@axa-fr/react-oidc 6.3.1 → 6.4.1

package/dist/OidcServiceWorker.js

@@ -20,6 +20,7 @@ let database = {
         tokens: null,
         status:null,
         items:[],
+        nonce: null,
         oidcServerConfiguration: null
     }
 };
@@ -56,6 +57,37 @@ const isTokensValid= (tokens) =>{
     return computeTimeLeft(0, tokens.expiresAt) > 0;
 }
 
+// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).
+// https://github.com/openid/AppAuth-JS/issues/65
+const isTokensOidcValid =(tokens, nonce, oidcServerConfiguration) =>{
+    if(tokens.idTokenPayload) {
+        const idTokenPayload = tokens.idTokenPayload;
+        // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.
+        if(oidcServerConfiguration.issuer !==  idTokenPayload.iss){
+            return false;
+        }
+        // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+
+        // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.
+
+        // 9: The current time MUST be before the time represented by the exp Claim.
+        const currentTimeUnixSecond = new Date().getTime() /1000;
+        if(idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {
+            return false;
+        }
+        // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.
+        const timeInSevenDays = 60 * 60 * 24 * 7;
+        if(idTokenPayload.iat && (idTokenPayload.iat + timeInSevenDays) < currentTimeUnixSecond) {
+            return false;
+        }
+        // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.
+        if (idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {
+            return false;
+        }
+    }
+    return true;
+}
+
 function hideTokens(currentDatabaseElement) {
     const configurationName = currentDatabaseElement.configurationName;
     return (response) => {
@@ -79,8 +111,12 @@ function hideTokens(currentDatabaseElement) {
             let _idTokenPayload = null;
             if(tokens.id_token) {
                 _idTokenPayload = extractTokenPayload(tokens.id_token);
+                tokens.idTokenPayload = {..._idTokenPayload};
+                if(_idTokenPayload.nonce) {
+                    const keyNonce = NONCE_TOKEN + '_'+ currentDatabaseElement.configurationName;
+                    _idTokenPayload.nonce = keyNonce;
+                }
                 secureTokens.idTokenPayload = _idTokenPayload;
-                tokens.idTokenPayload = _idTokenPayload;
             }
             if(tokens.refresh_token){
                 secureTokens.refresh_token = REFRESH_TOKEN + "_" + configurationName;
@@ -90,10 +126,23 @@ function hideTokens(currentDatabaseElement) {
             const accessTokenExpiresAt =  (accessTokenPayload && accessTokenPayload.exp)? accessTokenPayload.exp : tokens.issued_at + tokens.expires_in;
             const expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;
             secureTokens.expiresAt = expiresAt;
-            const body = JSON.stringify(secureTokens);
+           
             tokens.expiresAt = expiresAt;
-            currentDatabaseElement.tokens = tokens;
+
+            if(!isTokensOidcValid(tokens, currentDatabaseElement.nonce.nonce, currentDatabaseElement.oidcServerConfiguration)){
+                throw Error("Tokens are not OpenID valid");
+            }
+            
+            // When refresh_token is not rotated we reuse ald refresh_token
+            if(currentDatabaseElement.tokens != null && "refresh_token" in currentDatabaseElement.tokens && !("refresh_token" in tokens)){
+                const refreshToken = currentDatabaseElement.tokens.refresh_token;
+                currentDatabaseElement.tokens = {...tokens, refresh_token : refreshToken};
+            } else{
+                currentDatabaseElement.tokens = tokens;    
+            }
+            
             currentDatabaseElement.status = "LOGGED_IN";
+            const body = JSON.stringify(secureTokens);
             return new Response(body, response);
         });
     };
@@ -138,7 +187,7 @@ const getCurrentDatabaseDomain = (database, url) => {
             }
         }
 
-        if(hasToSendToken){
+        if(hasToSendToken) {
             if(!currentDatabase.tokens) {
                 return null;
             }
@@ -159,6 +208,7 @@ const serializeHeaders = (headers) => {
 
 const REFRESH_TOKEN = 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER';
 const ACCESS_TOKEN = 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER';
+const NONCE_TOKEN = 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER';
 
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 
@@ -215,11 +265,14 @@ const handleFetch = async (event) => {
                     let newBody = actualBody;
                     for(let i= 0;i<numberDatabase;i++){
                         const currentDb = currentDatabases[i];
-                        const key = REFRESH_TOKEN + '_'+ currentDb.configurationName;
-                        if(currentDb && currentDb.tokens != null && actualBody.includes(key)) {
-                            newBody = newBody.replace(key, encodeURIComponent(currentDb.tokens.refresh_token));
-                            currentDatabase = currentDb;
-                            break;
+
+                        if(currentDb && currentDb.tokens != null) {
+                            const keyRefreshToken = REFRESH_TOKEN + '_'+ currentDb.configurationName;
+                            if(actualBody.includes(keyRefreshToken)) {
+                                newBody = newBody.replace(keyRefreshToken, encodeURIComponent(currentDb.tokens.refresh_token));
+                                currentDatabase = currentDb;
+                                break;
+                            }
                         }
                     }
 
@@ -327,6 +380,8 @@ addEventListener('message', event => {
             checkDomain(domains, tokenEndpoint);
             const userInfoEndpoint = oidcServerConfiguration.userInfoEndpoint;
             checkDomain(domains, userInfoEndpoint);
+            const issuer = oidcServerConfiguration.issuer;
+            checkDomain(domains, issuer);
             currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
             const where = data.data.where;
             if(where === "loginCallbackAsync" || where === "tryKeepExistingSessionAsync") {
@@ -348,6 +403,9 @@ addEventListener('message', event => {
                 if(tokens.refresh_token){
                     tokens.refresh_token = REFRESH_TOKEN + "_" + configurationName;
                 }
+                if(tokens.idTokenPayload && tokens.idTokenPayload.nonce){
+                    tokens.idTokenPayload.nonce =  NONCE_TOKEN + "_" + configurationName;
+                }
                 port.postMessage({
                     tokens,
                     status: currentDatabase.status,
@@ -364,8 +422,12 @@ addEventListener('message', event => {
             const sessionState = currentDatabase.sessionState;
             port.postMessage({configurationName, sessionState});
             return;
+        case "setNonce":
+            currentDatabase.nonce = data.data.nonce;
+            port.postMessage({configurationName});
+            return;
         default:
-            currentDatabase.items = data.data;
+            currentDatabase.items = { ...data.data };
             port.postMessage({configurationName});
             return;
     }

package/dist/vanilla/initSession.d.ts

@@ -10,5 +10,9 @@ export declare const initSession: (configurationName: any, redirectUri: any, sto
     getTokens: () => string;
     setSessionState: (sessionState: any) => void;
     getSessionState: () => any;
+    setNonceAsync: (nonce: any) => void;
+    getNonceAsync: () => Promise<{
+        nonce: any;
+    }>;
 };
 //# sourceMappingURL=initSession.d.ts.map

