Oidc-client-js: silent_redirect_uri should not be required when using refresh tokens

[fnberta]

When a refresh token is available, the library uses that to do a silentRenew. Relevant code in UserManager.js:

signinSilent(args = {}) {
        // first determine if we have a refresh token, or need to use iframe
        return this._loadUser().then(user => {
            if (user && user.refresh_token) {
                args.refresh_token = user.refresh_token;
                return this._useRefreshToken(args);
            }
            else {
                args.id_token_hint = args.id_token_hint || (this.settings.includeIdTokenInSilentRenew && user && user.id_token);
                return this._signinSilentIframe(args);
            }
        });
    }

Hence if refresh tokens are available, silent_redirect_uri should not really be needed if I understand it correctly. But the following code in UserSettings.js prevents automaticSilentRenew if no silent_redirect_uri is set:

get automaticSilentRenew() {
        return !!(this.silent_redirect_uri && this._automaticSilentRenew);
    }

This looks like a bug to me, automaticSilentRenew should be possible without a silent_redirect_uri if refresh tokens are available. Or am I missing something?

[brockallen]

Yea, good point. I think when I updated for code flow/refresh tokens I didn't revisit that piece of code. Personally I wish I had never added automaticSilentRenew, and in 2.0 I plan to remove it. So yes, it's a bug in this version.

Are you needing this to be fixed?

[NunoSav]

@brockallen a fix would be nice :)

[brockallen]

So would a PR :)

[fnberta]

Thanks for the response @brockallen. No, doesn't need an urgent fix. I can just specify a silent_redirect_uri even though it's not used. So not a big problem, just something I noticed.

[mylifeandcode]

@brockallen Please don't remove automaticSilentRenew. :)

[brockallen]

Ok, I think I have fixed this by changing the automaticSilentRenew to not require the silent_redirect_uri

[brockallen]

[email protected] released; please have a look and see if it satisfies this issue.

[brockallen]

Any chance to test on the beta?

[vincent-dm]

FYI: I ran into this bug in 1.7.0 and it disappeared by upgrading to 1.7.1. Thanks @brockallen !