see userPoolId .
      */
     endpoint?: string;
-    /**
-     * Session storage.
-     * You can either choose on of the provided build in session
-     * storages. Or provider your own one based on @see SessionStorage .
-     *
-     * <ul>
-     *  <li>
-     *    @see CookieSessionStorage
-     *  </li>
-     *  <li>
-     *    @see MemorySessionStorage
-     *  </li>
-     * </ul>
-     */
-    sessionStorage: SessionStorage;
     /**
      * Cognito OAuth related options. See @see OAuthProps .
      */
@@ -85,15 +69,15 @@ export interface Session {
  * Represents the decoded values from a JWT ID token.
  */
 export interface IdToken extends Record<string, string | string[] | number | boolean> {
-    "cognito:username": string;
-    "cognito:groups": string[];
+    'cognito:username': string;
+    'cognito:groups': string[];
     email_verified: boolean;
     email: string;
     iss: string;
     origin_jti: string;
     aud: string;
     event_id: string;
-    token_use: "id";
+    token_use: 'id';
     auth_time: number;
     exp: number;
     iat: number;
@@ -111,7 +95,7 @@ export interface AccessToken extends Record<string, string | string[] | number |
     origin_jti: string;
     scope: string;
     sub: string;
-    token_use: "access";
+    token_use: 'access';
     username: string;
 }
 export interface DecodedTokens {
@@ -157,7 +141,7 @@ export interface AuthenticationResponse {
     AuthenticationResult: AuthenticationResult;
 }
 export interface ChallengeResponse {
-    ChallengeName: "PASSWORD_VERIFIER";
+    ChallengeName: 'PASSWORD_VERIFIER';
     ChallengeParameters: {
         SALT: string;
         SECRET_BLOCK: string;
@@ -173,9 +157,8 @@ export declare class CognitoClient {
     private readonly cognitoEndpoint;
     private readonly cognitoPoolName;
     private readonly userPoolClientId;
-    private readonly sessionStorage;
     private readonly oAuth?;
-    constructor({ userPoolId, userPoolClientId, endpoint, sessionStorage, oAuth2: oAuth, }: CognitoClientProps);
+    constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth }: CognitoClientProps);
     static getDecodedTokenFromSession(session: Session): DecodedTokens;
     private cognitoRequest;
     private static authResultToSession;
@@ -186,7 +169,7 @@ export declare class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     authenticateUserSrp(username: string, password: string): Promise<Session>;
     /**
@@ -196,25 +179,23 @@ export declare class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     authenticateUser(username: string, password: string): Promise<Session>;
-    private refreshSession;
     /**
-     * Returns the current auth session.
-     * The auth session is only defined when we previously had a successful user authentication.
-     * This function will also take care to refresh the session with the refresh token in case
-     * the current session has expired.
+     * Returns a new session based on the given refresh token.
      *
-     * @throws {AuthException}
+     * @param refreshToken
+     * @returns @see Session
+     * @throws {CognitoError}
      */
-    getSession(): Promise<Session | undefined>;
+    refreshSession(refreshToken: string): Promise<Session>;
     /**
      *
      * @param username Username
      * @param password Password
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     signUp(username: string, password: string, userAttributes?: UserAttribute[]): Promise<{
         id: string;
@@ -226,7 +207,7 @@ export declare class CognitoClient {
      * @param username Username
      * @param code Confirmation code the user gets through the registration E-Mail
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     confirmSignUp(username: string, code: string): Promise<void>;
     /**
@@ -234,22 +215,22 @@ export declare class CognitoClient {
      * @param currentPassword Current user password.
      * @param newPassword  New user password.
