@axa-fr/react-oidc 5.13.12 → 6.0.0-alpha1

package/src/oidc/vanilla/oidc.ts

@@ -10,18 +10,32 @@ import {
     RedirectRequestHandler,
     TokenRequest
 } from '@openid/appauth';
-import {NoHashQueryStringUtils, HashQueryStringUtils} from './noHashQueryStringUtils';
+import {HashQueryStringUtils, NoHashQueryStringUtils} from './noHashQueryStringUtils';
 import {initWorkerAsync, sleepAsync} from './initWorker'
 import {MemoryStorageBackend} from "./memoryStorageBackend";
 import {initSession} from "./initSession";
 import timer from './timer';
 
-const isInIframe = () => {
-    try {
-        return window.self !== window.top;
-    } catch (e) {
-        return true;
+import {CheckSessionIFrame} from "./checkSessionIFrame"
+import {getParseQueryStringFromLocation} from "./route-utils";
+import {AuthorizationServiceConfigurationJson} from "@openid/appauth/src/authorization_service_configuration";
+
+export interface OidcAuthorizationServiceConfigurationJson extends AuthorizationServiceConfigurationJson{
+    check_session_iframe?: string;
+}
+
+export class OidcAuthorizationServiceConfiguration extends AuthorizationServiceConfiguration{
+    private check_session_iframe: string;
+    
+    constructor(request: any) {
+        super(request);
+        this.authorizationEndpoint = request.authorization_endpoint;
+        this.tokenEndpoint = request.token_endpoint;
+        this.revocationEndpoint = request.revocation_endpoint;
+        this.userInfoEndpoint = request.userinfo_endpoint;
+        this.check_session_iframe = request.check_session_iframe;
     }
+    
 }
 
 const idTokenPayload = (token) => {
@@ -70,23 +84,27 @@ export interface AuthorityConfiguration {
     revocation_endpoint: string;
     end_session_endpoint?: string;
     userinfo_endpoint?: string;
+    check_session_iframe?:string;
 }
 
-const refresh_token_scope = "offline_access";
  export type OidcConfiguration = {
-    client_id: string,
-    redirect_uri: string,
+     client_id: string,
+     redirect_uri: string,
      silent_redirect_uri?:string,
+     silent_signin_uri?:string,
      silent_signin_timeout?:number,
-    scope: string,
-    authority: string,
+     scope: string,
+     authority: string,
+     authority_time_cache_wellknowurl_in_second?: number,
      authority_configuration?: AuthorityConfiguration,
-    refresh_time_before_tokens_expiration_in_second?: number,
-    token_request_timeout?: number,
-    service_worker_relative_url?:string,
+     refresh_time_before_tokens_expiration_in_second?: number,
+     token_request_timeout?: number,
+     service_worker_relative_url?:string,
      service_worker_only?:boolean,
      extras?:StringMap
-     token_request_extras?:StringMap, 
+     token_request_extras?:StringMap,
+     storage?: Storage
+     monitor_session?: boolean
 };
 
 const oidcDatabase = {};
@@ -99,22 +117,16 @@ const oidcFactory = (configuration: OidcConfiguration, name="default") => {
 }
 
 const loginCallbackWithAutoTokensRenewAsync = async (oidc) => {
-    const response = await oidc.loginCallbackAsync();
-    const tokens = response.tokens
-    oidc.tokens = await setTokensAsync(oidc.serviceWorker, tokens);
-    if(!oidc.serviceWorker){
-        await oidc.session.setTokens(oidc.tokens);
-    }
-    oidc.publishEvent(Oidc.eventNames.token_aquired, oidc.tokens);
-    oidc.timeoutId = autoRenewTokens(oidc, tokens.refreshToken, oidc.tokens.expiresAt)
-    return { state:response.state, callbackPath : response.callbackPath };
+    const { parsedTokens, state, callbackPath } = await oidc.loginCallbackAsync();
+    oidc.timeoutId = autoRenewTokens(oidc, parsedTokens.refreshToken, parsedTokens.expiresAt)
+    return { state, callbackPath };
 }
 
