@auth0/auth0-spa-js 2.11.0 → 2.11.1

package/dist/typings/global.d.ts

@@ -140,9 +140,12 @@ export interface Auth0ClientOptions {
      */
     cache?: ICache;
     /**
-     * If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the legacy technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
+     * If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the standard technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
      * The default setting is `false`.
      *
+     * Standard technique relies on cookies. Because browsers increasingly block third-party cookies, it requires a Custom Domain to function reliably. Refresh tokens serve as a fallback for environments where third-party cookies are blocked.
+     * Using a Custom Domain with this set to `false` is the most secure and recommended approach.
+     *
      * **Note**: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.
      */
     useRefreshTokens?: boolean;

package/dist/typings/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "2.11.0";
+declare const _default: "2.11.1";
 export default _default;

package/package.json

@@ -3,7 +3,7 @@
   "name": "@auth0/auth0-spa-js",
   "description": "Auth0 SDK for Single Page Applications using Authorization Code Grant Flow with PKCE",
   "license": "MIT",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "main": "dist/lib/auth0-spa-js.cjs.js",
   "types": "dist/typings/index.d.ts",
   "module": "dist/auth0-spa-js.production.esm.js",
@@ -59,7 +59,7 @@
     "@types/jest": "^28.1.7",
     "@typescript-eslint/eslint-plugin-tslint": "^5.33.1",
     "@typescript-eslint/parser": "^5.33.1",
-    "browserstack-cypress-cli": "1.32.8",
+    "browserstack-cypress-cli": "1.36.0",
     "cli-table": "^0.3.6",
     "concurrently": "^7.3.0",
     "cypress": "13.17.0",
@@ -76,7 +76,7 @@
     "jest-junit": "^14.0.0",
     "jest-localstorage-mock": "^2.4.22",
     "jsonwebtoken": "^9.0.0",
-    "oidc-provider": "^7.14.0",
+    "oidc-provider": "^9.6.0",
     "prettier": "^2.7.1",
     "pretty-quick": "^3.1.2",
     "rimraf": "^3.0.2",

package/src/Auth0Client.ts

@@ -1373,6 +1373,19 @@ export class Auth0Client {
       organization
     );
 
+    // When logging in with authorization_code, check if a different user is authenticating
+    // If so, clear the cache to prevent tokens from multiple users coexisting
+    if (options.grant_type === 'authorization_code') {
+      const existingIdToken = await this._getIdTokenFromCache();
+      
+      if (existingIdToken?.decodedToken?.claims?.sub && 
+          existingIdToken.decodedToken.claims.sub !== decodedToken.claims.sub) {
+        // Different user detected - clear cached tokens
+        await this.cacheManager.clear(this.options.clientId);
+        this.userCache.remove(CACHE_KEY_ID_TOKEN_SUFFIX);
+      }
+    }
+
     await this._saveEntryInCache({
       ...authResult,
       decodedToken,

package/src/global.ts

@@ -161,9 +161,12 @@ export interface Auth0ClientOptions {
   cache?: ICache;
 
   /**
-   * If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the legacy technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
+   * If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the standard technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
    * The default setting is `false`.
    *
+   * Standard technique relies on cookies. Because browsers increasingly block third-party cookies, it requires a Custom Domain to function reliably. Refresh tokens serve as a fallback for environments where third-party cookies are blocked.
+   * Using a Custom Domain with this set to `false` is the most secure and recommended approach.
+   *
    * **Note**: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.
    */
   useRefreshTokens?: boolean;

package/src/version.ts

@@ -1 +1 @@
-export default '2.11.0';
+export default '2.11.1';