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
-    changePassword(currentPassword: string, newPassword: string): Promise<void>;
-    updateUserAttributes(userAttributes: UserAttribute[]): Promise<void>;
-    verifyUserAttribute(attributeName: string, code: string): Promise<void>;
+    changePassword(currentPassword: string, newPassword: string, accessToken: string): Promise<void>;
+    updateUserAttributes(userAttributes: UserAttribute[], accessToken: string): Promise<void>;
+    verifyUserAttribute(attributeName: string, code: string, accessToken: string): Promise<void>;
     /**
      * Sign out the user and remove the current user session.
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
-    signOut(): Promise<void>;
+    signOut(refreshToken: string): Promise<void>;
     /**
      * Request forgot password.
      * @param username Username
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     forgotPassword(username: string): Promise<void>;
     /**
@@ -259,7 +240,7 @@ export declare class CognitoClient {
      * @param newPassword New password
      * @param confirmationCode Confirmation code which the user got through E-mail
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     confirmForgotPassword(username: string, newPassword: string, confirmationCode: string): Promise<void>;
     /**
@@ -276,7 +257,11 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    generateOAuthSignInUrl(identityProvider?: CognitoIdentityProvider): Promise<string>;
+    generateOAuthSignInUrl(identityProvider?: CognitoIdentityProvider): Promise<{
+        url: string;
+        state: string;
+        pkce: string;
+    }>;
     /**
      *
      * Handles Cognito`s OAuth2 code flow after redirection from Cognito`s Hosted UI.
@@ -288,5 +273,5 @@ export declare class CognitoClient {
      *
      * @throws {Error}
      */
-    handleCodeFlow(returnUrl: string): Promise<Session>;
+    handleCodeFlow(returnUrl: string, pkce: string): Promise<Session>;
 }

package/lib/cognito-client.js

@@ -1,9 +1,8 @@
-import { addSeconds } from "date-fns";
-import hashJs from "hash.js";
-import { BigInteger } from "jsbn";
-import { Buffer } from "buffer";
-import { AuthError, AuthException, getAuthError, } from "./error.js";
-import { calculateSignature, calculateU, decodeJwt, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes, } from "./utils.js";
+import hashJs from 'hash.js';
+import { BigInteger } from 'jsbn';
+import { Buffer } from 'buffer';
+import { CognitoError, CognitoException } from './error.js';
+import { calculateSignature, calculateU, decodeJwt, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -38,12 +37,11 @@ export var CognitoIdentityProvider;
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
 export class CognitoClient {
-    constructor({ userPoolId, userPoolClientId, endpoint, sessionStorage, oAuth2: oAuth, }) {
-        const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split("_");
-        this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, "");
+    constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth }) {
+        const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split('_');
+        this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, '');
         this.cognitoPoolName = cognitoPoolName;
         this.userPoolClientId = userPoolClientId;
-        this.sessionStorage = sessionStorage;
         this.oAuth = oAuth;
     }
     static getDecodedTokenFromSession(session) {
@@ -51,31 +49,31 @@ export class CognitoClient {
         const { payload: accessToken } = decodeJwt(session.accessToken);
         return {
             idToken,
-            accessToken,
+            accessToken
         };
     }
     async cognitoRequest(body, serviceTarget) {
-        const respondToAuthChallenge = await fetch(this.cognitoEndpoint, {
+        const cognitoResponse = await fetch(this.cognitoEndpoint, {
             headers: {
-                "x-amz-target": `AWSCognitoIdentityProviderService.${serviceTarget}`,
-                "content-type": "application/x-amz-json-1.1",
+                'x-amz-target': `AWSCognitoIdentityProviderService.${serviceTarget}`,
+                'content-type': 'application/x-amz-json-1.1'
             },
-            method: "POST",
-            body: JSON.stringify(body),
+            method: 'POST',