 const autoRenewTokens = (oidc, refreshToken, expiresAt) => {
     const refreshTimeBeforeTokensExpirationInSecond = oidc.configuration.refresh_time_before_tokens_expiration_in_second ?? 60;
     return timer.setTimeout(async () => {
         const currentTimeUnixSecond = new Date().getTime() /1000;
-        const timeInfo = { timeLeft: Math.round(((expiresAt - refreshTimeBeforeTokensExpirationInSecond)- currentTimeUnixSecond))};
+        const timeInfo = { timeLeft: Math.round(((expiresAt - refreshTimeBeforeTokensExpirationInSecond) - currentTimeUnixSecond))};
         oidc.publishEvent(Oidc.eventNames.token_timer, timeInfo);
         if(currentTimeUnixSecond > (expiresAt - refreshTimeBeforeTokensExpirationInSecond)) {
             const tokens = await oidc.refreshTokensAsync(refreshToken);
@@ -123,9 +135,13 @@ const autoRenewTokens = (oidc, refreshToken, expiresAt) => {
                 await oidc.session.setTokens(oidc.tokens);
             }
             if(!oidc.tokens){
+                if(oidc.checkSessionIFrame){
+                    oidc.checkSessionIFrame.stop();
+                    oidc.checkSessionIFrame = null;
+                }
                 return;                
             }
-            oidc.publishEvent(Oidc.eventNames.token_renewed, oidc.tokens);
+            oidc.publishEvent(Oidc.eventNames.token_renewed, {});
             if(oidc.timeoutId) {
                 oidc.timeoutId = autoRenewTokens(oidc, tokens.refreshToken, oidc.tokens.expiresAt);
             }
@@ -138,10 +154,14 @@ const autoRenewTokens = (oidc, refreshToken, expiresAt) => {
     }, 1000);
 }
 
-export const getLoginParams = (configurationName) => {
-    return JSON.parse(sessionStorage[`oidc_login.${configurationName}`]);
+const getLoginSessionKey = (configurationName:string, redirectUri:string) => {
+    return `oidc_login.${configurationName}:${redirectUri}`;
+}
+const getLoginParams = (configurationName, redirectUri) => {
+    return JSON.parse(sessionStorage[getLoginSessionKey(configurationName, redirectUri)]);
 }
 
+
 const userInfoAsync = async (oidc) => {
     if(oidc.userInfo != null){
         return oidc.userInfo;
@@ -188,13 +208,15 @@ const setTokensAsync = async (serviceWorker, tokens) =>{
     else {
         accessTokenPayload = extractAccessTokenPayload(tokens);
     }
-    const expiresAt =  tokens.issuedAt + tokens.expiresIn;
-    return {...tokens, idTokenPayload: idTokenPayload(tokens.idToken), accessTokenPayload, expiresAt};
+    const _idTokenPayload = idTokenPayload(tokens.idToken);
+    const expiresAt =  (_idTokenPayload && _idTokenPayload.exp) ? _idTokenPayload.exp :  tokens.issuedAt + tokens.expiresIn;
+    return {...tokens, idTokenPayload: _idTokenPayload, accessTokenPayload, expiresAt};
 }
 
 const eventNames = {
     service_worker_not_supported_by_browser: "service_worker_not_supported_by_browser",
     token_aquired: "token_aquired",
+    logout_from_another_tab: "logout_from_another_tab",
     token_renewed: "token_renewed",
     token_timer: "token_timer",
     loginAsync_begin:"loginAsync_begin",
@@ -205,8 +227,6 @@ const eventNames = {
     refreshTokensAsync_begin: "refreshTokensAsync_begin",
     refreshTokensAsync_end: "refreshTokensAsync_end",
     refreshTokensAsync_error: "refreshTokensAsync_error",
-    refreshTokensAsync_silent_begin: "refreshTokensAsync_silent_begin",
-    refreshTokensAsync_silent_end: "refreshTokensAsync_silent_end",
     refreshTokensAsync_silent_error: "refreshTokensAsync_silent_error",
     tryKeepExistingSessionAsync_begin: "tryKeepExistingSessionAsync_begin",
     tryKeepExistingSessionAsync_end: "tryKeepExistingSessionAsync_end",
@@ -225,6 +245,51 @@ const getRandomInt = (max) => {
     return Math.floor(Math.random() * max);
 }
 
+const WELL_KNOWN_PATH = '.well-known';
+const OPENID_CONFIGURATION = 'openid-configuration';
+
+
+const oneHourSecond = 60 * 60;
+const fetchFromIssuer = async (openIdIssuerUrl: string, timeCacheSecond = oneHourSecond):
+    Promise<OidcAuthorizationServiceConfiguration> => {
+    const fullUrl = `${openIdIssuerUrl}/${WELL_KNOWN_PATH}/${OPENID_CONFIGURATION}`;
+    
+    const localStorageKey = `oidc.server:${openIdIssuerUrl}`;
+    const cacheJson = window.localStorage.getItem(localStorageKey);
+    
+    const oneHourMinisecond = 1000 * timeCacheSecond;
+    // @ts-ignore
+    if(cacheJson && (cacheJson.timestamp + oneHourMinisecond) > Date.now()){
+        return new OidcAuthorizationServiceConfiguration(JSON.parse(cacheJson));
+    }
+    
+    const res = await fetch(fullUrl);
+
+    if (res.status != 200) {
+        return null;
+    }
+    
+    
+    const result = await res.json();
+    window.localStorage.setItem(localStorageKey, JSON.stringify({result, timestamp:Date.now()}));
+    
+    return new OidcAuthorizationServiceConfiguration(result);
+}
+
+const buildQueries = (extras:StringMap) => {
+    let queries = '';
+    if(extras != null){
+        for (let [key, value] of Object.entries(extras)) {
+            if (queries === ""){
+                queries = `?${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+            } else {
+                queries+= `&${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+            }
+        }
+    }
+    return queries;
+}
+
 export class Oidc {
     public configuration: OidcConfiguration;
     public userInfo: null;
@@ -234,7 +299,7 @@ export class Oidc {
     private serviceWorker?: any;
     private configurationName: string;
     private session?: any;
-    private iFrameSession= {}
+    private checkSessionIFrame: CheckSessionIFrame;
     constructor(configuration:OidcConfiguration, configurationName="default") {
       this.configuration = configuration
         this.configurationName= configurationName;
@@ -248,6 +313,7 @@ export class Oidc {
       this.loginCallbackWithAutoTokensRenewAsync.bind(this);
       this.initAsync.bind(this);
       this.loginCallbackAsync.bind(this);
+      this._loginCallbackAsync.bind(this);
       this.subscriveEvents.bind(this);
       this.removeEventSubscription.bind(this);
       this.publishEvent.bind(this);
@@ -285,11 +351,18 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
     