package/dist/vanilla/initSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initSession.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/initSession.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;;;;;;;;;;CA8CvB,CAAA"}
+{"version":3,"file":"initSession.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/initSession.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;CAmEvB,CAAA"}

package/dist/vanilla/initSession.js

@@ -70,13 +70,35 @@ var initSession = function (configurationName, redirectUri, storage) {
     var getSessionState = function () {
         return storage["oidc.session_state.".concat(configurationName, ":").concat(redirectUri)];
     };
+    var setNonceAsync = function (nonce) {
+        localStorage["oidc.nonce.".concat(configurationName, ":").concat(redirectUri)] = nonce.nonce;
+    };
+    var getNonceAsync = function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            result = { nonce: localStorage["oidc.nonce.".concat(configurationName, ":").concat(redirectUri)] };
+            localStorage["oidc.nonce.".concat(configurationName, ":").concat(redirectUri)] = "";
+            return [2 /*return*/, result];
+        });
+    }); };
     var getTokens = function () {
         if (!storage["oidc.".concat(configurationName, ":").concat(redirectUri)]) {
             return null;
         }
         return JSON.stringify({ tokens: JSON.parse(storage["oidc.".concat(configurationName, ":").concat(redirectUri)]).tokens });
     };
-    return { saveItemsAsync: saveItemsAsync, loadItemsAsync: loadItemsAsync, clearAsync: clearAsync, initAsync: initAsync, setTokens: setTokens, getTokens: getTokens, setSessionState: setSessionState, getSessionState: getSessionState };
+    return {
+        saveItemsAsync: saveItemsAsync,
+        loadItemsAsync: loadItemsAsync,
+        clearAsync: clearAsync,
+        initAsync: initAsync,
+        setTokens: setTokens,
+        getTokens: getTokens,
+        setSessionState: setSessionState,
+        getSessionState: getSessionState,
+        setNonceAsync: setNonceAsync,
+        getNonceAsync: getNonceAsync
+    };
 };
 exports.initSession = initSession;
 //# sourceMappingURL=initSession.js.map

package/dist/vanilla/initSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"initSession.js","sourceRoot":"","sources":["../../src/oidc/vanilla/initSession.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAO,IAAM,WAAW,GAAG,UAAC,iBAAiB,EAAE,WAAW,EAAE,OAAsB;IAAtB,wBAAA,EAAA,wBAAsB;IAE9E,IAAM,cAAc,GAAE,UAAC,KAAK;QACxB,OAAO,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAA;IAED,IAAM,cAAc,GAAC;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAA;IAED,IAAM,UAAU,GAAC,UAAC,MAAM;QACpB,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,QAAA,EAAC,CAAC,CAAC;QAC5F,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAA;IAED,IAAM,SAAS,GAAC;;;YACZ,IAAG,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,EAAC;gBACpD,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC;gBACjG,sBAAO,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,EAAC,IAAI,EAAC,EAAC;aACrC;YACK,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC;YAC7E,sBAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAC;;SACzE,CAAA;IAED,IAAM,SAAS,GAAG,UAAC,MAAM;QACrB,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,QAAA,EAAC,CAAC,CAAC;IACnF,CAAC,CAAA;IAED,IAAM,eAAe,GAAG,UAAC,YAAY;QACjC,OAAO,CAAC,6BAAsB,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,YAAY,CAAC;IACrF,CAAC,CAAA;IAED,IAAM,eAAe,GAAE;QACnB,OAAO,OAAO,CAAC,6BAAsB,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC;IAC7E,CAAC,CAAA;IAED,IAAM,SAAS,GAAG;QAEd,IAAG,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,EAAC;YACpD,OAAO,IAAI,CAAC;SACf;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAA;IAED,OAAO,EAAE,cAAc,gBAAA,EAAE,cAAc,gBAAA,EAAE,UAAU,YAAA,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE,eAAe,iBAAA,EAAE,eAAe,iBAAA,EAAE,CAAC;AAC7H,CAAC,CAAA;AA9CY,QAAA,WAAW,eA8CvB"}
+{"version":3,"file":"initSession.js","sourceRoot":"","sources":["../../src/oidc/vanilla/initSession.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAO,IAAM,WAAW,GAAG,UAAC,iBAAiB,EAAE,WAAW,EAAE,OAAsB;IAAtB,wBAAA,EAAA,wBAAsB;IAE9E,IAAM,cAAc,GAAE,UAAC,KAAK;QACxB,OAAO,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAA;IAED,IAAM,cAAc,GAAC;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAA;IAED,IAAM,UAAU,GAAC,UAAC,MAAM;QACpB,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,QAAA,EAAC,CAAC,CAAC;QAC5F,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAA;IAED,IAAM,SAAS,GAAC;;;YACZ,IAAG,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,EAAC;gBACpD,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC;gBACjG,sBAAO,EAAC,MAAM,EAAC,IAAI,EAAE,MAAM,EAAC,IAAI,EAAC,EAAC;aACrC;YACK,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC;YAC7E,sBAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAC;;SACzE,CAAA;IAED,IAAM,SAAS,GAAG,UAAC,MAAM;QACrB,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,QAAA,EAAC,CAAC,CAAC;IACnF,CAAC,CAAA;IAED,IAAM,eAAe,GAAG,UAAC,YAAY;QACjC,OAAO,CAAC,6BAAsB,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,YAAY,CAAC;IACrF,CAAC,CAAA;IAED,IAAM,eAAe,GAAE;QACnB,OAAO,OAAO,CAAC,6BAAsB,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC;IAC7E,CAAC,CAAA;IAED,IAAM,aAAa,GAAG,UAAC,KAAK;QACxB,YAAY,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACjF,CAAC,CAAA;IAED,IAAM,aAAa,GAAE;;;YAEX,MAAM,GAAI,EAAC,KAAK,EAAE,YAAY,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,EAAC,CAAC;YACxF,YAAY,CAAC,qBAAc,iBAAiB,cAAI,WAAW,CAAE,CAAC,GAAG,EAAE,CAAC;YACpE,sBAAO,MAAM,EAAC;;SACjB,CAAA;IAED,IAAM,SAAS,GAAG;QACd,IAAG,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,EAAC;YACpD,OAAO,IAAI,CAAC;SACf;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAQ,iBAAiB,cAAI,WAAW,CAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAA;IAED,OAAO;QACH,cAAc,gBAAA;QACd,cAAc,gBAAA;QACd,UAAU,YAAA;QACV,SAAS,WAAA;QACT,SAAS,WAAA;QACT,SAAS,WAAA;QACT,eAAe,iBAAA;QACf,eAAe,iBAAA;QACf,aAAa,eAAA;QACb,aAAa,eAAA;KAChB,CAAC;AACN,CAAC,CAAA;AAnEY,QAAA,WAAW,eAmEvB"}