+            body: JSON.stringify(body)
         });
-        if (respondToAuthChallenge.status < 200 ||
-            respondToAuthChallenge.status > 299) {
-            const errorMessage = (await respondToAuthChallenge.json());
-            throw getAuthError(errorMessage);
+        if (cognitoResponse.status < 200 || cognitoResponse.status > 299) {
+            const errorMessage = cognitoResponse.headers.get('X-Amzn-ErrorMessage') ?? 'Unknown';
+            const cognitoException = cognitoResponse.headers.get('X-Amzn-ErrorType') ?? CognitoException.Unknown;
+            throw new CognitoError(errorMessage, cognitoException);
         }
-        return respondToAuthChallenge.json();
+        return cognitoResponse.json();
     }
     static authResultToSession(authenticationResult) {
         return {
             accessToken: authenticationResult.AccessToken,
             idToken: authenticationResult.IdToken,
-            expiresIn: addSeconds(new Date(), authenticationResult.ExpiresIn).getTime(),
-            refreshToken: authenticationResult.RefreshToken,
+            expiresIn: new Date().getMilliseconds() / 1000 + authenticationResult.ExpiresIn,
+            refreshToken: authenticationResult.RefreshToken
         };
     }
     /**
@@ -85,19 +83,19 @@ export class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async authenticateUserSrp(username, password) {
         const smallA = await generateSmallA();
         const A = generateA(smallA);
         const initiateAuthPayload = {
-            AuthFlow: "USER_SRP_AUTH",
+            AuthFlow: 'USER_SRP_AUTH',
             ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
-                SRP_A: A.toString(16),
+                SRP_A: A.toString(16)
             },
-            ClientMetadata: {},
+            ClientMetadata: {}
         };
         const challenge = (await this.cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth));
         const B = new BigInteger(challenge.ChallengeParameters.SRP_B, 16);
@@ -106,20 +104,18 @@ export class CognitoClient {
         const hkdf = getPasswordAuthenticationKey(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, password, B, U, smallA, salt);
         const { signature, timeStamp } = calculateSignature(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, challenge.ChallengeParameters.SECRET_BLOCK, hkdf);
         const respondToAuthChallengePayload = {
-            ChallengeName: "PASSWORD_VERIFIER",
+            ChallengeName: 'PASSWORD_VERIFIER',
             ClientId: this.userPoolClientId,
             ChallengeResponses: {
                 PASSWORD_CLAIM_SECRET_BLOCK: challenge.ChallengeParameters.SECRET_BLOCK,
                 PASSWORD_CLAIM_SIGNATURE: signature,
                 USERNAME: challenge.ChallengeParameters.USER_ID_FOR_SRP,
-                TIMESTAMP: timeStamp,
+                TIMESTAMP: timeStamp
             },
-            ClientMetadata: {},
+            ClientMetadata: {}
         };
         const { AuthenticationResult } = await this.cognitoRequest(respondToAuthChallengePayload, CognitoServiceTarget.RespondToAuthChallenge);
-        const session = CognitoClient.authResultToSession(AuthenticationResult);
-        this.sessionStorage.setSession(session);
-        return session;
+        return CognitoClient.authResultToSession(AuthenticationResult);
     }
     /**
      *
@@ -128,75 +124,62 @@ export class CognitoClient {
      *
      * @param username Username
      * @param password Password
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async authenticateUser(username, password) {
         const initiateAuthPayload = {
-            AuthFlow: "USER_PASSWORD_AUTH",
+            AuthFlow: 'USER_PASSWORD_AUTH',
             ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
-                PASSWORD: password,
+                PASSWORD: password
             },
-            ClientMetadata: {},
+            ClientMetadata: {}
         };
         const { AuthenticationResult } = (await this.cognitoRequest(initiateAuthPayload, CognitoServiceTarget.InitiateAuth));
         const session = CognitoClient.authResultToSession(AuthenticationResult);
-        this.sessionStorage.setSession(session);
         return session;
     }
-    async refreshSession(session) {
+    /**
+     * Returns a new session based on the given refresh token.