     silentSigninCallbackFromIFrame(){
         if (this.configuration.silent_redirect_uri) {
-            window.top.postMessage(`${this.configurationName}_oidc_tokens:${JSON.stringify(this.tokens)}`, window.location.origin);
+            const queryParams = getParseQueryStringFromLocation(window.location.href);
+            window.top.postMessage(`${this.configurationName}_oidc_tokens:${JSON.stringify({tokens:this.tokens, sessionState:queryParams.session_state})}`, window.location.origin);
         }
     }
-    async silentSigninAsync() {
-        if (!this.configuration.silent_redirect_uri) {
+    silentSigninErrorCallbackFromIFrame(){
+        if (this.configuration.silent_redirect_uri) {
+            const queryParams = getParseQueryStringFromLocation(window.location.href);
+            window.top.postMessage(`${this.configurationName}_oidc_error:${JSON.stringify({error:queryParams.error})}`, window.location.origin);
+        }
+    }
+    async silentSigninAsync(extras:StringMap=null, state:string=null, scope:string=null) {
+        if (!this.configuration.silent_redirect_uri || !this.configuration.silent_signin_uri) {
             return Promise.resolve(null);
         }
         while (document.hidden) {
@@ -300,10 +373,38 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
         try {
             this.publishEvent(eventNames.silentSigninAsync_begin, {});
             const configuration = this.configuration
-            const link = configuration.silent_redirect_uri;
+            let queries = "";
+            
+            if(state){
+                if(extras == null){
+                    extras = {};
+                }
+                extras.state = state;
+            }
+            
+            if(scope){
+                if(extras == null){
+                    extras = {};
+                }
+                extras.scope = scope;
+            }
+            
+            if(extras != null){
+                for (let [key, value] of Object.entries(extras)) {
+                    if (queries === ""){
+                      queries = `?${encodeURIComponent(key)}=${encodeURIComponent(value)}`;  
+                    } else {
+                        queries+= `&${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+                    }
+                }
+            }
+            const link = configuration.silent_signin_uri  + queries;
+            const idx = link.indexOf("/", link.indexOf("//") + 2);
+            const iFrameOrigin = link.substr(0, idx);
             const iframe = document.createElement('iframe');
             iframe.width = "0px";
             iframe.height = "0px";
+            
             iframe.id = `${this.configurationName}_oidc_iframe`;
             iframe.setAttribute("src", link);
             document.body.appendChild(iframe);
@@ -312,18 +413,33 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                 try {
                     let isResolved = false;
                     window.onmessage = function (e) {
-                        const key = `${self.configurationName}_oidc_tokens:`;
-                        if (e.data && typeof (e.data) === "string" && e.data.startsWith(key)) {
-                            if (!isResolved) {
-                                const result = JSON.parse(e.data.replace(key, ''));
-                                self.publishEvent(eventNames.silentSigninAsync_end, result);
-                                iframe.remove();
-                                isResolved = true;
-                                resolve(result);
+                        if (e.origin === iFrameOrigin &&
+                            e.source === iframe.contentWindow
+                        ) {
+                            const key = `${self.configurationName}_oidc_tokens:`;
+                            const key_error = `${self.configurationName}_oidc_error:`;
+                            const data = e.data;
+                            if (data && typeof (data) === "string") {
+                                if (!isResolved) {
+                                    if(data.startsWith(key)) {
+                                        const result = JSON.parse(e.data.replace(key, ''));
+                                        self.publishEvent(eventNames.silentSigninAsync_end, {});
+                                        iframe.remove();
+                                        isResolved = true;
+                                        resolve(result);
+                                    }
+                                    else if(data.startsWith(key_error)) {
+                                        const result = JSON.parse(e.data.replace(key_error, ''));
+                                        self.publishEvent(eventNames.silentSigninAsync_error, result);
+                                        iframe.remove();
+                                        isResolved = true;
+                                        reject(result);
+                                    }
+                                }
                             }
                         }
                     };
-                    const silentSigninTimeout = configuration.silent_signin_timeout ? configuration.silent_signin_timeout : 12000
+                    const silentSigninTimeout = configuration.silent_signin_timeout ?? 12000
                     setTimeout(() => {
                         if (!isResolved) {
                             self.publishEvent(eventNames.silentSigninAsync_error, "timeout");
@@ -346,17 +462,20 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
     initAsyncPromise = null;
     async initAsync(authority:string, authorityConfiguration:AuthorityConfiguration) {
         if (authorityConfiguration != null) {
-            return new AuthorizationServiceConfiguration( {
+            return new OidcAuthorizationServiceConfiguration( {
                 authorization_endpoint: authorityConfiguration.authorization_endpoint,
                 end_session_endpoint: authorityConfiguration.end_session_endpoint,
                 revocation_endpoint: authorityConfiguration.revocation_endpoint,
                 token_endpoint: authorityConfiguration.token_endpoint,
-                userinfo_endpoint: authorityConfiguration.userinfo_endpoint});
+                userinfo_endpoint: authorityConfiguration.userinfo_endpoint,
+                check_session_iframe:authorityConfiguration.check_session_iframe,
+            });
         }
         if(this.initAsyncPromise){
             return this.initAsyncPromise;
         }
-        this.initAsyncPromise = await AuthorizationServiceConfiguration.fetchFromIssuer(authority, new FetchRequestor());
+        
+        this.initAsyncPromise = await fetchFromIssuer(authority, this.configuration.authority_time_cache_wellknowurl_in_second ?? 60 * 60);
         return this.initAsyncPromise;
     }
 
