When does API Gateway validate revoked Cognito ID token

Question

I am building a serverless react app which uses Cognito for sign-in/sign-out. The app calls API Gateway which is configured to use the Cognito User pool as the custom authorizer.

I also build a lambda function to sign out a user (cognitoIdentityServiceProvider.globalSignOut).

When I sign into the app, and then call the lambda function to perform an admin sign-out, calls to protected API gateway functions from the app are still valid (with Cognito ID token passed in Authorization header);

Are admin calls such as cognitoIdentityServiceProvider.globalSignOut and cognitoIdentityServiceProvider.adminUserGlobalSignOut not realtime, or is API Gateway configured to only validate after an hour?

Answer 1

Just found the answer, unfortunately not what I wanted to hear:

Because IdToken is represented as a JSON Web Key Token, it's signed with a secret or private/public key pairs, which means even if you revoke the IdToken, there is no way to revoke the distributed public key. And IdToken has a short life span, it will expire in a short time.

Is it possible to revoke AWS Cognito IdToken?

https://github.com/aws/aws-sdk-js/issues/1687

https://github.com/aws/amazon-cognito-identity-js/issues/21