Oidc-client-js: Lib size and dependency on jsrsasign

[primozs]

Currently I am building my one oidc-client from sources but there is still huge dependency there on shipped jsrsasign.

My codecoverage on initial load for oidc-client-js looks like this.

[brockallen]

This is a long standing issue and a dup of a prior issue. As of now, it is what it is. In the future, perhaps there will be time/support to rework this library and drop implicit support.

[jeroenheijmans]

Could not find an open issue but #23 might be the duplicate issue being referred to?

I heard before indeed that jsrsasign is only needed for Implict Flow, but not for Code+PKCE flow - that's what you also mean @brockallen, right?

I follow another library (angular-oauth2-openid) where the maintainer decided to extract validation to a separate library/package you need to include if you use Implicit Flow. That way you won't have the extra bundle size if you have the (currently recommended?) Code+PKCE flow for browser apps. At the cost of extra bootstrapping work for Implicit Flow.

Perhaps this approach would be feasible for oidc-client-js as well? Just a thought.

[brockallen]

My plan is to eventually drop implicit support, as it's deprecated.