@asgardeo/auth-spa 0.1.10 → 0.2.3

package/src/clients/main-thread-client.ts

@@ -297,14 +297,14 @@ export const MainThreadClient = async (
     ): Promise<BasicUserInfo> => {
         const config = await _dataLayer.getConfigData();
 
-        const isLoggingOut = await _sessionManagementHelper.receivePromptNoneResponse(
+        const shouldStopContinue = await _sessionManagementHelper.receivePromptNoneResponse(
             async (sessionState: string | null) => {
                 await _dataLayer.setSessionDataParameter(SESSION_STATE, sessionState ?? "");
                 return;
             }
         );
 
-        if (isLoggingOut) {
+        if (shouldStopContinue) {
             return Promise.resolve({
                 allowedScopes: "",
                 displayName: "",
@@ -322,7 +322,11 @@ export const MainThreadClient = async (
         if (await _authenticationClient.isAuthenticated()) {
             _spaHelper.clearRefreshTokenTimeout();
             _spaHelper.refreshAccessTokenAutomatically();
-            checkSession();
+
+            // Enable OIDC Sessions Management only if it is set to true in the config.
+            if (config.enableOIDCSessionManagement) {
+                checkSession();
+            }
 
             return Promise.resolve(await _authenticationClient.getBasicUserInfo());
         }
@@ -371,6 +375,8 @@ export const MainThreadClient = async (
 
             location.href = url;
 
+            await SPAUtils.waitTillPageRedirect();
+
             return Promise.resolve({
                 allowedScopes: "",
                 displayName: "",
@@ -391,10 +397,12 @@ export const MainThreadClient = async (
 
         _spaHelper.clearRefreshTokenTimeout();
 
+        await SPAUtils.waitTillPageRedirect();
+
         return true;
     };
 
-    const requestCustomGrant = async(config: CustomGrantConfig): Promise<BasicUserInfo | HttpResponse> => {
+    const requestCustomGrant = async (config: CustomGrantConfig): Promise<BasicUserInfo | HttpResponse> => {
         let useDefaultEndpoint = true;
         let matches = false;
         const clientConfig = await _dataLayer.getConfigData();
@@ -436,8 +444,8 @@ export const MainThreadClient = async (
                     "requestCustomGrant",
                     "Request to the provided endpoint is prohibited.",
                     "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
-                        " attribute while initializing the SDK. The specified token endpoint in this request " +
-                        "cannot be found among the `resourceServerURLs`"
+                    " attribute while initializing the SDK. The specified token endpoint in this request " +
+                    "cannot be found among the `resourceServerURLs`"
                 )
             );
         }
@@ -488,7 +496,11 @@ export const MainThreadClient = async (
 
                 _spaHelper.clearRefreshTokenTimeout();
                 _spaHelper.refreshAccessTokenAutomatically();
-                checkSession();
+
+                // Enable OIDC Sessions Management only if it is set to true in the config.
+                if (config.enableOIDCSessionManagement) {
+                    checkSession();
+                }
 
                 return _authenticationClient.getBasicUserInfo();
             })
@@ -555,28 +567,34 @@ export const MainThreadClient = async (
         }
 
         return new Promise((resolve, reject) => {
-            const listenToPrompNoneIFrame = async (e: MessageEvent) => {
+            const listenToPromptNoneIFrame = async (e: MessageEvent) => {
                 const data: Message<AuthorizationInfo | null> = e.data;
+                const timer = setTimeout(() => {
+                    resolve(false);
+                }, 10000);
 
                 if (data?.type == CHECK_SESSION_SIGNED_OUT) {
-                    window.removeEventListener("message", listenToPrompNoneIFrame);
+                    window.removeEventListener("message", listenToPromptNoneIFrame);
+                    clearTimeout(timer);
                     resolve(false);
                 }
 
                 if (data?.type == CHECK_SESSION_SIGNED_IN && data?.data?.code) {
                     requestAccessToken(data.data.code, data?.data?.sessionState)
                         .then((response: BasicUserInfo) => {
-                            window.removeEventListener("message", listenToPrompNoneIFrame);
+                            window.removeEventListener("message", listenToPromptNoneIFrame);
+                            clearTimeout(timer);
                             resolve(response);
                         })
                         .catch((error) => {
-                            window.removeEventListener("message", listenToPrompNoneIFrame);
+                            window.removeEventListener("message", listenToPromptNoneIFrame);
+                            clearTimeout(timer);
                             reject(error);
                         });
                 }
             };
 
