AxaFrance / oidc-client

Light, Secure, Pure Javascript OIDC (Open ID Connect) Client. We provide also a REACT wrapper (compatible NextJS, etc.).
MIT License
571 stars 152 forks source link

multiple parallel silent signin: iframes are not removed before timeout #1309

Closed astrinxit66 closed 4 months ago

astrinxit66 commented 4 months ago

Issue and Steps to Reproduce

Let's say that you need to get 4 access tokens silently, only the last iframe gets removed when its access_token is acquired, the other 3 are removed at timeout (defined by the value of configuration.silent_login_timeout) even though their access_token are also acquired before the timeout occured.

Steps to reproduce

// assume I have conf1, conf2, conf3 and conf4 that represent the OidcConfiguration of my 4 OidcClient
// silent_login_timeout in each conf = 60000
const client1 = OidcClient.getOrCreate(() => window.fetch)(conf1, 'client1');
const client2 = OidcClient.getOrCreate(() => window.fetch)(conf2, 'client2');
const client3 = OidcClient.getOrCreate(() => window.fetch)(conf3, 'client3');
const client4 = OidcClient.getOrCreate(() => window.fetch)(conf4, 'client4');

// this will perform 4 silent signin at the same time
await Promise.all([
    client1,
    client2,
    client3,
    client4
].map((client) => client.loginAsync(undefined, undefined, false, undefined, true))
);

Versions

7.19.0

Expected

Actual

Additional Details

I find out that this line returns false for client1, client2 and client3 so the data posted by the iframes cannot be parsed and then _silentLoginAsync cannot be resoled.

For client4 (the last one in Promise.all()), that line returns true, the data posted by its iframe get parsed and _silentLoginAsync is resolved as expected.