@@ -380,12 +499,21 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                     const {tokens} = await serviceWorker.initAsync(oidcServerConfiguration, "tryKeepExistingSessionAsync");
                     if (tokens) {
                         serviceWorker.startKeepAliveServiceWorker();
-                        const updatedTokens = await this.refreshTokensAsync(tokens.refresh_token, true);
                         // @ts-ignore
-                        this.tokens = await setTokensAsync(serviceWorker, updatedTokens);
+                        const reformattedToken = {
+                            accessToken : tokens.access_token,
+                            refreshToken : tokens.refresh_token,
+                            expiresIn: tokens.expires_in,
+                            idToken: tokens.id_token,
+                            scope: tokens.scope,
+                            tokenType: tokens.token_type
+                        }
+                        this.tokens = await setTokensAsync(serviceWorker, reformattedToken);
                         this.serviceWorker = serviceWorker;
                         // @ts-ignore
-                        this.timeoutId = autoRenewTokens(this, updatedTokens.refreshToken, this.tokens.expiresAt);
+                        this.timeoutId = autoRenewTokens(this, this.tokens.refreshToken, this.tokens.expiresAt);
+                        const sessionState = await serviceWorker.getSessionStateAsync();
+                        await this.startCheckSessionAsync(oidcServerConfiguration.check_session_iframe, configuration.client_id, sessionState);
                         this.publishEvent(eventNames.tryKeepExistingSessionAsync_end, {
                             success: true,
                             message: "tokens inside ServiceWorker are valid"
@@ -402,19 +530,22 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                             message: "service worker is not supported by this browser"
                         });
                     }
-                    const session = initSession(this.configurationName);
+                    const session = initSession(this.configurationName, configuration.redirect_uri, configuration.storage ?? sessionStorage);
                     const {tokens} = await session.initAsync();
+                    console.log("const {tokens} = await session.initAsync();")
+                    console.log(tokens)
                     if (tokens) {
-                        const updatedTokens = await this.refreshTokensAsync(tokens.refreshToken, true);
                         // @ts-ignore
-                        this.tokens = await setTokensAsync(serviceWorker, updatedTokens);
-                        session.setTokens(this.tokens);
+                        this.tokens = await setTokensAsync(serviceWorker, tokens);
+                        //session.setTokens(this.tokens);
                         this.session = session;
                         // @ts-ignore
-                        this.timeoutId = autoRenewTokens(this, updatedTokens.refreshToken, this.tokens.expiresAt);
+                        this.timeoutId = autoRenewTokens(this, tokens.refreshToken, this.tokens.expiresAt);
+                        const sessionState = session.getSessionState();
+                        await this.startCheckSessionAsync(oidcServerConfiguration.check_session_iframe, configuration.client_id, sessionState);
                         this.publishEvent(eventNames.tryKeepExistingSessionAsync_end, {
                             success: true,
-                            message: "tokens inside ServiceWorker are valid"
+                            message: `tokens inside storage are valid`
                         });
                         return true;
                     }
@@ -425,6 +556,7 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                 });
                 return false;
             } catch (exception) {
+                console.error(exception);
                 if (serviceWorker) {
                     await serviceWorker.clearAsync();
                 }
@@ -440,109 +572,167 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
         });
     }
 