package/dist/vanilla/initWorker.d.ts

@@ -11,6 +11,10 @@ export declare const initWorkerAsync: (serviceWorkerRelativeUrl: any, configurat
     isServiceWorkerProxyActiveAsync: () => Promise<boolean>;
     setSessionStateAsync: (sessionState: any) => Promise<unknown>;
     getSessionStateAsync: () => Promise<any>;
+    setNonceAsync: (nonce: any) => Promise<unknown>;
+    getNonceAsync: () => Promise<{
+        nonce: string;
+    }>;
     unregisterAsync: () => Promise<boolean>;
 }>;
 //# sourceMappingURL=initWorker.d.ts.map

package/dist/vanilla/initWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initWorker.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/initWorker.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,UAAU,yCAEtB,CAAA;AA+BD,eAAO,MAAM,eAAe;;;;;;;;;;;;;EAoF3B,CAAA"}
+{"version":3,"file":"initWorker.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/initWorker.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,UAAU,yCAEtB,CAAA;AA+BD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;EAgG3B,CAAA"}

package/dist/vanilla/initWorker.js

@@ -104,7 +104,7 @@ var sendMessageAsync = function (registration) { return function (data) {
     });
 }; };
 var initWorkerAsync = function (serviceWorkerRelativeUrl, configurationName) { return __awaiter(void 0, void 0, void 0, function () {
-    var _a, name, version, registration, err_1, saveItemsAsync, loadItemsAsync, unregisterAsync, clearAsync, initAsync, startKeepAliveServiceWorker, setSessionStateAsync, getSessionStateAsync;
+    var _a, name, version, registration, err_1, saveItemsAsync, loadItemsAsync, unregisterAsync, clearAsync, initAsync, startKeepAliveServiceWorker, setSessionStateAsync, getSessionStateAsync, setNonceAsync, NONCE_TOKEN, getNonceAsync;
     return __generator(this, function (_b) {
         switch (_b.label) {
             case 0:
@@ -169,7 +169,7 @@ var initWorkerAsync = function (serviceWorkerRelativeUrl, configurationName) { r
                             case 1:
                                 result = _a.sent();
                                 // @ts-ignore
-                                return [2 /*return*/, { tokens: (0, parseTokens_1.parseOriginalTokens)(result.tokens), status: result.status }];
+                                return [2 /*return*/, { tokens: (0, parseTokens_1.parseOriginalTokens)(result.tokens, null), status: result.status }];
                         }
                     });
                 }); };
@@ -194,6 +194,17 @@ var initWorkerAsync = function (serviceWorkerRelativeUrl, configurationName) { r
                         }
                     });
                 }); };
+                setNonceAsync = function (nonce) {
+                    return sendMessageAsync(registration)({ type: "setNonce", data: { nonce: nonce }, configurationName: configurationName });
+                };
+                NONCE_TOKEN = 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER';
+                getNonceAsync = function () { return __awaiter(void 0, void 0, void 0, function () {
+                    var keyNonce;
+                    return __generator(this, function (_a) {
+                        keyNonce = NONCE_TOKEN + '_' + configurationName;
+                        return [2 /*return*/, { nonce: keyNonce }];
+                    });
+                }); };
                 return [2 /*return*/, {
                         saveItemsAsync: saveItemsAsync,
                         loadItemsAsync: loadItemsAsync,
@@ -204,6 +215,8 @@ var initWorkerAsync = function (serviceWorkerRelativeUrl, configurationName) { r
                         isServiceWorkerProxyActiveAsync: isServiceWorkerProxyActiveAsync,
                         setSessionStateAsync: setSessionStateAsync,
                         getSessionStateAsync: getSessionStateAsync,
+                        setNonceAsync: setNonceAsync,
+                        getNonceAsync: getNonceAsync,
                         unregisterAsync: unregisterAsync,
                     }];
         }