+     *
+     * @param refreshToken
+     * @returns @see Session
+     * @throws {CognitoError}
+     */
+    async refreshSession(refreshToken) {
         const refreshTokenPayload = {
-            AuthFlow: "REFRESH_TOKEN_AUTH",
+            AuthFlow: 'REFRESH_TOKEN_AUTH',
             ClientId: this.userPoolClientId,
             AuthParameters: {
-                REFRESH_TOKEN: session.refreshToken,
+                REFRESH_TOKEN: refreshToken
             },
-            ClientMetadata: {},
+            ClientMetadata: {}
         };
         const { AuthenticationResult } = (await this.cognitoRequest(refreshTokenPayload, CognitoServiceTarget.InitiateAuth));
-        const newSession = CognitoClient.authResultToSession({
-            ...AuthenticationResult,
-            RefreshToken: session.refreshToken,
-        });
-        this.sessionStorage.setSession(newSession);
-        return newSession;
-    }
-    /**
-     * Returns the current auth session.
-     * The auth session is only defined when we previously had a successful user authentication.
-     * This function will also take care to refresh the session with the refresh token in case
-     * the current session has expired.
-     *
-     * @throws {AuthException}
-     */
-    async getSession() {
-        const session = this.sessionStorage.getSession();
-        if (session) {
-            if (new Date().getTime() >= session.expiresIn) {
-                return this.refreshSession(session);
-            }
+        if (!AuthenticationResult.RefreshToken) {
+            AuthenticationResult.RefreshToken = refreshToken;
         }
-        return session;
+        return CognitoClient.authResultToSession(AuthenticationResult);
     }
     /**
      *
      * @param username Username
      * @param password Password
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async signUp(username, password, userAttributes) {
         const signUpPayload = {
             ClientId: this.userPoolClientId,
             Username: username,
             Password: password,
-            UserAttributes: userAttributes,
+            UserAttributes: userAttributes
         };
         const data = await this.cognitoRequest(signUpPayload, CognitoServiceTarget.SignUp);
         return {
             id: data.UserSub,
-            confirmed: data.UserConfirmed,
+            confirmed: data.UserConfirmed
         };
     }
     /**
@@ -205,85 +188,68 @@ export class CognitoClient {
      * @param username Username
      * @param code Confirmation code the user gets through the registration E-Mail
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async confirmSignUp(username, code) {
         const confirmSignUpPayload = {
             ClientId: this.userPoolClientId,
             ConfirmationCode: code,
-            Username: username,
+            Username: username
         };
-        const result = await this.cognitoRequest(confirmSignUpPayload, CognitoServiceTarget.ConfirmSignUp);
+        await this.cognitoRequest(confirmSignUpPayload, CognitoServiceTarget.ConfirmSignUp);
     }
     /**
      *
      * @param currentPassword Current user password.
      * @param newPassword  New user password.
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
-    async changePassword(currentPassword, newPassword) {
-        const session = await this.getSession();
-        if (session === undefined) {
-            throw new AuthException("User must be authenticated", AuthError.UserNotAuthenticated);
-        }
+    async changePassword(currentPassword, newPassword, accessToken) {
         const changePasswordPayload = {
             PreviousPassword: currentPassword,
             ProposedPassword: newPassword,
-            AccessToken: session.accessToken,
+            AccessToken: accessToken
         };
-        const result = await this.cognitoRequest(changePasswordPayload, CognitoServiceTarget.ChangePassword);
+        await this.cognitoRequest(changePasswordPayload, CognitoServiceTarget.ChangePassword);
     }
-    async updateUserAttributes(userAttributes) {
-        const session = await this.getSession();
-        if (session === undefined) {
-            throw new AuthException("User must be authenticated", AuthError.UserNotAuthenticated);
-        }
+    async updateUserAttributes(userAttributes, accessToken) {
         const updateUserAttributesPayload = {
             UserAttributes: userAttributes,
-            AccessToken: session.accessToken,
+            AccessToken: accessToken
         };
-        const result = await this.cognitoRequest(updateUserAttributesPayload, CognitoServiceTarget.UpdateUserAttributes);
+        await this.cognitoRequest(updateUserAttributesPayload, CognitoServiceTarget.UpdateUserAttributes);
     }
-    async verifyUserAttribute(attributeName, code) {
-        const session = await this.getSession();
-        if (session === undefined) {
-            throw new AuthException("User must be authenticated", AuthError.UserNotAuthenticated);
-        }
+    async verifyUserAttribute(attributeName, code, accessToken) {
         const verifyUserAttributePayload = {
             AttributeName: attributeName,
             Code: code,
-            AccessToken: session.accessToken,
+            AccessToken: accessToken
         };
-        const result = await this.cognitoRequest(verifyUserAttributePayload, CognitoServiceTarget.VerifyUserAttribute);
+        await this.cognitoRequest(verifyUserAttributePayload, CognitoServiceTarget.VerifyUserAttribute);
     }
     /**
      * Sign out the user and remove the current user session.
