Flutter中Amplify Cognito多用户池配置及会话丢失问题解决

一、多用户池配置实现 #

Amplify支持同时配置多个Cognito用户池，只需在配置中为每个用户池分配唯一标识，并对应配置Auth规则：

修改后的Amplify配置代码 #

final _amplifyConfig = '''
{
    "UserAgent": "aws-amplify-cli/2.0",
    "Version": "1.0",
    "auth": {
        "plugins": {
            "awsCognitoAuthPlugin": {
                "UserAgent": "aws-amplify-cli/0.1.0",
                "Version": "0.1.0",
                "IdentityManager": {
                    "Default": {}
                },
                "CognitoUserPool": {
                    // 邮箱/密码登录用户池
                    "Default": {
                        "PoolId": "${Environment.emailCognitoPoolId}",
                        "AppClientId": "${Environment.emailCognitoAppClientId}",
                        "Region": "${Environment.cognitoRegion}"
                    },
                    // Google SSO用户池
                    "GoogleSSOPool": {
                        "PoolId": "${Environment.ssoCognitoPoolId}",
                        "AppClientId": "${Environment.ssoCognitoAppClientId}",
                        "Region": "${Environment.cognitoRegion}"
                    }
                },
                "Auth": {
                    // 邮箱/密码Auth配置（无OAuth）
                    "Default": {
                        "authenticationFlowType": "USER_SRP_AUTH",
                        "usernameAttributes": ["EMAIL"],
                        "signupAttributes": ["EMAIL"],
                        "passwordProtectionSettings": {
                            "passwordPolicyMinLength": 8,
                            "passwordPolicyCharacters": [
                                "REQUIRES_LOWERCASE",
                                "REQUIRES_UPPERCASE",
                                "REQUIRES_NUMBERS",
                                "REQUIRES_SYMBOLS"
                            ]
                        },
                        "mfaConfiguration": "OFF",
                        "verificationMechanisms": ["EMAIL"]
                    },
                    // Google SSO Auth配置（带OAuth）
                    "GoogleSSO": {
                        "OAuth": {
                            "WebDomain": "${Environment.ssoCognitoWebDomain}",
                            "AppClientId": "${Environment.ssoCognitoAppClientId}",
                            "SignInRedirectURI": "${Environment.ssoCognitoOAuth}",
                            "SignOutRedirectURI": "${Environment.ssoCognitoOAuth}",
                            "ResponseType": "code",
                            "Scopes": ["email", "openid", "profile"]
                        },
                        "authenticationFlowType": "USER_SRP_AUTH",
                        "socialProviders": ["GOOGLE"],
                        "usernameAttributes": ["EMAIL"],
                        "mfaConfiguration": "OFF",
                        "verificationMechanisms": ["EMAIL"]
                    }
                }
            }
        }
    }
}''';

登录时指定用户池 #

调用登录接口时，通过userPoolKey指定使用的用户池：

邮箱/密码登录

await Amplify.Auth.signIn(
  username: username,
  password: password,
  options: const SignInOptions(
    authPluginOptions: CognitoSignInOptions(userPoolKey: "Default"),
  ),
);

Google SSO登录

await Amplify.Auth.signInWithWebUI(
  provider: AuthProvider.google,
  options: const SignInWithWebUIOptions(
    authPluginOptions: CognitoSignInWithWebUIOptions(userPoolKey: "GoogleSSOPool"),
  ),
);

二、Google SSO会话持久化修复 #

1. 配置持久化存储 #

确保Amplify初始化时配置本地持久化存储（以Flutter为例，使用SharedPreferences）：

import 'package:shared_preferences/shared_preferences.dart';

// 初始化前配置存储
final prefs = await SharedPreferences.getInstance();
final storage = AmplifySecureStorage.fromSharedPreferences(sharedPreferences: prefs);

await Amplify.addPlugins([
  AmplifyAuthCognito(storage: storage),
]);
await Amplify.configure(_amplifyConfig);

2. 应用启动时恢复会话 #

在应用启动入口调用fetchAuthSession主动恢复会话：

@override
void initState() {
  super.initState();
  _restoreSession();
}

Future<void> _restoreSession() async {
  try {
    final session = await Amplify.Auth.fetchAuthSession(
      options: const FetchAuthSessionOptions(
        authPluginOptions: CognitoFetchAuthSessionOptions(userPoolKey: "GoogleSSOPool"),
      ),
    );
    if (session.isSignedIn) {
      // 处理已登录状态，比如跳转主页
    }
  } catch (e) {
    // 会话恢复失败，处理未登录状态
  }
}

3. 检查Cognito应用客户端设置 #

• 确保应用客户端的OAuth 2.0授权类型包含Authorization code grant
• 确认Sign in redirect URIs和Sign out redirect URIs与配置完全一致
• 检查token过期时间（默认3600秒，可按需调整，但过短会导致频繁登录）

内容的提问来源于stack exchange，提问作者Cristian Gomez