package/dist/vanilla/initWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"initWorker.js","sourceRoot":"","sources":["../../src/oidc/vanilla/initWorker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA2B;AAC3B,6CAAkD;AAElD,SAAS,WAAW;IAChB,IAAI,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,EAC7B,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,IAAI,EAAE,CAAC;IACvF,IAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAC;QACrB,GAAG,GAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAE,EAAE,CAAC,EAAC,CAAC;KAC3C;IACD,IAAG,CAAC,CAAC,CAAC,CAAC,KAAG,QAAQ,EAAC;QACf,GAAG,GAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAElC,IAAG,GAAG,IAAE,IAAI,EAAE;YACV,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IAAG,CAAC,OAAO,EAAC;gBACR,IAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAC,GAAG,CAAC,CAAC;gBACpC,IAAG,MAAM,CAAC,MAAM,GAAC,CAAC,EAAC;oBACf,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvB;aACJ;YAED,OAAO,EAAC,IAAI,EAAC,OAAO,EAAE,OAAO,SAAA,EAAC,CAAC;SAClC;KACJ;IACD,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtE,IAAG,CAAC,GAAG,GAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAE,IAAI,EAAE;QAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KAAC;IACnE,OAAO;QACH,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;KAChB,CAAC;AACN,CAAC;AAED,IAAI,+BAA+B,GAAG,IAAI,CAAC;AAEpC,IAAM,UAAU,GAAG,UAAC,YAAY;IACnC,OAAO,IAAI,OAAO,CAAC,UAAA,OAAO,IAAI,OAAA,eAAK,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,EAAvC,CAAuC,CAAC,CAAA;AAC1E,CAAC,CAAA;AAFY,QAAA,UAAU,cAEtB;AAED,IAAM,SAAS,GAAG;IACd,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1C,IAAA,kBAAU,EAAC,GAAG,GAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAA;AAED,IAAM,+BAA+B,GAAG;IACpC,OAAO,KAAK,CAAC,kCAAkC,EAAE;QAC7C,OAAO,EAAE;YACL,cAAc,EAAE,MAAM;SACzB;KAAC,CAAC;SACF,IAAI,CAAC,UAAC,QAAQ;QACX,OAAO,QAAQ,CAAC,UAAU,KAAK,qBAAqB,CAAC;IACzD,CAAC,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,IAAM,gBAAgB,GAAG,UAAC,YAAY,IAAK,OAAA,UAAC,IAAI;IAC5C,OAAO,IAAI,OAAO,CAAC,UAAS,OAAO,EAAE,MAAM;QACvC,IAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAC5C,cAAc,CAAC,KAAK,CAAC,SAAS,GAAG,UAAU,KAAK;YAC5C,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC5B;iBAAM;gBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvB;QACL,CAAC,CAAC;QACF,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC,EAZ0C,CAY1C,CAAA;AAEM,IAAM,eAAe,GAAG,UAAM,wBAAwB,EAAE,iBAAiB;;;;;gBAE5E,IAAG,CAAC,SAAS,CAAC,aAAa,IAAE,CAAC,wBAAwB,EAAC;oBACnD,sBAAO,IAAI,EAAC;iBACf;gBACK,KAAkB,WAAW,EAAE,EAA9B,IAAI,UAAA,EAAE,OAAO,aAAA,CAAkB;gBACtC,IAAG,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAC,EAAE,EAAC;oBACxC,sBAAO,IAAI,EAAC;iBACf;gBACD,IAAG,IAAI,IAAI,OAAO,EAAC;oBACf,IAAG,CAAC,OAAO,EAAE;wBACT,sBAAO,IAAI,EAAC;qBACf;oBACD,IAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAE,EAAE,EAAE;wBACpC,sBAAO,IAAI,EAAC;qBACf;iBACJ;gBACD,IAAG,IAAI,IAAI,IAAI,EAAC;oBACZ,sBAAO,IAAI,EAAC;iBACf;gBAEoB,qBAAM,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAA;;gBAA/E,YAAY,GAAG,SAAgE;;;;gBAGjF,qBAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAA;;gBAAnC,SAAmC,CAAA;;;;gBAGnC,sBAAO,IAAI,EAAC;;gBAGV,cAAc,GAAE,UAAC,KAAK;oBACpB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBACnG,CAAC,CAAA;gBAEK,cAAc,GAAC;oBACjB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9F,CAAC,CAAA;gBAEK,eAAe,GAAG;;;oCACb,qBAAM,YAAY,CAAC,UAAU,EAAE,EAAA;oCAAtC,sBAAO,SAA+B,EAAC;;;qBAC1C,CAAA;gBAEK,UAAU,GAAC,UAAC,MAAM;oBACpB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAC,MAAM,QAAA,EAAC,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9F,CAAC,CAAA;gBACK,SAAS,GAAE,UAAO,uBAAuB,EAAE,KAAK;;;;oCACnC,qBAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;oCAChD,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,EAAC,uBAAuB,yBAAA,EAAE,KAAK,OAAA,EAAC;oCACtC,iBAAiB,mBAAA;iCACpB,CAAC,EAAA;;gCAJI,MAAM,GAAG,SAIb;gCACF,aAAa;gCACb,sBAAO,EAAE,MAAM,EAAG,IAAA,iCAAmB,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAC,EAAC;;;qBAChF,CAAA;gBAEK,2BAA2B,GAAG;oBAChC,IAAI,+BAA+B,IAAI,IAAI,EAAE;wBACzC,+BAA+B,GAAG,UAAU,CAAC;wBAC7C,SAAS,EAAE,CAAC;qBACf;gBACL,CAAC,CAAA;gBAEK,oBAAoB,GAAG,UAAC,YAAY;oBACtC,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAC,YAAY,cAAA,EAAC,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9G,CAAC,CAAA;gBAEK,oBAAoB,GAAE;;;;oCACT,qBAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,mBAAA,EAAC,CAAC,EAAA;;gCAAvG,MAAM,GAAG,SAA8F;gCAC7G,aAAa;gCACb,sBAAO,MAAM,CAAC,YAAY,EAAC;;;qBAC9B,CAAA;gBAED,sBAAO;wBACH,cAAc,gBAAA;wBACd,cAAc,gBAAA;wBACd,UAAU,YAAA;wBACV,SAAS,WAAA;wBACV,8BAA8B;wBAC7B,2BAA2B,6BAAA;wBAC3B,+BAA+B,iCAAA;wBAC/B,oBAAoB,sBAAA;wBACpB,oBAAoB,sBAAA;wBACpB,eAAe,iBAAA;qBAClB,EAAC;;;KACL,CAAA;AApFY,QAAA,eAAe,mBAoF3B"}
