Angular-auth-oidc-client: First time of token renew clear localstorage

[paszkowskik]

Hi, We have noticed that during first time (very first time after application initialization) of token renew, library clear whole session storage. That act causes a problem that for 2-3 seconds we don't have a token. The issue is when user is trying to access API (during token renew) and localstorage is empty we got 401. Feature of token renew should prevent us before 401 because we never shouldn't have invalid/empty token. We think that the problem is related to token renew, because new instance of application is initialized and loaded to iframe. Propably that initalization clear whole session storage.
Is any chance to fix that ?

[damienbod]

Thanks for reporting, I'll fix this tonight, or tomorrow and release. This should not happen.

[paszkowskik]

Thank you very much for fast reponse. We are waiting for release.

[damienbod]

@paszkowskik Going through this now, and I can't reproduce this. When does this happen? After the first authorization callback, the authorization data is reset, then the token is validated, and the authorized is set.

[paszkowskik]

Maybe I just described it wrongly. It happend during first time of token renew that in session storage I see "running" and after 2-3 seconds session storage is clear (no key/values in session storage) and after 1 second again all library values comeback with new token. It happend only during first time of token renew after initialization of application (by F5), when it happend once next time app it just replace only access-token and everything is working well.

[damienbod]

@paszkowskik Maybe I misunderstood :), thanks for your feedback.

The first time the app initializations, I reset the security data, but this is done in the init application and not the silent renew. Once setup, everything runs.

What I need to find out is, if the app is setup, logged in and then resets, if this happens, we have a bug and need to fix. I cannot reproduce this. Have I understood correctly? If so, I need more details to reproduce. What is the lifespan of your id_token, access_token?

Greetings Damien

[paszkowskik]

"The first time the app initializations, I reset the security data, but this is done in the init application and not the silent renew. Once setup, everything runs." - yes we know that and it is not the problem that I am describing. It happend during token renew from B2C, token expiration time in b2c is 5 min, during my lastest tests I used offest time as 250.
To repeat that you can fallow steps:

1. Run angular app,
2. Login into B2C and have a state of app where b2c return access token by call authorizeCallback();
3. Open browser console and go to session storage (we can see there access token obtain from b2c)
4. After ~30sec I see "running" in session storage it take about 3-5 seconds
5. On the last second of token renew session storage is being clear (no key/values)
6. After next second again every key/values come back with new access token.
7. During every next token renew library change only access token, session storage is not anymore cleared.
   I hope that it will help you.

[damienbod]

Thanks, I'll try to reproduce

[damienbod]

I checked this with an IdentityServer4 STS and cannot reproduce. Will try this with a B2C server now

[wolfhoundjesse]

I'm experiencing this, too, or something similar. I don't actually see the token clear from session storage, but oidcSecurityService.getToken() comes back with nothing momentarily, and then it comes back with a token.

[Riddler1225]

I think we are experiencing this too (or it seems that way, the nature of debugging this has made it difficult to pin down). The issue does not reproduce on Windows 10 machines. But we have experienced what appears to be the same issue on machines running Windows 8 and Apple machines.

Our application works on all Windows 8 and Windows 10 after rolling back to angular-auth-oidc-client 4.1.0. Later versions don't work on Windows 8. We don't have access to Apple machines at this time to test on them.

We're experiencing this on Angular v. 5.2.11.

[damienbod]

I would use version 4.1.0 with Angular 5.2.11, the version 6 is for the new Angular with the new rxjs lib. This has changed a lot. You would all need the rxjs compat package if using the Angular 5.2.11 packages. IE also need the fetch package.

Greetings Damien

[FabianGosebrink]

this should be fixed, closing this, please reopen if closed incorrectly