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
-    async signOut() {
-        const session = await this.getSession();
-        if (session === undefined) {
-            throw new AuthException("User must be authenticated", AuthError.UserNotAuthenticated);
-        }
+    async signOut(refreshToken) {
         const revokeTokenPayload = {
-            Token: session.refreshToken,
-            ClientId: this.userPoolClientId,
+            Token: refreshToken,
+            ClientId: this.userPoolClientId
         };
-        this.sessionStorage.setSession(undefined);
         await this.cognitoRequest(revokeTokenPayload, CognitoServiceTarget.RevokeToken);
     }
     /**
      * Request forgot password.
      * @param username Username
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async forgotPassword(username) {
         const forgotPasswordPayload = {
             ClientId: this.userPoolClientId,
-            Username: username,
+            Username: username
         };
         await this.cognitoRequest(forgotPasswordPayload, CognitoServiceTarget.ForgotPassword);
     }
@@ -294,14 +260,14 @@ export class CognitoClient {
      * @param newPassword New password
      * @param confirmationCode Confirmation code which the user got through E-mail
      *
-     * @throws {AuthException}
+     * @throws {CognitoException}
      */
     async confirmForgotPassword(username, newPassword, confirmationCode) {
         const confirmForgotPasswordPayload = {
             ClientId: this.userPoolClientId,
             Username: username,
             ConfirmationCode: confirmationCode,
-            Password: newPassword,
+            Password: newPassword
         };
         await this.cognitoRequest(confirmForgotPasswordPayload, CognitoServiceTarget.ConfirmForgotPassword);
     }
@@ -312,7 +278,7 @@ export class CognitoClient {
     async resendConfirmationCode(username) {
         const resendConfirmationCodePayLoad = {
             ClientId: this.userPoolClientId,
-            Username: username,
+            Username: username
         };
         await this.cognitoRequest(resendConfirmationCodePayLoad, CognitoServiceTarget.ResendConfirmationCode);
     }
@@ -327,30 +293,29 @@ export class CognitoClient {
      */
     async generateOAuthSignInUrl(identityProvider) {
         if (this.oAuth === undefined) {
-            throw Error("You have to define oAuth options to use generateFederatedSignUrl");
+            throw Error('You have to define oAuth options to use generateFederatedSignUrl');
         }
-        const state = (await randomBytes(32)).toString("hex");
-        const pkce = (await randomBytes(128)).toString("hex");
+        const state = (await randomBytes(32)).toString('hex');
+        const pkce = (await randomBytes(128)).toString('hex');
         const code_challenge = Buffer.from(hashJs.sha256().update(pkce).digest())
-            .toString("base64")
-            .replace(/\+/g, "-")
-            .replace(/\//g, "_")
-            .replace(/=+$/, "");
+            .toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=+$/, '');
         const queryParams = new URLSearchParams();
-        queryParams.append("redirect_uri", this.oAuth.redirectUrl);
-        queryParams.append("response_type", this.oAuth.responseType);
-        queryParams.append("client_id", this.userPoolClientId);
-        identityProvider &&
-            queryParams.append("identity_provider", identityProvider);
-        queryParams.append("scope", this.oAuth.scopes.join(" "));
-        queryParams.append("state", state);
-        queryParams.append("code_challenge", code_challenge);
-        queryParams.append("code_challenge_method", "S256");
-        this.sessionStorage.setOauthVerificationParams({
+        queryParams.append('redirect_uri', this.oAuth.redirectUrl);