+{"version":3,"file":"initWorker.js","sourceRoot":"","sources":["../../src/oidc/vanilla/initWorker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA2B;AAC3B,6CAAkD;AAElD,SAAS,WAAW;IAChB,IAAI,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,EAC7B,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,IAAI,EAAE,CAAC;IACvF,IAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAC;QACrB,GAAG,GAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAE,EAAE,CAAC,EAAC,CAAC;KAC3C;IACD,IAAG,CAAC,CAAC,CAAC,CAAC,KAAG,QAAQ,EAAC;QACf,GAAG,GAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAElC,IAAG,GAAG,IAAE,IAAI,EAAE;YACV,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IAAG,CAAC,OAAO,EAAC;gBACR,IAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAC,GAAG,CAAC,CAAC;gBACpC,IAAG,MAAM,CAAC,MAAM,GAAC,CAAC,EAAC;oBACf,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvB;aACJ;YAED,OAAO,EAAC,IAAI,EAAC,OAAO,EAAE,OAAO,SAAA,EAAC,CAAC;SAClC;KACJ;IACD,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtE,IAAG,CAAC,GAAG,GAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAE,IAAI,EAAE;QAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KAAC;IACnE,OAAO;QACH,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;KAChB,CAAC;AACN,CAAC;AAED,IAAI,+BAA+B,GAAG,IAAI,CAAC;AAEpC,IAAM,UAAU,GAAG,UAAC,YAAY;IACnC,OAAO,IAAI,OAAO,CAAC,UAAA,OAAO,IAAI,OAAA,eAAK,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,EAAvC,CAAuC,CAAC,CAAA;AAC1E,CAAC,CAAA;AAFY,QAAA,UAAU,cAEtB;AAED,IAAM,SAAS,GAAG;IACd,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1C,IAAA,kBAAU,EAAC,GAAG,GAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAA;AAED,IAAM,+BAA+B,GAAG;IACpC,OAAO,KAAK,CAAC,kCAAkC,EAAE;QAC7C,OAAO,EAAE;YACL,cAAc,EAAE,MAAM;SACzB;KAAC,CAAC;SACF,IAAI,CAAC,UAAC,QAAQ;QACX,OAAO,QAAQ,CAAC,UAAU,KAAK,qBAAqB,CAAC;IACzD,CAAC,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,IAAM,gBAAgB,GAAG,UAAC,YAAY,IAAK,OAAA,UAAC,IAAI;IAC5C,OAAO,IAAI,OAAO,CAAC,UAAS,OAAO,EAAE,MAAM;QACvC,IAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAC5C,cAAc,CAAC,KAAK,CAAC,SAAS,GAAG,UAAU,KAAK;YAC5C,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC5B;iBAAM;gBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvB;QACL,CAAC,CAAC;QACF,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC,EAZ0C,CAY1C,CAAA;AAEM,IAAM,eAAe,GAAG,UAAM,wBAAwB,EAAE,iBAAiB;;;;;gBAE5E,IAAG,CAAC,SAAS,CAAC,aAAa,IAAE,CAAC,wBAAwB,EAAC;oBACnD,sBAAO,IAAI,EAAC;iBACf;gBACK,KAAkB,WAAW,EAAE,EAA9B,IAAI,UAAA,EAAE,OAAO,aAAA,CAAkB;gBACtC,IAAG,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAC,EAAE,EAAC;oBACxC,sBAAO,IAAI,EAAC;iBACf;gBACD,IAAG,IAAI,IAAI,OAAO,EAAC;oBACf,IAAG,CAAC,OAAO,EAAE;wBACT,sBAAO,IAAI,EAAC;qBACf;oBACD,IAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAE,EAAE,EAAE;wBACpC,sBAAO,IAAI,EAAC;qBACf;iBACJ;gBACD,IAAG,IAAI,IAAI,IAAI,EAAC;oBACZ,sBAAO,IAAI,EAAC;iBACf;gBAEoB,qBAAM,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAA;;gBAA/E,YAAY,GAAG,SAAgE;;;;gBAGjF,qBAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAA;;gBAAnC,SAAmC,CAAA;;;;gBAGnC,sBAAO,IAAI,EAAC;;gBAGV,cAAc,GAAE,UAAC,KAAK;oBACpB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBACnG,CAAC,CAAA;gBAEK,cAAc,GAAC;oBACjB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9F,CAAC,CAAA;gBAEK,eAAe,GAAG;;;oCACb,qBAAM,YAAY,CAAC,UAAU,EAAE,EAAA;oCAAtC,sBAAO,SAA+B,EAAC;;;qBAC1C,CAAA;gBAEK,UAAU,GAAC,UAAC,MAAM;oBACpB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAC,MAAM,QAAA,EAAC,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9F,CAAC,CAAA;gBACK,SAAS,GAAE,UAAO,uBAAuB,EAAE,KAAK;;;;oCACnC,qBAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;oCAChD,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,EAAC,uBAAuB,yBAAA,EAAE,KAAK,OAAA,EAAC;oCACtC,iBAAiB,mBAAA;iCACpB,CAAC,EAAA;;gCAJI,MAAM,GAAG,SAIb;gCACF,aAAa;gCACb,sBAAO,EAAE,MAAM,EAAG,IAAA,iCAAmB,EAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAC,EAAC;;;qBACtF,CAAA;gBAEK,2BAA2B,GAAG;oBAChC,IAAI,+BAA+B,IAAI,IAAI,EAAE;wBACzC,+BAA+B,GAAG,UAAU,CAAC;wBAC7C,SAAS,EAAE,CAAC;qBACf;gBACL,CAAC,CAAA;gBAEK,oBAAoB,GAAG,UAAC,YAAY;oBACtC,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAC,YAAY,cAAA,EAAC,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAC9G,CAAC,CAAA;gBAEK,oBAAoB,GAAE;;;;oCACT,qBAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,mBAAA,EAAC,CAAC,EAAA;;gCAAvG,MAAM,GAAG,SAA8F;gCAC7G,aAAa;gCACb,sBAAO,MAAM,CAAC,YAAY,EAAC;;;qBAC9B,CAAA;gBAEK,aAAa,GAAG,UAAC,KAAK;oBACxB,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAC,KAAK,OAAA,EAAC,EAAE,iBAAiB,mBAAA,EAAC,CAAC,CAAC;gBAChG,CAAC,CAAA;gBACK,WAAW,GAAG,sCAAsC,CAAC;gBACrD,aAAa,GAAE;;;wBAEX,QAAQ,GAAG,WAAW,GAAG,GAAG,GAAE,iBAAiB,CAAC;wBACtD,sBAAO,EAAC,KAAK,EAAC,QAAQ,EAAC,EAAC;;qBAC3B,CAAA;gBAED,sBAAO;wBACH,cAAc,gBAAA;wBACd,cAAc,gBAAA;wBACd,UAAU,YAAA;wBACV,SAAS,WAAA;wBACV,8BAA8B;wBAC7B,2BAA2B,6BAAA;wBAC3B,+BAA+B,iCAAA;wBAC/B,oBAAoB,sBAAA;wBACpB,oBAAoB,sBAAA;wBACpB,aAAa,eAAA;wBACb,aAAa,eAAA;wBACb,eAAe,iBAAA;qBAClB,EAAC;;;KACL,CAAA;AAhGY,QAAA,eAAe,mBAgG3B"}