-            window.addEventListener("message", listenToPrompNoneIFrame);
+            window.addEventListener("message", listenToPromptNoneIFrame);
         });
     };
 

package/src/clients/web-worker-client.ts

@@ -329,6 +329,7 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
     const trySignInSilently = async (): Promise<BasicUserInfo | boolean> => {
         const config: AuthClientConfig<WebWorkerClientConfig> = await getConfigData();
 
+        // This block is executed by the iFrame when the server redirects with the authorization code.
         if (SPAUtils.setIsInitializedSilentSignIn()) {
             await _sessionManagementHelper.receivePromptNoneResponse();
 
@@ -343,6 +344,11 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
         }
 
         if (SPAUtils.isStatePresentInURL()) {
+            // The state that is used to detect the auth request sent by this method is not there in the URL.
+            // Happens if it is the first time this method is being called.
+            // Or when this method is called inside the iFrame during the check session execution.
+
+            // This reverses the silent sign in flag being set to true by the previous code block.
             SPAUtils.setIsInitializedSilentSignIn();
 
             return Promise.resolve({
@@ -355,6 +361,7 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
             });
         }
 
+        // This gets executed in the main thread and sends the prompt none request.
         const rpIFrame = document.getElementById(RP_IFRAME) as HTMLIFrameElement;
 
         const promptNoneIFrame: HTMLIFrameElement = rpIFrame?.contentDocument?.getElementById(
@@ -380,27 +387,33 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
         }
 
         return new Promise((resolve, reject) => {
-            const listenToPrompNoneIFrame = async (e: MessageEvent) => {
+            const listenToPromptNoneIFrame = async (e: MessageEvent) => {
                 const data: Message<AuthorizationInfo | null> = e.data;
+                const timer = setTimeout(() => {
+                    resolve(false);
+                }, 10000);
 
                 if (data?.type == CHECK_SESSION_SIGNED_OUT) {
-                    window.removeEventListener("message", listenToPrompNoneIFrame);
+                    window.removeEventListener("message", listenToPromptNoneIFrame);
+                    clearTimeout(timer);
                     resolve(false);
                 }
 
                 if (data?.type == CHECK_SESSION_SIGNED_IN && data?.data?.code) {
                     requestAccessToken(data?.data?.code, data?.data?.sessionState).then((response: BasicUserInfo) => {
-                        window.removeEventListener("message", listenToPrompNoneIFrame);
+                        window.removeEventListener("message", listenToPromptNoneIFrame);
+                        clearTimeout(timer);
                         resolve(response);
                     }).catch((error) => {
-                        window.removeEventListener("message", listenToPrompNoneIFrame);
+                        window.removeEventListener("message", listenToPromptNoneIFrame);
+                        clearTimeout(timer);
                         reject(error);
                     })
 
                 }
             };
 
-            window.addEventListener("message", listenToPrompNoneIFrame)
+            window.addEventListener("message", listenToPromptNoneIFrame);
         });
     };
 
@@ -430,7 +443,13 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
                 return communicate<null, string>(message)
                     .then((url: string) => {
                         SPAUtils.setSignOutURL(url);
-                        checkSession();
+
+                        // Enable OIDC Sessions Management only if it is set to true in the config.
+                        if (config.enableOIDCSessionManagement) {
+                            checkSession();
+                        }
+
+                        startAutoRefreshToken();
 
                         return Promise.resolve(response);
                     })
@@ -455,13 +474,13 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
     ): Promise<BasicUserInfo> => {
         const config: AuthClientConfig<WebWorkerClientConfig> = await getConfigData();
 
-        const isLoggingOut = await _sessionManagementHelper.receivePromptNoneResponse(
+        const shouldStopContinue = await _sessionManagementHelper.receivePromptNoneResponse(
             async (sessionState: string | null) => {
                 return setSessionState(sessionState);
             }
         );
 
-        if (isLoggingOut) {
+        if (shouldStopContinue) {
             return Promise.resolve({
                 allowedScopes: "",
                 displayName: "",
@@ -499,7 +518,11 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
 
         if (await isAuthenticated()) {
             await startAutoRefreshToken();
-            checkSession();
+
+            // Enable OIDC Sessions Management only if it is set to true in the config.
+            if (config.enableOIDCSessionManagement) {
+                checkSession();
+            }
 
             return getBasicUserInfo();
         }
@@ -526,13 +549,15 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
         };
 
         return communicate<GetAuthURLConfig, AuthorizationResponse>(message)
-            .then((response) => {
+            .then(async (response) => {
                 if (response.pkce && config.enablePKCE) {
                     SPAUtils.setPKCE(response.pkce);
                 }
 
                 location.href = response.authorizationURL;
 
