Repository: manfredsteyer/angular-oauth2-oidc

Issue #600: Consider supporting iframe silent refresh in Authorization Code + PKCE flow
Created: 2019-08-11T14:05:57Z
Recently released versions 8.x introduced support for "Code Flow" (Authorization Code + PKCE). While trying to upgrade my sample repositlory to utilize this flow I'm running into an issue.
It seems that silent refresh via an iframe is not supported with Code Flow in angular-oauth2-oidc?
Current situation
Even though you could ask for offline_access as suggested by the Code Flow docs for this library, and then utilize refresh() instead, I think the iframe method can be at least as useful, if not more. It allows you to initiate a silent refresh when starting your application (if you want this negates the need for localStorage too), and in general prevents having to ask for refresh tokens (which are often deemed too powerful for SPA's).
I shortly wondered if "the iframe silent refresh trick" would even work with Code Flow, but found some evidence that it should do so:

E.g. Auth0's silent auth tutorial also mentions using it with Code Flow
There's another Angular OAuth library promoting similar behavior
In my experimental branch I observe that the library can be made to try and do iframe-based silent refresh, it just fails to handle the iframe state after silent login

So, I think our library could and should support it just fine.
The code
Here's the relevant tryLogin method:

  
    
      angular-oauth2-oidc/projects/lib/src/oauth-service.ts
    
    
        Lines 1374 to 1381
      in
      a1652dc
    
  
  
    

        
          
           public tryLogin(options: LoginOptions = null): Promise<boolean> { 
        

        
          
               if (this.config.responseType === 'code') { 
        

        
          
                   return this.tryLoginCodeFlow().then(_ => true); 
        

        
          
               } 
        

        
          
               else { 
        

        
          
                   return this.tryLoginImplicitFlow(options); 
        

        
          
               } 
        

        
          
           } 
        
    
  


This method is called:

For initial login sequences, possibly grabbing the code hash fragment parameter and others from the window.location
When called based on silent renew iframe messages fired when the auth server successfully does a "no prompt" login, redirecting the iframe back to the silent-refresh.html page

As you can see in the code above, tryLoginCodeFlow is called without arguments, that is the iframe's message is discarded in the second scenario.
This makes sense, as the method does not support being called with a customHashFragment grabbed from the iframe's message:

  
    
      angular-oauth2-oidc/projects/lib/src/oauth-service.ts
    
    
        Lines 1398 to 1401
      in
      a1652dc
    
  
  
    

        
          
           public tryLoginCodeFlow(): Promise<void> { 
        

        
          
            
        

        
          
               const parts = this.parseQueryString(window.location.search) 
        

        
          
            
        
    
  


Proposed change
I propose we change tryLoginCodeFlow to support passing along something like LoginOptions. We most likely would need to tweak things, as with the code flow the response data is in the query string parameter, not the hash fragment (I think?).

Duplicate issue #734: Code flow silent refresh without offline_access?
Created: 2020-03-05T09:20:51Z
Hi,
Is it possible to use Code flow silent refresh without having the offline_access scope? My initial authorization works but when it comes to silent refresh i get invalid_grant error and silent_refresh_error.

Closing comment (2020-03-05T20:12:26Z): Would you agree that this is a duplicate of #600 ?