package/dist/vanilla/oidc.d.ts

@@ -2,9 +2,11 @@ import { AuthorizationServiceConfiguration } from '@openid/appauth';
 import { AuthorizationServiceConfigurationJson } from "@openid/appauth/src/authorization_service_configuration";
 export interface OidcAuthorizationServiceConfigurationJson extends AuthorizationServiceConfigurationJson {
     check_session_iframe?: string;
+    issuer: string;
 }
 export declare class OidcAuthorizationServiceConfiguration extends AuthorizationServiceConfiguration {
     private check_session_iframe;
+    private issuer;
     constructor(request: any);
 }
 export interface StringMap {
@@ -21,6 +23,7 @@ export interface AuthorityConfiguration {
     end_session_endpoint?: string;
     userinfo_endpoint?: string;
     check_session_iframe?: string;
+    issuer: string;
 }
 export declare type OidcConfiguration = {
     client_id: string;

package/dist/vanilla/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,iCAAiC,EAQpC,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAAC,qCAAqC,EAAC,MAAM,yDAAyD,CAAC;AA4D9G,MAAM,WAAW,yCAA0C,SAAQ,qCAAqC;IACpG,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,qBAAa,qCAAsC,SAAQ,iCAAiC;IACxF,OAAO,CAAC,oBAAoB,CAAS;gBAEzB,OAAO,EAAE,GAAG;CAS3B;AAGD,MAAM,WAAW,SAAS;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAC,MAAM,CAAC;CAChC;AAEA,oBAAY,iBAAiB,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAC,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAC,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C,CAAC,EAAE,MAAM,CAAC;IACpD,uBAAuB,CAAC,EAAE,sBAAsB,CAAC;IACjD,+CAA+C,CAAC,EAAE,MAAM,CAAC;IACzD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2BAA2B,CAAC,EAAC,MAAM,CAAC;IACpC,mBAAmB,CAAC,EAAC,OAAO,CAAC;IAC7B,MAAM,CAAC,EAAC,SAAS,CAAA;IACjB,oBAAoB,CAAC,EAAC,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAC;AAsLF,qBAAa,IAAI;IACN,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,OAAO,CAAC,CAAM;IACtB,OAAO,CAAC,kBAAkB,CAAqB;gBACnC,aAAa,EAAC,iBAAiB,EAAE,iBAAiB,SAAU;IAkCxE,eAAe,CAAC,IAAI,KAAA;IAMpB,uBAAuB,CAAC,EAAE,KAAA;IAK1B,YAAY,CAAC,SAAS,KAAA,EAAE,IAAI,KAAA;IAK5B,MAAM,CAAC,WAAW,CAAC,aAAa,KAAA,EAAE,IAAI,SAAU;IAGhD,MAAM,CAAC,GAAG,CAAC,IAAI,SAAU;IAQzB,MAAM,CAAC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAc;IAE/B,8BAA8B;IAM9B,mCAAmC;IAO7B,wBAAwB;IAUxB,gBAAgB,CAAC,MAAM,GAAC,SAAc,EAAE,KAAK,GAAC,MAAW,EAAE,KAAK,GAAC,MAAW;IA8FlF,WAAW,MAAQ;IACb,SAAS,CAAC,SAAS,EAAC,MAAM,EAAE,sBAAsB,EAAC,sBAAsB;IA2B/E,6BAA6B,MAAQ;IAC/B,2BAA2B;IAoFjC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAM;IAC1B,UAAU,CAAC,YAAY,GAAC,MAAgB,EAAE,MAAM,GAAC,SAAc,EAAE,KAAK,GAAC,MAAgB,EAAE,cAAc,GAAC,OAAa,EAAE,KAAK,GAAC,MAAgB;IA0D7I,sBAAsB,CAAC,qBAAqB,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,KAAA,EAAE,cAAc,UAAM;IAyDhG,oBAAoB,EAAG,OAAO,CAAC,GAAG,CAAC,CAAK;IAClC,kBAAkB,CAAC,aAAa,GAAC,OAAa;IA0B9C,mBAAmB,CAAC,cAAc,GAAC,OAAa;IA4HhD,sBAAsB,CAAC,YAAY,KAAA,EAAE,KAAK,SAAE,EAAE,YAAY,UAAO;IA4GjE,mBAAmB,CAAC,aAAa,KAAA,EAAE,iBAAiB,KAAA,EAAE,aAAa,KAAA,EAAE,YAAY,UAAO;;;;IA6C9F,uCAAuC,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAQ;IAC3E,qCAAqC,IAAG,OAAO,CAAC,mBAAmB,CAAC;IAWrE,eAAe,EAAC,OAAO,CAAC,GAAG,CAAC,CAAQ;IACnC,aAAa;IAWP,gBAAgB;IAShB,YAAY,CAAC,MAAM,KAAA;IAiBnB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,GAAG,KAAA;IAQjC,mBAAmB,CAAC,QAAQ,KAAA,EAAE,GAAG,KAAA;IAQjC,WAAW,CAAC,iBAAiB,GAAE,MAAM,GAAG,IAAI,GAAG,SAAqB,EAAE,MAAM,GAAE,SAAgB;CAqDrG;AAGD,eAAe,IAAI,CAAC"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,iCAAiC,EAQpC,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAAC,qCAAqC,EAAC,MAAM,yDAAyD,CAAC;AA4D9G,MAAM,WAAW,yCAA0C,SAAQ,qCAAqC;IACpG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAC,MAAM,CAAC;CACjB;AAED,qBAAa,qCAAsC,SAAQ,iCAAiC;IACxF,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,EAAE,GAAG;CAU3B;AAGD,MAAM,WAAW,SAAS;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAC,MAAM,CAAC;IAC7B,MAAM,EAAC,MAAM,CAAC;CACjB;AAEA,oBAAY,iBAAiB,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAC,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAC,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C,CAAC,EAAE,MAAM,CAAC;IACpD,uBAAuB,CAAC,EAAE,sBAAsB,CAAC;IACjD,+CAA+C,CAAC,EAAE,MAAM,CAAC;IACzD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2BAA2B,CAAC,EAAC,MAAM,CAAC;IACpC,mBAAmB,CAAC,EAAC,OAAO,CAAC;IAC7B,MAAM,CAAC,EAAC,SAAS,CAAA;IACjB,oBAAoB,CAAC,EAAC,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAC;AAsLF,qBAAa,IAAI;IACN,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,SAAS,CAAiB;IAClC,OAAO,CAAC,aAAa,CAAC,CAAM;IAC5B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,OAAO,CAAC,CAAM;IACtB,OAAO,CAAC,kBAAkB,CAAqB;gBACnC,aAAa,EAAC,iBAAiB,EAAE,iBAAiB,SAAU;IAkCxE,eAAe,CAAC,IAAI,KAAA;IAMpB,uBAAuB,CAAC,EAAE,KAAA;IAK1B,YAAY,CAAC,SAAS,KAAA,EAAE,IAAI,KAAA;IAK5B,MAAM,CAAC,WAAW,CAAC,aAAa,KAAA,EAAE,IAAI,SAAU;IAGhD,MAAM,CAAC,GAAG,CAAC,IAAI,SAAU;IAQzB,MAAM,CAAC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAc;IAE/B,8BAA8B;IAM9B,mCAAmC;IAO7B,wBAAwB;IAUxB,gBAAgB,CAAC,MAAM,GAAC,SAAc,EAAE,KAAK,GAAC,MAAW,EAAE,KAAK,GAAC,MAAW;IA8FlF,WAAW,MAAQ;IACb,SAAS,CAAC,SAAS,EAAC,MAAM,EAAE,sBAAsB,EAAC,sBAAsB;IA4B/E,6BAA6B,MAAQ;IAC/B,2BAA2B;IAoFjC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAM;IAC1B,UAAU,CAAC,YAAY,GAAC,MAAgB,EAAE,MAAM,GAAC,SAAc,EAAE,KAAK,GAAC,MAAgB,EAAE,cAAc,GAAC,OAAa,EAAE,KAAK,GAAC,MAAgB;IAyE7I,sBAAsB,CAAC,qBAAqB,KAAA,EAAE,QAAQ,KAAA,EAAE,YAAY,KAAA,EAAE,cAAc,UAAM;IAyDhG,oBAAoB,EAAG,OAAO,CAAC,GAAG,CAAC,CAAK;IAClC,kBAAkB,CAAC,aAAa,GAAC,OAAa;IA0B9C,mBAAmB,CAAC,cAAc,GAAC,OAAa;IAyIhD,sBAAsB,CAAC,YAAY,KAAA,EAAE,KAAK,SAAE,EAAE,YAAY,UAAO;IAgHjE,mBAAmB,CAAC,aAAa,KAAA,EAAE,iBAAiB,KAAA,EAAE,aAAa,KAAA,EAAE,YAAY,UAAO;;;;IA6C9F,uCAAuC,EAAC,OAAO,CAAC,mBAAmB,CAAC,CAAQ;IAC3E,qCAAqC,IAAG,OAAO,CAAC,mBAAmB,CAAC;IAWrE,eAAe,EAAC,OAAO,CAAC,GAAG,CAAC,CAAQ;IACnC,aAAa;IAWP,gBAAgB;IAShB,YAAY,CAAC,MAAM,KAAA;IAiBnB,kBAAkB,CAAC,QAAQ,KAAA,EAAE,GAAG,KAAA;IAQjC,mBAAmB,CAAC,QAAQ,KAAA,EAAE,GAAG,KAAA;IAQjC,WAAW,CAAC,iBAAiB,GAAE,MAAM,GAAG,IAAI,GAAG,SAAqB,EAAE,MAAM,GAAE,SAAgB;CAqDrG;AAGD,eAAe,IAAI,CAAC"}

