Repository: auth0/auth0.js (js)

Issue:
renewAuth does not work anymore due to location.hash being empty in SilentAuthenticationHandler
Hi!
The renewAuth does not work anymore for us on v8.12.1 on Chrome (Windows & MacOS).

It seems that the `location.hash` in `SilentAuthenticationHandler. getCallbackHandler` is empty here:
https://github.com/auth0/auth0.js/blob/v8/src/web-auth/silent-authentication-handler.js#L68

Here is the value of `eventData.sourceObject.contentWindow.location` that we get:
```
{
    "href": "about:blank",
    "ancestorOrigins": {
        "0": "http://localhost:5000"
    },
    "origin": "null",
    "protocol": "about:",
    "host": "",
    "hostname": "",
    "port": "",
    "pathname": "blank",
    "search": "",
    "hash": ""
}
```

We suspect that this bug got introduced with this commit:
https://github.com/auth0/auth0.js/commit/2d7243d2675dbc5070305fe9236af5daebf8fbfd
Because the iframe source URL is set after `addEventListener` and the event is then called for the `about:blank` Chrome page being loaded instead of the actual renewal URL page being loaded.

Can you please have a look.
Thanks!

Pull request:
Do not consider a load event valid if protocol is "about:"
Fix #601

Patch:
diff --git a/src/web-auth/silent-authentication-handler.js b/src/web-auth/silent-authentication-handler.js
index ff670b7..205c626 100644
--- a/src/web-auth/silent-authentication-handler.js
+++ b/src/web-auth/silent-authentication-handler.js
@@ -53,7 +53,12 @@ SilentAuthenticationHandler.prototype.getEventValidator = function() {
             eventData.event.data.type && eventData.event.data.type === _this.postMessageDataType
           );
 
-        case 'load': // Fall through to default
+        case 'load':
+          if (eventData.sourceObject.contentWindow.location.protocol === 'about:') {
+            // Chrome is automatically loading the about:blank page, we ignore this.
+            return false;
+          }
+        // Fall through to default
         default:
           return true;
       }


Test patch:
diff --git a/test/web-auth/silent-authentication-handler.test.js b/test/web-auth/silent-authentication-handler.test.js
index dc1bd48..a41c49b 100644
--- a/test/web-auth/silent-authentication-handler.test.js
+++ b/test/web-auth/silent-authentication-handler.test.js
@@ -182,6 +182,13 @@ describe('handlers silent-authentication-handler', function() {
         validator.isValid({
           event: {
             type: 'load'
+          },
+          sourceObject: {
+            contentWindow: {
+              location: {
+                protocol: 'https:'
+              }
+            }
           }
         })
       ).to.be(true);
@@ -252,7 +259,38 @@ describe('handlers silent-authentication-handler', function() {
       });
       var validator = sah.getEventValidator();
 
-      expect(validator.isValid({ event: { type: 'load' } })).to.be(true);
+      expect(validator.isValid({
+        event: {
+          type: 'load'
+        },
+        sourceObject: {
+          contentWindow: {
+            location: {
+              protocol: 'https:'
+            }
+          }
+        }
+      })).to.be(true);
+    });
+
+    it('should negatively validate load event types for "about:" protocol', function() {
+      var sah = new SilentAuthenticationHandler({
+        postMessageDataType: false
+      });
+      var validator = sah.getEventValidator();
+
+      expect(validator.isValid({
+          event: {
+            type: 'load'
+          },
+          sourceObject: {
+            contentWindow: {
+              location: {
+                protocol: 'about:'
+              }
+            }
+          }
+      })).to.be(false);
     });
   });
 });