Oidc-client-js: Consider removing Cordova support in 2.0

[brockallen]

This issue is to gauge the current level of Cordova use and find out how painful this will be if Cordova is removed. Feedback welcome.

[markphillips100]

Well I for one use it a lot in all my Ionic apps. Happy to fork and go my own way though but then it'll end up a private repo I guess.

[markphillips100]

Would maybe moving the cordova specifics into its own repo as pluggable components help? So those who want cordova include both libraries and setup via configuration as usual perhaps?

[masterpoi]

Using it

[markphillips100]

I'd be for removing it as the implementation (InAppBrowser approach) is no longer recommended for native/hybrid apps.

[kabaehr]

I just landed here because I wanted to consider this repo for use it in my cordova application.

I also read that the InAppBrowser is no longer recommended but what else to use? SafariViewController/ChromeCustomTabs? I am doing this, but ChromeCustomTabs does not support hidden windows, so I can't have token refreshment... so I am stuck to inAppBrowser at least for Android

[brockallen]

so I can't have token refreshment

For native apps you'd use hybrid flow (and PKCE), and thus you'd be able to use refresh tokens.

[kabaehr]

Thanks for the answer. Our application is also running in the browser, therefore we are using the implicit flow. As far as I understand it, we can't use both flows (using Azure) without doubling our Azure B2C endpoint. Do you probably know a solution for this?

[brockallen]

Sorry, I can't help you with AB2C. But still, if your app is considered native (like cordova) then it should use hybrid and PKCE with the system browser (and not implicit with an embedded browser), as recommended by this: https://tools.ietf.org/html/rfc8252