package/dist/vanilla/oidc.js

@@ -75,7 +75,7 @@ var timer_1 = __importDefault(require("./timer"));
 var checkSessionIFrame_1 = require("./checkSessionIFrame");
 var route_utils_1 = require("./route-utils");
 var parseTokens_1 = require("./parseTokens");
-var performTokenRequestAsync = function (url, details, extras) { return __awaiter(void 0, void 0, void 0, function () {
+var performTokenRequestAsync = function (url, details, extras, oldTokens) { return __awaiter(void 0, void 0, void 0, function () {
     var _i, _a, _b, key, value, formBody, property, encodedKey, encodedValue, formBodyString, response, tokens;
     return __generator(this, function (_c) {
         switch (_c.label) {
@@ -111,7 +111,7 @@ var performTokenRequestAsync = function (url, details, extras) { return __awaite
                 tokens = _c.sent();
                 return [2 /*return*/, {
                         success: true,
-                        data: (0, parseTokens_1.parseOriginalTokens)(tokens)
+                        data: (0, parseTokens_1.parseOriginalTokens)(tokens, oldTokens)
                     }];
         }
     });
@@ -157,6 +157,7 @@ var OidcAuthorizationServiceConfiguration = /** @class */ (function (_super) {
         _this.revocationEndpoint = request.revocation_endpoint;
         _this.userInfoEndpoint = request.userinfo_endpoint;
         _this.check_session_iframe = request.check_session_iframe;
+        _this.issuer = request.issuer;
         return _this;
     }
     return OidcAuthorizationServiceConfiguration;
@@ -608,6 +609,7 @@ var Oidc = /** @class */ (function () {
                                             token_endpoint: authorityConfiguration.token_endpoint,
                                             userinfo_endpoint: authorityConfiguration.userinfo_endpoint,
                                             check_session_iframe: authorityConfiguration.check_session_iframe,
+                                            issuer: authorityConfiguration.issuer,
                                         })];
                                 }
                                 return [4 /*yield*/, (0, initWorker_1.initWorkerAsync)(this.configuration.service_worker_relative_url, this.configurationName)];
@@ -697,7 +699,7 @@ var Oidc = /** @class */ (function () {
                                 tokens = (_b.sent()).tokens;
                                 if (!tokens) return [3 /*break*/, 11];
                                 // @ts-ignore
-                                this.tokens = (0, parseTokens_1.setTokens)(tokens);
+                                this.tokens = (0, parseTokens_1.setTokens)(tokens, null);
                                 //session.setTokens(this.tokens);
                                 this.session = session;
                                 // @ts-ignore
@@ -756,12 +758,12 @@ var Oidc = /** @class */ (function () {
                     return [2 /*return*/, this.loginPromise];
                 }
                 loginLocalAsync = function () { return __awaiter(_this, void 0, void 0, function () {
-                    var location_1, url, configuration, redirectUri, serviceWorker, oidcServerConfiguration, storage, session, extraFinal, queryStringUtil, authorizationHandler, authRequest, exception_2;
+                    var location_1, url, configuration, redirectUri, randomString, extraFinal, nonce, serviceWorker, oidcServerConfiguration, storage, session, queryStringUtil, authorizationHandler, authRequest, exception_2;
                     var _a;
                     return __generator(this, function (_b) {
                         switch (_b.label) {
                             case 0:
-                                _b.trys.push([0, 7, , 8]);
+                                _b.trys.push([0, 9, , 10]);
                                 location_1 = window.location;
                                 url = callbackPath || location_1.pathname + (location_1.search || '') + (location_1.hash || '');
                                 this.publishEvent(eventNames.loginAsync_begin, {});
@@ -770,7 +772,20 @@ var Oidc = /** @class */ (function () {
                                 if (!scope) {
                                     scope = configuration.scope;
                                 }
+                                randomString = function (length) {
+                                    var text = "";
+                                    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+                                    for (var i = 0; i < length; i++) {
+                                        text += possible.charAt(Math.floor(Math.random() * possible.length));
+                                    }
+                                    return text;
+                                };
                                 setLoginParams(this.configurationName, redirectUri, { callbackPath: url, extras: extras, state: state });
+                                extraFinal = (_a = extras !== null && extras !== void 0 ? extras : configuration.extras) !== null && _a !== void 0 ? _a : {};
+                                if (!extraFinal.nonce) {
+                                    extraFinal["nonce"] = randomString(12);
+                                }
+                                nonce = { "nonce": extraFinal.nonce };
                                 return [4 /*yield*/, (0, initWorker_1.initWorkerAsync)(configuration.service_worker_relative_url, this.configurationName)];
                             case 1:
                                 serviceWorker = _b.sent();
@@ -778,22 +793,27 @@ var Oidc = /** @class */ (function () {
                             case 2:
                                 oidcServerConfiguration = _b.sent();
                                 storage = void 0;
-                                if (!serviceWorker) return [3 /*break*/, 5];
+                                if (!serviceWorker) return [3 /*break*/, 6];
                                 serviceWorker.startKeepAliveServiceWorker();
                                 return [4 /*yield*/, serviceWorker.initAsync(oidcServerConfiguration, "loginAsync")];
                             case 3:
                                 _b.sent();
-                                storage = new memoryStorageBackend_1.MemoryStorageBackend(serviceWorker.saveItemsAsync, {});
-                                return [4 /*yield*/, storage.setItem("dummy", {})];
+                                return [4 /*yield*/, serviceWorker.setNonceAsync(nonce)];
                             case 4:
                                 _b.sent();
-                                return [3 /*break*/, 6];
+                                storage = new memoryStorageBackend_1.MemoryStorageBackend(serviceWorker.saveItemsAsync, {});
+                                return [4 /*yield*/, storage.setItem("dummy", {})];
                             case 5:
+                                _b.sent();
+                                return [3 /*break*/, 8];
+                            case 6:
                                 session = (0, initSession_1.initSession)(this.configurationName, redirectUri);
+                                return [4 /*yield*/, session.setNonceAsync(nonce)];
+                            case 7:
+                                _b.sent();
                                 storage = new memoryStorageBackend_1.MemoryStorageBackend(session.saveItemsAsync, {});
-                                _b.label = 6;
-                            case 6:
-                                extraFinal = (_a = extras !== null && extras !== void 0 ? extras : configuration.extras) !== null && _a !== void 0 ? _a : {};
+                                _b.label = 8;
+                            case 8:
                                 queryStringUtil = redirectUri.includes("#") ? new noHashQueryStringUtils_1.HashQueryStringUtils() : new noHashQueryStringUtils_1.NoHashQueryStringUtils();
                                 authorizationHandler = new appauth_1.RedirectRequestHandler(storage, queryStringUtil, window.location, new appauth_1.DefaultCrypto());
                                 authRequest = new appauth_1.AuthorizationRequest({
@@ -805,12 +825,12 @@ var Oidc = /** @class */ (function () {
                                     extras: extraFinal
                                 });
                                 authorizationHandler.performAuthorizationRequest(oidcServerConfiguration, authRequest);
