Open t-knapp opened 2 years ago
Same problem here, I have just made some tests with @t-knapp code, and it works.
@t-knapp can we have this feature flagged? so this only kicks off if the flag is true.
This PR is exactly what I feel was missing from this package. Thanks for it!
Hello folks,
I face a problem with
autoRefresh
enabled. If thetokenEndpoint
responds with non-success http status code, the response body is still stored in localStorage. The value is not a validAuthTokens
object and crashes thejwt-decode
call. Since the token values are read from localStorage, the app won't work even when reloading the whole page. Only fix is to remove the 'auth' value from localStorage.If the response from
tokenEndpoint
is http 400 e.g. if the refresh_token expired (see: OIDC API Doc for tokenEndpoint https://connect2id.com/products/server/docs/api/token#overview), the response body should not be stored. Instead, a full login cycle should be kicked off.It's a little bit tricky to reproduce - I mocked the http request on the
tokenEndpoint
to the IDP (Keycloak in my case) with a Chrome Extension https://github.com/mukuljainx/Mokku This is the body I returned in the mockThe fix proposed in this PR will start a new login cycle.
Kind regards, Tobias