+        queryParams.append('response_type', this.oAuth.responseType);
+        queryParams.append('client_id', this.userPoolClientId);
+        identityProvider && queryParams.append('identity_provider', identityProvider);
+        queryParams.append('scope', this.oAuth.scopes.join(' '));
+        queryParams.append('state', state);
+        queryParams.append('code_challenge', code_challenge);
+        queryParams.append('code_challenge_method', 'S256');
+        return {
+            url: `${this.oAuth.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`,
             state,
-            pkce,
-        });
-        return `${this.oAuth.cognitoDomain}/oauth2/authorize?${queryParams.toString()}`;
+            pkce
+        };
     }
     /**
      *
@@ -363,38 +328,31 @@ export class CognitoClient {
      *
      * @throws {Error}
      */
-    async handleCodeFlow(returnUrl) {
+    async handleCodeFlow(returnUrl, pkce) {
         if (this.oAuth === undefined) {
-            throw Error("You have to define oAuth options to use handleCodeFlow");
+            throw Error('You have to define oAuth options to use handleCodeFlow');
         }
         const url = new URL(returnUrl);
-        const code = url.searchParams.get("code");
-        const state = url.searchParams.get("state");
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
         if (code === null || state === null) {
-            throw Error("code or state parameter is missing from return url.");
-        }
-        const oAuthVerificationParams = this.sessionStorage.getOauthVerificationParams();
-        if (oAuthVerificationParams === undefined) {
-            throw new Error("OAuth verification parameters are missing, did you forgot to call generateOAuthSignInUrl ?");
-        }
-        if (oAuthVerificationParams.state !== state) {
-            throw new Error("state parameter does not match with previous value generated by previous call of generateOAuthSignInUrl .");
+            throw Error('code or state parameter is missing from return url.');
         }
         const urlParams = new URLSearchParams();
-        urlParams.append("grant_type", "authorization_code");
-        urlParams.append("code", code);
-        urlParams.append("client_id", this.userPoolClientId);
-        urlParams.append("redirect_uri", this.oAuth.redirectUrl);
-        urlParams.append("code_verifier", oAuthVerificationParams.pkce);
+        urlParams.append('grant_type', 'authorization_code');
+        urlParams.append('code', code);
+        urlParams.append('client_id', this.userPoolClientId);
+        urlParams.append('redirect_uri', this.oAuth.redirectUrl);
+        urlParams.append('code_verifier', pkce);
         const tokenEndpoint = `${this.oAuth.cognitoDomain}/oauth2/token`;
         const response = await fetch(tokenEndpoint, {
-            method: "POST",
+            method: 'POST',
             headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
+                'Content-Type': 'application/x-www-form-urlencoded'
             },
-            body: urlParams.toString(),
+            body: urlParams.toString()
         });
-        const { access_token, refresh_token, id_token, expires_in, token_type, error, } = await response.json();
+        const { access_token, refresh_token, id_token, expires_in, token_type, error } = await response.json();
         if (error) {
             throw new Error(error);
         }
@@ -403,9 +361,8 @@ export class CognitoClient {
             RefreshToken: refresh_token,
             IdToken: id_token,
             ExpiresIn: expires_in,
-            TokenType: token_type,
+            TokenType: token_type
         });
-        this.sessionStorage.setSession(session);
         return session;
     }
 }