-                                return [3 /*break*/, 8];
-                            case 7:
+                                return [3 /*break*/, 10];
+                            case 9:
                                 exception_2 = _b.sent();
                                 this.publishEvent(eventNames.loginAsync_error, exception_2);
                                 throw exception_2;
-                            case 8: return [2 /*return*/];
+                            case 10: return [2 /*return*/];
                         }
                     });
                 }); };
@@ -941,12 +961,12 @@ var Oidc = /** @class */ (function () {
         var _a;
         if (isSilentSignin === void 0) { isSilentSignin = false; }
         return __awaiter(this, void 0, void 0, function () {
-            var configuration_2, clientId_1, redirectUri_1, authority, tokenRequestTimeout_1, oidcServerConfiguration_1, queryParams, sessionState_2, serviceWorker_1, storage_1, items, dummy, session, items, exception_3;
+            var configuration_2, clientId_1, redirectUri_1, authority, tokenRequestTimeout_1, oidcServerConfiguration_1, queryParams, sessionState_2, serviceWorker_1, storage_1, nonceData_1, items, dummy, session, items, exception_3;
             var _this = this;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
-                        _b.trys.push([0, 11, , 12]);
+                        _b.trys.push([0, 13, , 14]);
                         this.publishEvent(eventNames.loginCallbackAsync_begin, {});
                         configuration_2 = this.configuration;
                         clientId_1 = configuration_2.client_id;
@@ -962,7 +982,8 @@ var Oidc = /** @class */ (function () {
                     case 2:
                         serviceWorker_1 = _b.sent();
                         storage_1 = null;
-                        if (!serviceWorker_1) return [3 /*break*/, 8];
+                        nonceData_1 = null;
+                        if (!serviceWorker_1) return [3 /*break*/, 9];
                         serviceWorker_1.startKeepAliveServiceWorker();
                         this.serviceWorker = serviceWorker_1;
                         return [4 /*yield*/, serviceWorker_1.initAsync(oidcServerConfiguration_1, "loginCallbackAsync")];
@@ -984,17 +1005,23 @@ var Oidc = /** @class */ (function () {
                         return [4 /*yield*/, serviceWorker_1.setSessionStateAsync(sessionState_2)];
                     case 7:
                         _b.sent();
-                        return [3 /*break*/, 10];
+                        return [4 /*yield*/, serviceWorker_1.getNonceAsync()];
                     case 8:
+                        nonceData_1 = _b.sent();
+                        return [3 /*break*/, 12];
+                    case 9:
                         this.session = (0, initSession_1.initSession)(this.configurationName, redirectUri_1, (_a = configuration_2.storage) !== null && _a !== void 0 ? _a : sessionStorage);
                         session = (0, initSession_1.initSession)(this.configurationName, redirectUri_1);
                         session.setSessionState(sessionState_2);
                         return [4 /*yield*/, session.loadItemsAsync()];
-                    case 9:
+                    case 10:
                         items = _b.sent();
                         storage_1 = new memoryStorageBackend_1.MemoryStorageBackend(session.saveItemsAsync, items);
-                        _b.label = 10;
-                    case 10: return [2 /*return*/, new Promise(function (resolve, reject) {
+                        return [4 /*yield*/, session.getNonceAsync()];
+                    case 11:
+                        nonceData_1 = _b.sent();
+                        _b.label = 12;
+                    case 12: return [2 /*return*/, new Promise(function (resolve, reject) {
                             // @ts-ignore
                             var queryStringUtil = new noHashQueryStringUtils_1.NoHashQueryStringUtils();
                             if (redirectUri_1.includes("#")) {
@@ -1042,7 +1069,7 @@ var Oidc = /** @class */ (function () {
                                 try {
                                     var tokenHandler = new appauth_1.BaseTokenRequestHandler(new appauth_1.FetchRequestor());
                                     tokenHandler.performTokenRequest(oidcServerConfiguration_1, tokenRequest).then(function (tokenResponse) { return __awaiter(_this, void 0, void 0, function () {
-                                        var loginParams_1, tokens;
+                                        var loginParams_1, tokens, exception;
                                         var _this = this;
                                         return __generator(this, function (_a) {
                                             switch (_a.label) {
@@ -1058,6 +1085,17 @@ var Oidc = /** @class */ (function () {
                                                     tokenResponse = tokens;
                                                     _a.label = 2;
                                                 case 2:
+                                                    ;
+                                                    if (!(0, parseTokens_1.isTokensOidcValid)(tokenResponse, nonceData_1.nonce, oidcServerConfiguration_1)) {
+                                                        exception = new Error("Tokens are not OpenID valid");
+                                                        if (timeoutId) {
+                                                            clearTimeout(timeoutId);
+                                                            this.timeoutId = null;
+                                                            this.publishEvent(eventNames.loginCallbackAsync_error, exception);
+                                                            console.error(exception);
+                                                            reject(exception);
+                                                        }
+                                                    }
                                                     // @ts-ignore
                                                     this.startCheckSessionAsync(oidcServerConfiguration_1.check_session_iframe, clientId_1, sessionState_2, isSilentSignin).then(function () {
                                                         _this.publishEvent(eventNames.loginCallbackAsync_end, {});
@@ -1085,12 +1123,12 @@ var Oidc = /** @class */ (function () {
                             });
                             authorizationHandler.completeAuthorizationRequestIfPossible();
                         })];
-                    case 11:
+                    case 13:
                         exception_3 = _b.sent();
                         console.error(exception_3);
                         this.publishEvent(eventNames.loginCallbackAsync_error, exception_3);
                         throw exception_3;
-                    case 12: return [2 /*return*/];
+                    case 14: return [2 /*return*/];
                 }
             });
         });
@@ -1215,10 +1253,14 @@ var Oidc = /** @class */ (function () {
                         return [4 /*yield*/, this.initAsync(authority, configuration.authority_configuration)];
                     case 19:
                         oidcServerConfiguration = _e.sent();
-                        return [4 /*yield*/, performTokenRequestAsync(oidcServerConfiguration.tokenEndpoint, details, extras)];
+                        return [4 /*yield*/, performTokenRequestAsync(oidcServerConfiguration.tokenEndpoint, details, extras, tokens)];
                     case 20:
                         tokenResponse = _e.sent();
                         if (!tokenResponse.success) return [3 /*break*/, 21];
+                        if (!(0, parseTokens_1.isTokensOidcValid)(tokenResponse.data, null, oidcServerConfiguration)) {
+                            this.publishEvent(eventNames.refreshTokensAsync_error, { message: "refresh token return not valid tokens" });
+                            return [2 /*return*/, { tokens: null, status: "SESSION_LOST" }];
+                        }
                         this.publishEvent(eventNames.refreshTokensAsync_end, { success: tokenResponse.success });
                         this.publishEvent(Oidc.eventNames.token_renewed, {});
                         return [2 /*return*/, { tokens: tokenResponse.data, status: "LOGGED_IN" }];