-    async loginAsync(callbackPath:string=undefined, extras:StringMap=null, installServiceWorker=true, state:string=undefined) {
-        try {
-            const location = window.location;
-            const url = callbackPath || location.pathname + (location.search || '') + (location.hash || '');
-            this.publishEvent(eventNames.loginAsync_begin, {});
-            const configuration = this.configuration
-            // Security we cannot loggin from Iframe
-            if (!configuration.silent_redirect_uri && isInIframe()) {
-                throw new Error("Login from iframe is forbidden");
-            }
-            sessionStorage[`oidc_login.${this.configurationName}`] = JSON.stringify({callbackPath:url,extras,state});
-            
-            let serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
-            const oidcServerConfiguration = await this.initAsync(configuration.authority, configuration.authority_configuration);
-            if(serviceWorker && installServiceWorker) {
-                const isServiceWorkerProxyActive = await serviceWorker.isServiceWorkerProxyActiveAsync();
-                if(!isServiceWorkerProxyActive) {
-                    window.location.href = `${configuration.redirect_uri}/service-worker-install`;
-                    return;
+    loginPromise: Promise<any>=null;
+    async loginAsync(callbackPath:string=undefined, extras:StringMap=null, installServiceWorker=true, state:string=undefined, isSilentSignin:boolean=false, scope:string=undefined) {
+        if(this.loginPromise !== null){
+            return this.loginPromise;
+        }
+        
+        const loginLocalAsync=async () => {
+            try {
+                const location = window.location;
+                const url = callbackPath || location.pathname + (location.search || '') + (location.hash || '');
+                this.publishEvent(eventNames.loginAsync_begin, {});
+                const configuration = this.configuration;
+
+                const redirectUri = isSilentSignin ? configuration.silent_redirect_uri : configuration.redirect_uri;
+                if (!scope) {
+                    scope = configuration.scope;
+                }
+
+                const sessionKey = getLoginSessionKey(this.configurationName, redirectUri);
+                sessionStorage[sessionKey] = JSON.stringify({callbackPath: url, extras, state});
+
+                let serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
+                const oidcServerConfiguration = await this.initAsync(configuration.authority, configuration.authority_configuration);
+                if (serviceWorker && installServiceWorker) {
+                    const isServiceWorkerProxyActive = await serviceWorker.isServiceWorkerProxyActiveAsync();
+                    if (!isServiceWorkerProxyActive) {
+                        const isUnregistered = await serviceWorker.unregisterAsync();
+                        const extrasQueries = extras != null ? {...extras}: {};
+                        extrasQueries.callbackPath = url;
+                        extrasQueries.state = state;
+                        const queryString = buildQueries(extrasQueries);
+                        window.location.href = `${redirectUri}/service-worker-install${queryString}`;
+                        return;
+                    }
+                }
+                let storage;
+                if (serviceWorker) {
+                    serviceWorker.startKeepAliveServiceWorker();
+                    await serviceWorker.initAsync(oidcServerConfiguration, "loginAsync");
+                    storage = new MemoryStorageBackend(serviceWorker.saveItemsAsync, {});
+                    await storage.setItem("dummy", {});
+                } else {
+                    const session = initSession(this.configurationName, redirectUri);
+                    storage = new MemoryStorageBackend(session.saveItemsAsync, {});
                 }
+
+                const extraFinal = extras ?? configuration.extras ?? {};
+
+                // @ts-ignore
+                const queryStringUtil = redirectUri.includes("#") ? new HashQueryStringUtils() : new NoHashQueryStringUtils();
+                const authorizationHandler = new RedirectRequestHandler(storage, queryStringUtil, window.location, new DefaultCrypto());
+                const authRequest = new AuthorizationRequest({
+                    client_id: configuration.client_id,
+                    redirect_uri: redirectUri,
+                    scope,
+                    response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
+                    state,
+                    extras: extraFinal
+                });
+                authorizationHandler.performAuthorizationRequest(oidcServerConfiguration, authRequest);
+            } catch (exception) {
+                this.publishEvent(eventNames.loginAsync_error, exception);
+                throw exception;
             }
-            let storage;
-            if(serviceWorker) {
-                serviceWorker.startKeepAliveServiceWorker();
-                await serviceWorker.initAsync(oidcServerConfiguration, "loginAsync");
-                storage = new MemoryStorageBackend(serviceWorker.saveItemsAsync, {});
-                await storage.setItem("dummy",{});
+        }
+        this.loginPromise = loginLocalAsync();
+        return this.loginPromise.then(result =>{
+            this.loginPromise = null;
+            return result;
+        });
+
+    }
+    
+    async startCheckSessionAsync(checkSessionIFrameUri, clientId, sessionState, isSilentSignin=false){
+        return new Promise((resolve:Function, reject) => {
+            if (this.configuration.silent_signin_uri && this.configuration.silent_redirect_uri && this.configuration.monitor_session && checkSessionIFrameUri && sessionState && !isSilentSignin) {
+                const checkSessionCallback = () => {
+                    this.checkSessionIFrame.stop();
+                    
+                    if(this.tokens === null){
+                        return;
+                    }
+                    // @ts-ignore
+                    const idToken = this.tokens.idToken;
+                    // @ts-ignore
+                    const idTokenPayload = this.tokens.idTokenPayload;
+                    this.silentSigninAsync({
+                        prompt: "none",
+                        id_token_hint: idToken,
+                        scope: "openid"
+                    }).then((silentSigninResponse) => {
+                        const iFrameIdTokenPayload = silentSigninResponse.tokens.idTokenPayload;
+                        if (idTokenPayload.sub === iFrameIdTokenPayload.sub) {
+                            const sessionState = silentSigninResponse.sessionState;
+                            this.checkSessionIFrame.start(silentSigninResponse.sessionState);
+                            if (idTokenPayload.sid === iFrameIdTokenPayload.sid) {
+                                console.debug("SessionMonitor._callback: Same sub still logged in at OP, restarting check session iframe; session_state:", sessionState);
+                            } else {
+                                console.debug("SessionMonitor._callback: Same sub still logged in at OP, session state has changed, restarting check session iframe; session_state:", sessionState);
+                            }
+                        }
+                        else {
+                            console.debug("SessionMonitor._callback: Different subject signed into OP:", iFrameIdTokenPayload.sub);
+                        }
+                    }).catch((e) => {
+                        this.publishEvent(eventNames.logout_from_another_tab, {});
+                        this.destroyAsync();
+                    });
+                };
+
+                this.checkSessionIFrame = new CheckSessionIFrame(checkSessionCallback, clientId, checkSessionIFrameUri);
+                this.checkSessionIFrame.load().then(() => {
+                    this.checkSessionIFrame.start(sessionState);
+                    resolve();
+                }).catch((e) =>{
+                    reject(e);
+                });
             } else {
-                const session = initSession(this.configurationName);
-                storage = new MemoryStorageBackend(session.saveItemsAsync, {});
+                resolve();
             }
-            
-            // @ts-ignore
-            const queryStringUtil = configuration.redirect_uri.includes("#") ? new HashQueryStringUtils() : new NoHashQueryStringUtils();
-            const authorizationHandler = new RedirectRequestHandler(storage, queryStringUtil, window.location, new DefaultCrypto());
-                    const authRequest = new AuthorizationRequest({
-                        client_id: configuration.client_id,
-                        redirect_uri: configuration.redirect_uri,
-                        scope: configuration.scope,
-                        response_type: AuthorizationRequest.RESPONSE_TYPE_CODE,
-                        state,
-                        extras: extras ?? configuration.extras
-                    });
-                    authorizationHandler.performAuthorizationRequest(oidcServerConfiguration, authRequest);
-        } catch(exception) {
-            this.publishEvent(eventNames.loginAsync_error, exception);
-            throw exception;
-        }
+        });
     }
 
