Angular-oauth2-oidc: Status of jsrasign dependency and resulting bundle size?

[medokin]

Hi, the description says that jsrasign should be replaced in a past release to lower the bundle size. This seems not to be done.

Should we update the readme with a clarification?

Is there a technication reason why jsrasign is not removed?

[jeroenheijmans]

Some observations:

• JSRASIGN was removed in 5.0.0, but brought back in 5.0.2 when it turned out there were unforeseen problems
• the start of the README indeed still has this change from 5.0.0 and should be updated I think
• no one has picked up the task of giving a second go at removing the jsrasign dependency, or reducing it - just yet
• there's another similar library that seems to struggle with this problem too; there are many issues on their GitHub repo, there's a particular one about removing the dependency sticks out at the moment, as well as one where its effect on bundle size was dramatically reduced

Hope that helps?

PS. I'm tempted to use this issue for all these follow-ups (improve docs, reduce bundle size by improving shakeability and/or removing the dependency), would that make sense?

[manfredsteyer]

The next version will work without JSRASIGN when using Code Flow (which is the recommented flow since some months) or Implicit Flow w/o Token-validation.

[cgatian]

@manfredsteyer you might want to update :)

[manfredsteyer]

with version 9, you don't need this for code flow anymore (see readme).