RolandGuijt
commented
3 months ago oidc-client is an example of a library that can renew the token silently as long as there is an active session with the identity provider. It would be hard for any library to offer protection against the attacks you mention. The browser is just not a good place to keep any kind of secret. Since you can't use a BFF I recommend trying to mitigate the problem somewhat by giving the token a relatively short lifetime so that calls to the identity provider to renew are more frequent. That way at least there is a way to revoke access quickly when an attack is detected. But it depends on the application if that is practical/possible.
chandraarora
Hi
We are using Duende IDP and it works like a charm.
We are building a teams app and it is hosted in iframe of ms teams site which means we can not use bff and cookie unless we change samesite to none.
We would have to go with SPA with access token authentication. Do we have any library which can manage the token at client side and refresh the token automatically and protect again XSS and csrf attack?
Thanks Chandra