search

AxaFrance / oidc-client

Light, Secure, Pure Javascript OIDC (Open ID Connect) Client. We provide also a REACT wrapper (compatible NextJS, etc.).
MIT License
570 stars 152 forks source link

User logged out after an hour or so of inactivity despite using Service Worker implementation #1363

Open abhilashlr7 opened 1 month ago

abhilashlr7 commented 1 month ago

Issue and Steps to Reproduce

A user active on a tab works perfectly fine, but if the same user closes the lid or locks the screen and comes back after a day or even a couple of hours, they are logged out.

Versions

7.22.4

Expected

They shouldn't be logged out, but made to fetch a new access token using the refresh token if that exists, and if this is success, dont log the user out.

Actual

There is a oidc-configuration call that happens from the client side. This API call on failure, simply removes the token and possibly sets the internals to assume that the user has logged out. The api call should have been made on System wake or as long as internet is connected not simply make those calls and reject the user from being continously logged in.

Sorry to say this, its been a bit hard for us to continue using this lib and we are unsure if we will get support on it going forward.

guillaume-chervet commented 1 month ago

Hi @abhilashlr7 thank you for your issue. I will resolve it in priority when I will be back from holiday.

Temporaly, You can try to use the new mode where refresh of the token is done only when a fetch is done.

Is is better because it reduce the number of refresh_token and it do it generaly when browser tab is active and have cpu time allowed and internet.