+                await SPAUtils.waitTillPageRedirect();
+
                 return Promise.resolve({
                     allowedScopes: "",
                     displayName: "",
@@ -554,16 +579,18 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
      */
     const signOut = (): Promise<boolean> => {
         return isAuthenticated()
-            .then((response: boolean) => {
+            .then(async (response: boolean) => {
                 if (response) {
                     const message: Message<null> = {
                         type: SIGN_OUT
                     };
 
                     return communicate<null, string>(message)
-                        .then((response) => {
+                        .then(async (response) => {
                             window.location.href = response;
 
+                            await SPAUtils.waitTillPageRedirect();
+
                             return Promise.resolve(true);
                         })
                         .catch((error) => {
@@ -572,6 +599,8 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
                 } else {
                     window.location.href = SPAUtils.getSignOutURL();
 
+                    await SPAUtils.waitTillPageRedirect();
+
                     return Promise.resolve(true);
                 }
             })
@@ -618,14 +647,14 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
             type: GET_CONFIG_DATA
         };
 
-        return communicate< null, AuthClientConfig<WebWorkerClientConfig>>(message)
+        return communicate<null, AuthClientConfig<WebWorkerClientConfig>>(message)
             .then((response) => {
                 return Promise.resolve(response);
             })
             .catch((error) => {
                 return Promise.reject(error);
-        })
-    }
+            });
+    };
 
     const getBasicUserInfo = (): Promise<BasicUserInfo> => {
         const message: Message<null> = {
@@ -715,9 +744,8 @@ export const WebWorkerClient = (config: AuthClientConfig<WebWorkerClientConfig>)
         }
     };
 
-    const updateConfig = async(newConfig: Partial<AuthClientConfig<WebWorkerClientConfig>>): Promise<void> => {
-
-        const config = { ...await getConfigData(), ...newConfig };
+    const updateConfig = async (newConfig: Partial<AuthClientConfig<WebWorkerClientConfig>>): Promise<void> => {
+        const config = { ...(await getConfigData()), ...newConfig };
 
         const message: Message<Partial<AuthClientConfig<WebWorkerClientConfig>>> = {
             data: config,

package/src/constants/session-management.ts

@@ -23,3 +23,4 @@ export const STATE = "Y2hlY2tTZXNzaW9u";
 export const SILENT_SIGN_IN_STATE = "sign-in-silently";
 export const INITIALIZED_SIGN_IN = "initialized-sign-in";
 export const INITIALIZED_SILENT_SIGN_IN = "initialized-silent-sign-in";
+export const PROMPT_NONE_REQUEST_SENT = "promptNoneRequestSent";

package/src/helpers/session-management-helper.ts

@@ -17,6 +17,7 @@
  */
 
 import { SESSION_STATE } from "@asgardeo/auth-js";
+import { SPAUtils } from "..";
 import {
     CHECK_SESSION_SIGNED_IN,
     CHECK_SESSION_SIGNED_OUT,
@@ -134,7 +135,7 @@ export const SessionManagementHelper = (() => {
             if (e.data === "unchanged") {
                 // [RP] session state has not changed
             } else if (e.data === "error") {
-                window.top.location.href = await _signOut();
+                window.parent.location.href = await _signOut();
             } else {
                 // [RP] session state has changed. Sending prompt=none request...
                 sendPromptNoneRequest();
@@ -150,19 +151,24 @@ export const SessionManagementHelper = (() => {
         const promptNoneIFrame: HTMLIFrameElement = rpIFrame?.contentDocument?.getElementById(
             PROMPT_NONE_IFRAME
         ) as HTMLIFrameElement;
-        promptNoneIFrame.src =
-            _authorizationEndpoint +
-            "?response_type=code" +
-            "&client_id=" +
-            _clientID +
-            "&scope=openid" +
-            "&redirect_uri=" +
-            _redirectURL +
-            "&state=" +
-            STATE +
-            "&prompt=none" +
-            "&code_challenge_method=S256&code_challenge=" +
-            getRandomPKCEChallenge();
+
+        if (SPAUtils.canSendPromptNoneRequest()) {
+            SPAUtils.setPromptNoneRequestSent(true);
+
+            promptNoneIFrame.src =
+                _authorizationEndpoint +
+                "?response_type=code" +
+                "&client_id=" +
+                _clientID +
+                "&scope=openid" +
+                "&redirect_uri=" +
+                _redirectURL +
+                "&state=" +
+                STATE +
+                "&prompt=none" +
+                "&code_challenge_method=S256&code_challenge=" +
+                getRandomPKCEChallenge();
+        }
     };
 
