Per default, the oidc-client-ts lib uses the browser session storage to store tokens.
When opening parts of my application in a new tab via the window.open() command, the content of the session storage is copied to the other tab unless explicitly told to do otherwise.
This means, given the default situation, the two tabs now use the same tokens.
The new OAuth2.1 strongly recommends to use refresh tokens only once.
This causes an issue if two or more tabs rely on the same refresh token. The first tab can use the refresh token to obtain a new access token, but the second tab will run into an error "refresh token already used"...
Is there a way to circumvent this problem?
I have seen that the oidc-client-lib allows to configure different storages.
However, I tried to use the provided InMemoryWebStorage but couldn't log in, since that storage doesn't seem to survive browser redirects...
zach-betz-hln
commented
2 months ago
Per default, the oidc-client-ts lib uses the browser session storage to store tokens. When opening parts of my application in a new tab via the window.open() command, the content of the session storage is copied to the other tab unless explicitly told to do otherwise.
This means, given the default situation, the two tabs now use the same tokens.
The new OAuth2.1 strongly recommends to use refresh tokens only once. This causes an issue if two or more tabs rely on the same refresh token. The first tab can use the refresh token to obtain a new access token, but the second tab will run into an error "refresh token already used"...
Is there a way to circumvent this problem? I have seen that the oidc-client-lib allows to configure different storages. However, I tried to use the provided InMemoryWebStorage but couldn't log in, since that storage doesn't seem to survive browser redirects...