search

IdentityModel / oidc-client-js

OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript applications
Apache License 2.0
2.43k stars 841 forks source link

Consider removing Cordova support in 2.0 #493

Open brockallen opened 6 years ago

brockallen commented 6 years ago

This issue is to gauge the current level of Cordova use and find out how painful this will be if Cordova is removed. Feedback welcome.

markphillips100 commented 6 years ago

Well I for one use it a lot in all my Ionic apps. Happy to fork and go my own way though but then it'll end up a private repo I guess.

markphillips100 commented 6 years ago

Would maybe moving the cordova specifics into its own repo as pluggable components help? So those who want cordova include both libraries and setup via configuration as usual perhaps?

masterpoi commented 6 years ago

Using it

markphillips100 commented 6 years ago

I'd be for removing it as the implementation (InAppBrowser approach) is no longer recommended for native/hybrid apps.

kabaehr commented 6 years ago

I just landed here because I wanted to consider this repo for use it in my cordova application.

I also read that the InAppBrowser is no longer recommended but what else to use? SafariViewController/ChromeCustomTabs? I am doing this, but ChromeCustomTabs does not support hidden windows, so I can't have token refreshment... so I am stuck to inAppBrowser at least for Android

brockallen commented 6 years ago

so I can't have token refreshment

For native apps you'd use hybrid flow (and PKCE), and thus you'd be able to use refresh tokens.

kabaehr commented 6 years ago

Thanks for the answer. Our application is also running in the browser, therefore we are using the implicit flow. As far as I understand it, we can't use both flows (using Azure) without doubling our Azure B2C endpoint. Do you probably know a solution for this?

brockallen commented 6 years ago

Sorry, I can't help you with AB2C. But still, if your app is considered native (like cordova) then it should use hybrid and PKCE with the system browser (and not implicit with an embedded browser), as recommended by this: https://tools.ietf.org/html/rfc8252