-    syncTokensAsyncPromise=null;
-    async syncTokensAsync() {
-        // Service Worker can be killed by the browser (when it wants,for example after 10 seconds of inactivity, so we retreieve the session if it happen)
-        const configuration = this.configuration;
-        if(!this.tokens){
-            return;
+    loginCallbackPromise : Promise<any>=null
+    async loginCallbackAsync(isSilenSignin:boolean=false){
+        if(this.loginCallbackPromise !== null){
+            return this.loginCallbackPromise;
         }
-       
-        const oidcServerConfiguration = await this.initAsync(configuration.authority, configuration.authority_configuration);
-        const serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
-        if (serviceWorker) {
-            const {tokens} = await serviceWorker.initAsync(oidcServerConfiguration, "syncTokensAsync");
-            if(!tokens){
-                try {
-                    this.publishEvent(eventNames.syncTokensAsync_begin, {});
-                    this.syncTokensAsyncPromise = this.silentSigninAsync();
-                    const silent_token_response = await this.syncTokensAsyncPromise;
-                    console.log("silent_token_response")
-                    console.log(silent_token_response)
-                    if (silent_token_response) {
-                        this.tokens = await setTokensAsync(serviceWorker, silent_token_response);
-                    } else{
-                        this.publishEvent(eventNames.syncTokensAsync_error, null);
-                        if(this.timeoutId){
-                           timer.clearTimeout(this.timeoutId);
-                           this.timeoutId=null;
-                        }
-                        return;
-                    }
-                } catch (exceptionSilent) {
-                    console.error(exceptionSilent);
-                    this.publishEvent(eventNames.syncTokensAsync_error, exceptionSilent);
-                    if(this.timeoutId){
-                        timer.clearTimeout(this.timeoutId);
-                        this.timeoutId=null;
-                    }
-                    return;
-                }
-                this.syncTokensAsyncPromise = null;
-                this.publishEvent(eventNames.syncTokensAsync_end, {});
+        
+        const loginCallbackLocalAsync= async( ) =>{
+            const response = await this._loginCallbackAsync(isSilenSignin);
+            // @ts-ignore
+            const tokens = response.tokens;
+            const parsedTokens = await setTokensAsync(this.serviceWorker, tokens);
+            this.tokens = parsedTokens;
+            if(!this.serviceWorker){
+                await this.session.setTokens(parsedTokens);
             }
+            this.publishEvent(Oidc.eventNames.token_aquired, parsedTokens);
+            // @ts-ignore
+            return  { parsedTokens, state:response.state, callbackPath : response.callbackPath};
         }
+        
+        this.loginCallbackPromise = loginCallbackLocalAsync();
+        return this.loginCallbackPromise.then(result =>{
+            this.loginCallbackPromise = null;
+            return result;
+        })
     }
-
-    async loginCallbackAsync(){
+    
+    async _loginCallbackAsync(isSilentSignin:boolean=false){
         try {
             this.publishEvent(eventNames.loginCallbackAsync_begin, {});
             const configuration = this.configuration;
             const clientId = configuration.client_id;
-            const redirectURL = configuration.redirect_uri;
+            const redirectUri = isSilentSignin ? configuration.silent_redirect_uri : configuration.redirect_uri;
             const authority =  configuration.authority;
             const tokenRequestTimeout =  configuration.token_request_timeout;
             const oidcServerConfiguration = await this.initAsync(authority, configuration.authority_configuration);
+            const queryParams = getParseQueryStringFromLocation(window.location.href);
+            const sessionState =  queryParams.session_state;
             const serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
             let storage = null;
             if(serviceWorker){
@@ -556,16 +746,19 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                     throw new Error("Service Worker storage disapear");
                 }
                 await storage.removeItem("dummy");
+                await serviceWorker.setSessionStateAsync(sessionState);
             }else{
-                const session = initSession(this.configurationName);
-                this.session = session;
+                
+                this.session = initSession(this.configurationName, redirectUri, configuration.storage ?? sessionStorage);
+                const session = initSession(this.configurationName, redirectUri);
+                session.setSessionState(sessionState);
                 const items = await session.loadItemsAsync();
                 storage = new MemoryStorageBackend(session.saveItemsAsync, items);
             }
             return new Promise((resolve, reject) => {
                 // @ts-ignore
                 let queryStringUtil = new NoHashQueryStringUtils();
-                if(configuration.redirect_uri.includes("#")) {
+                if(redirectUri.includes("#")) {
                     const splithash = window.location.href.split("#");
                     if (splithash.length === 2 && splithash[1].includes("?")) {
                         queryStringUtil = new HashQueryStringUtils();
@@ -599,14 +792,14 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
 