     /**
@@ -176,6 +182,7 @@ export const SessionManagementHelper = (() => {
     ): Promise<boolean> => {
         const state = new URL(window.location.href).searchParams.get("state");
         const sessionState = new URL(window.location.href).searchParams.get(SESSION_STATE);
+        const parent = window.parent.parent;
 
         if (state !== null && (state === STATE || state === SILENT_SIGN_IN_STATE)) {
             // Prompt none response.
@@ -192,17 +199,26 @@ export const SessionManagementHelper = (() => {
                     };
 
                     sessionStorage.setItem(INITIALIZED_SILENT_SIGN_IN, "false");
-                    window.top.postMessage(message, window.top.origin);
+                    parent.postMessage(message, parent.origin);
+                    SPAUtils.setPromptNoneRequestSent(false);
+
                     window.location.href = "about:blank";
 
+                    await SPAUtils.waitTillPageRedirect();
+
                     return true;
                 }
 
                 const newSessionState = new URL(window.location.href).searchParams.get("session_state");
 
                 setSessionState && await setSessionState(newSessionState);
+                SPAUtils.setPromptNoneRequestSent(false);
+
+                window.location.href = "about:blank";
 
-                window.stop();
+                await SPAUtils.waitTillPageRedirect();
+
+                return true;
             } else {
                 if (state === SILENT_SIGN_IN_STATE) {
                     const message: Message<null> = {
@@ -210,15 +226,23 @@ export const SessionManagementHelper = (() => {
                     };
 
                     sessionStorage.setItem(INITIALIZED_SILENT_SIGN_IN, "false");
-                    window.top.postMessage(message, window.top.origin);
+                    window.parent.parent.postMessage(message, parent.origin);
+                    SPAUtils.setPromptNoneRequestSent(false);
+
                     window.location.href = "about:blank";
 
+                    await SPAUtils.waitTillPageRedirect();
+
                     return true;
                 }
 
-                window.top.location.href = await _signOut();
+                SPAUtils.setPromptNoneRequestSent(false);
+
+                parent.location.href = await _signOut();
                 window.location.href = "about:blank";
 
+                await SPAUtils.waitTillPageRedirect();
+
                 return true;
             }
         }
@@ -239,10 +263,10 @@ export const SessionManagementHelper = (() => {
         promptNoneIFrame.setAttribute("id", PROMPT_NONE_IFRAME);
         promptNoneIFrame.style.display = "none";
 
-        document.body.appendChild(rpIFrame);
+        document?.body?.appendChild(rpIFrame);
         rpIFrame = document.getElementById(RP_IFRAME) as HTMLIFrameElement;
-        rpIFrame?.contentDocument?.body.appendChild(opIFrame);
-        rpIFrame?.contentDocument?.body.appendChild(promptNoneIFrame);
+        rpIFrame?.contentDocument?.body?.appendChild(opIFrame);
+        rpIFrame?.contentDocument?.body?.appendChild(promptNoneIFrame);
 
         _signOut = signOut;
 

package/src/models/client-config.ts

@@ -16,10 +16,17 @@
 * under the License.
 */
 
+import { AuthClientConfig } from "@asgardeo/auth-js";
 import { Storage } from "../constants";
 
 
 export interface SPAConfig {
+    /**
+     * Enable OIDC Session Management with PR Iframe.
+     * @remarks If the consumer app the OP is hosted in different domains,
+     * third party cookies has to be enabled for this to work properly.
+     */
+    enableOIDCSessionManagement?: boolean;
     checkSessionInterval?: number;
     sessionRefreshInterval?: number;
     resourceServerURLs?: string[];
@@ -38,3 +45,5 @@ export interface WebWorkerClientConfig  extends SPAConfig {
 }
 
 export type Config = MainThreadClientConfig | WebWorkerClientConfig;
+
+export type AuthSPAClientConfig = AuthClientConfig<Config>;