Renew from the provider's session, for installs that can - #150
Merged
Conversation
A refresh token is the only credential a tab holds long enough to be worth stealing, and asking for offline_access is what gets one issued. The alternative is to renew through a hidden frame against the session the provider already keeps -- nothing persisted, and a cookie script cannot read. That only works where the frame is first-party to the issuer, so the default still asks for offline_access and nothing here changes for an install that keeps it: oidc-client-ts renews from the refresh token and never opens the frame, so silent_redirect_uri goes unread and the gate below never sees the path. It is set unconditionally because the library throws on the frame path without it, not because it is always used. The gate has to answer before AuthProvider mounts. Rendering the callback from a route would put it below the gate, and the frame would run the whole sign-in flow in its own context instead of answering its parent. Dropping offline_access against a provider configured elsewhere also needs <origin>/silent-renew registered there as a redirect URI. The app cannot detect that it is missing -- the frame swallows the error and sessions end at token expiry -- so the values file says so.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires renewal through a hidden frame against the provider's session, so an install can drop
offline_accessand hold no refresh token at all.Inert unless it is dropped: with
offline_accesspresent oidc-client-ts renews from the refresh token and never opens the frame, sosilent_redirect_urigoes unread and the gate never sees the path. The chart default still asks for it, so nothing changes for an install that keeps it.The gate answers
/silent-renewbeforeAuthProvidermounts — from a route it would sit below the gate and the frame would run the whole sign-in flow in its own context.Dropping
offline_accessagainst a provider this chart does not configure also needs<origin>/silent-renewregistered there as a redirect URI; the app cannot detect that it is missing. The values file says so.