                     const tokenRequest = new TokenRequest({
                         client_id: clientId,
-                        redirect_uri: redirectURL,
+                        redirect_uri: redirectUri,
                         grant_type: GRANT_TYPE_AUTHORIZATION_CODE,
                         code: response.code,
                         refresh_token: undefined,
                         extras,
                     });
 
-                    let timeoutId = setTimeout(function(){
+                    let timeoutId = setTimeout(()=>{
                         reject("performTokenRequest timeout");
                         timeoutId=null;
                     }, tokenRequestTimeout ?? 12000);
@@ -614,14 +807,16 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                         const tokenHandler = new BaseTokenRequestHandler(new FetchRequestor());
                         tokenHandler.performTokenRequest(oidcServerConfiguration, tokenRequest).then((tokenResponse)=>{
                             if(timeoutId) {
-                                const loginParams = getLoginParams(this.configurationName);
                                 clearTimeout(timeoutId);
                                 this.timeoutId=null;
-                                this.publishEvent(eventNames.loginCallbackAsync_end, {});
-                                resolve({
-                                    tokens: tokenResponse,
-                                    state: request.state,
-                                    callbackPath: loginParams.callbackPath,
+                                const loginParams = getLoginParams(this.configurationName, redirectUri);
+                                this.startCheckSessionAsync(oidcServerConfiguration.check_session_iframe, clientId, sessionState, isSilentSignin).then(() =>{
+                                    this.publishEvent(eventNames.loginCallbackAsync_end, {});
+                                    resolve({
+                                        tokens: tokenResponse,
+                                        state: request.state,
+                                        callbackPath: loginParams.callbackPath,
+                                    });
                                 });
                             }
                         });
@@ -642,15 +837,14 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
             this.publishEvent(eventNames.loginCallbackAsync_error, exception);
             throw exception;
         }
-
     }
 
