Angular-auth-oidc-client: SilentRenew breaks when using refresh_token and refresh_token is expired/invalid

[jsferrazza]

When using silentRenew functionality with use_refresh_token = false, an IFRAME is used and a call to the OIDC authorization endpoint with prompt=none is made. If the OP responds that it is unwilling to vend out a new ID/Access Token (i.e. login_required, user_interaction_required), silentRenew acknowledges this and getIsAuthorized() emits false.

When use_refresh_token = true and the refresh_token is expired or invalidated, the token endpoint returns an error (in some cases a HTTP 400). This appears to breaks SilentRenew such that the diagnostic messages emit say that silentRenew is continuing to run. Additionally, and most importantly, getIsAuthorized() does not emit anything. I can see a case where technically the ID/Access tokens are still valid and therefore emitting getIsAuthorized() == false may not be technically correct, but the behavior is not consistent.

How can we catch this scenario (unable to renew with a refresh_token) and moreover could the behavior be made to be consistent with when a refresh_token isn't used (i.e. authz endpoint with param prompt=none)?

[damienbod]

@jsferrazza thanks for reporting. This needs to be fixed, will add this to version 11, ie when the refresh request fails, reset the silent and the session.

[damienbod]

fixed, will be released with version 11, thanks for reporting