{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-js/issues/609","labels_url":"https://api.github.com/repos/aws/aws-sdk-js/issues/609/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-js/issues/609/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-js/issues/609/events","html_url":"https://github.com/aws/aws-sdk-js/issues/609","id":76536881,"number":609,"title":"Cognito identities are cached per-pool but not per user","user":{"login":"wearhere","id":110000,"avatar_url":"https://avatars.githubusercontent.com/u/110000?v=3","gravatar_id":"","url":"https://api.github.com/users/wearhere","html_url":"https://github.com/wearhere","followers_url":"https://api.github.com/users/wearhere/followers","following_url":"https://api.github.com/users/wearhere/following{/other_user}","gists_url":"https://api.github.com/users/wearhere/gists{/gist_id}","starred_url":"https://api.github.com/users/wearhere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wearhere/subscriptions","organizations_url":"https://api.github.com/users/wearhere/orgs","repos_url":"https://api.github.com/users/wearhere/repos","events_url":"https://api.github.com/users/wearhere/events{/privacy}","received_events_url":"https://api.github.com/users/wearhere/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aws/aws-sdk-js/labels/Enhancement","name":"Enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-15T00:25:57Z","updated_at":"2015-10-16T17:38:33Z","closed_at":"2015-10-16T16:55:22Z","body":"`AWS.CognitoIdentityCredentials` will not fetch a Cognito ID [if one is already cached](https://github.com/aws/aws-sdk-js/blob/master/lib/credentials/cognito_identity_credentials.js#L152). But since IDs are keyed [only on the identity pool ID](https://github.com/aws/aws-sdk-js/blob/master/lib/credentials/cognito_identity_credentials.js#L288), only one ID can be cached per-pool. This may cause ID/login token mismatches if an application has multiple users that authenticate using the same browser.\r\n\r\n#### Example \r\n\r\nMy application, for instance, uses Google as an identity provider. My application runs inside of Gmail, so it is common for users to have multiple instances of the application running at a time—one per Gmail account. If the user uploads a file to S3 from their `joe1@gmail.com` account, they will succeed and the ID of `joe1` will be cached. But if the user then tries to upload a file to S3 from their `joe2@gmail.com` account, they will fail because the SDK will try to authenticate `joe1`'s identity using `joe2`'s login token.\r\n\r\n#### Fix\r\n\r\nTo fix this, I suggest that the `AWS.CognitoIdentityCredentials` cache space be subdivided by means of a new parameter `LoginHint` provided to the constructor. The value of `LoginHint` should differ by user; perhaps it could be the user's email address:\r\n\r\n```js\r\nAWS.config.credentials = new AWS.CognitoIdentityCredentials({\r\n  IdentityPoolId: ...,\r\n  Logins: ...,\r\n  LoginHint: 'joe1@gmail.com'\r\n});\r\n```\r\n\r\nThat parameter would supplement [the cache key](https://github.com/aws/aws-sdk-js/blob/master/lib/credentials/cognito_identity_credentials.js#L288) like so:\r\n\r\n```\r\nthis.storage[this.localStorageKey[key] + this.params.IdentityPoolId + (this.params.LoginHint || '')] = val;\r\n```\r\n\r\nI'm glad to submit a PR if you like this approach."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-js/issues/comments/148781180","html_url":"https://github.com/aws/aws-sdk-js/issues/609#issuecomment-148781180","issue_url":"https://api.github.com/repos/aws/aws-sdk-js/issues/609","id":148781180,"user":{"login":"chrisradek","id":14189820,"avatar_url":"https://avatars.githubusercontent.com/u/14189820?v=3","gravatar_id":"","url":"https://api.github.com/users/chrisradek","html_url":"https://github.com/chrisradek","followers_url":"https://api.github.com/users/chrisradek/followers","following_url":"https://api.github.com/users/chrisradek/following{/other_user}","gists_url":"https://api.github.com/users/chrisradek/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisradek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisradek/subscriptions","organizations_url":"https://api.github.com/users/chrisradek/orgs","repos_url":"https://api.github.com/users/chrisradek/repos","events_url":"https://api.github.com/users/chrisradek/events{/privacy}","received_events_url":"https://api.github.com/users/chrisradek/received_events","type":"User","site_admin":false},"created_at":"2015-10-16T17:38:32Z","updated_at":"2015-10-16T17:38:32Z","body":"@wearhere \r\nYes, this will be available in the next release. Thanks for requesting this feature and for your feedback!"}}