-    async refreshTokensAsync(refreshToken, silentEvent = false) {
+    async refreshTokensAsync(refreshToken) {
         const localSilentSigninAsync= async (exception=null) => {
             try {
                 const silent_token_response = await this.silentSigninAsync();
                 if (silent_token_response) {
-                    return silent_token_response;
+                    return silent_token_response.tokens;
                 }
             } catch (exceptionSilent) {
                 console.error(exceptionSilent);
@@ -659,12 +853,12 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                 timer.clearTimeout(this.timeoutId);
                 this.timeoutId=null;
             }
-            this.publishEvent(silentEvent ? eventNames.refreshTokensAsync_silent_error : eventNames.refreshTokensAsync_error, exception);
+            this.publishEvent(eventNames.refreshTokensAsync_error, exception);
             return null;
         }
 
         try{
-            this.publishEvent(silentEvent ? eventNames.refreshTokensAsync_silent_begin : eventNames.refreshTokensAsync_begin, {})
+            this.publishEvent(eventNames.refreshTokensAsync_begin, {refreshToken:refreshToken})
             const configuration = this.configuration;
             const clientId = configuration.client_id;
             const redirectUri = configuration.redirect_uri;
@@ -696,14 +890,69 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
             
             const oidcServerConfiguration = await this.initAsync(authority, configuration.authority_configuration);
             const token_response = await tokenHandler.performTokenRequest(oidcServerConfiguration, request);
-            this.publishEvent(silentEvent ? eventNames.refreshTokensAsync_silent_end :eventNames.refreshTokensAsync_end,  {message:"success"});
+            this.publishEvent(eventNames.refreshTokensAsync_end,  {message:"success"});
             return token_response;
         } catch(exception) {
             console.error(exception);
+            this.publishEvent(eventNames.refreshTokensAsync_silent_error, exception);
             return await localSilentSigninAsync(exception);
         }
      }
 
+    syncTokensAsyncPromise=null;
+    async syncTokensAsync() {
+        // Service Worker can be killed by the browser (when it wants,for example after 10 seconds of inactivity, so we retreieve the session if it happen)
+        const configuration = this.configuration;
+        if(!this.tokens){
+            return;
+        }
+
+        const oidcServerConfiguration = await this.initAsync(configuration.authority, configuration.authority_configuration);
+        const serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
+        if (serviceWorker) {
+            const { isLogin } = await serviceWorker.initAsync(oidcServerConfiguration, "syncTokensAsync");
+            if(isLogin == false){
+                this.publishEvent(eventNames.logout_from_another_tab, {});
+                await this.destroyAsync();
+            }
+            else if (isLogin == null){
+                try {
+                    this.publishEvent(eventNames.syncTokensAsync_begin, {});
+                    this.syncTokensAsyncPromise = this.silentSigninAsync({prompt:"none"});
+                    const silent_token_response = await this.syncTokensAsyncPromise;
+                    if (silent_token_response && silent_token_response.tokens) {
+                        this.tokens = await setTokensAsync(serviceWorker, silent_token_response.tokens);
+                    } else{
+                        this.publishEvent(eventNames.syncTokensAsync_error, null);
+                        if(this.timeoutId){
+                            timer.clearTimeout(this.timeoutId);
+                            this.timeoutId=null;
+                        }
+                        return;
+                    }
+                } catch (exceptionSilent) {
+                    console.error(exceptionSilent);
+                    this.publishEvent(eventNames.syncTokensAsync_error, exceptionSilent);
+                    if(this.timeoutId){
+                        timer.clearTimeout(this.timeoutId);
+                        this.timeoutId=null;
+                    }
+                    return;
+                }
+                this.syncTokensAsyncPromise = null;
+                this.publishEvent(eventNames.syncTokensAsync_end, {});
+            }
+        } else {
+            const session = initSession(this.configurationName, configuration.redirect_uri, configuration.storage ?? sessionStorage);
+            const {tokens} = await session.initAsync();
+            if(!tokens){
+                this.publishEvent(eventNames.logout_from_another_tab, {});
+                await this.destroyAsync();
+            }
+        }
+    }
+
+
     loginCallbackWithAutoTokensRenewPromise:Promise<loginCallbackResult> = null;
      loginCallbackWithAutoTokensRenewAsync():Promise<loginCallbackResult>{
          if(this.loginCallbackWithAutoTokensRenewPromise !== null){
@@ -721,6 +970,11 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
      }
      
      async destroyAsync() {
+         timer.clearTimeout(this.timeoutId);
+         this.timeoutId=null;
+         if(this.checkSessionIFrame){
+             this.checkSessionIFrame.stop();
+         }
         if(this.serviceWorker){
             await this.serviceWorker.clearAsync();
         }
@@ -730,8 +984,7 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
          this.tokens = null;
          this.userInfo = null;
          this.events = [];
-         timer.clearTimeout(this.timeoutId);
-         this.timeoutId=null;
+         
      }
      
     async logoutAsync(callbackPathOrUrl: string | undefined = undefined, extras: StringMap = null) {