[Question]: Using authorizeWithPopUp results in the window appearing and closing immediately

What Version of the library are you using? "angular-auth-oidc-client": "15.0.2"

Question

I am using Duende.IdentityServer (latest)

I am using authorize() successfully to get a token when navigating with a redirect uri

However, when I use authorizeWithPopUp() the window appears for milliseconds and then closes immediately without any error in the console or my IdentityServer - reading around this may be more related to IdentityServer's restrictive SecurityHeadersAttribute.cs

I know they recommend the same flow as Google to redirect to a page instead of a popup for security reasons but would still like to configure the popup to work, I believe it may be related to the content security policy - I am curious if anyone else has encountered this already

 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Type-Options"))
            {
                context.HttpContext.Response.Headers.Add("X-Content-Type-Options", "nosniff");
            }

            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Frame-Options"))
            {
                context.HttpContext.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
            }

            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
            var csp = "default-src 'self'; object-src 'none'; frame-ancestors 'none'; sandbox allow-forms allow-same-origin allow-scripts; base-uri 'self';";
            // also consider adding upgrade-insecure-requests once you have HTTPS in place for production
            //csp += "upgrade-insecure-requests;";
            // also an example if you need client images to be displayed from twitter
            // csp += "img-src 'self' https://pbs.twimg.com;";

            // once for standards compliant browsers
            if (!context.HttpContext.Response.Headers.ContainsKey("Content-Security-Policy"))
            {
                context.HttpContext.Response.Headers.Add("Content-Security-Policy", csp);
            }
            // and once again for IE
            if (!context.HttpContext.Response.Headers.ContainsKey("X-Content-Security-Policy"))
            {
                context.HttpContext.Response.Headers.Add("X-Content-Security-Policy", csp);
            }

            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
            var referrer_policy = "no-referrer";
            if (!context.HttpContext.Response.Headers.ContainsKey("Referrer-Policy"))
            {
                context.HttpContext.Response.Headers.Add("Referrer-Policy", referrer_policy);
            }

            config: {
                authority: 'https://localhost:5001',
                redirectUrl: window.location.origin,
                postLoginRoute: '/dashboard',
                postLogoutRedirectUri: window.location.origin,
                clientId: 'js',
                scope: 'openid profile email offline_access api1',
                responseType: 'code',
                silentRenew: true,
                useRefreshToken: true,
                renewTimeBeforeTokenExpiresInSeconds: 30,
                logLevel: LogLevel.Debug
            }

    login() {
        this.oidcSecurityService.authorize();
    }

    loginWithPopup() {
        const configId = this.configurations[0].configId;

        this.oidcSecurityService
            .authorizeWithPopUp(undefined, undefined, configId)
            .subscribe(({ isAuthenticated, userData, accessToken, errorMessage }) => {
                console.log(isAuthenticated);
                console.log(userData);
                console.log(accessToken);
                console.log(errorMessage);
            });
    }

damienbod / angular-auth-oidc-client

[Question]: Using authorizeWithPopUp results in the window appearing and closing immediately #1620