manfredsteyer / angular-oauth2-oidc

Support for OAuth 2 and OpenId Connect (OIDC) in Angular.
MIT License
1.9k stars 688 forks source link

Silent Refresh does not work in Safari #1441

Open bkrajendra opened 2 months ago

bkrajendra commented 2 months ago

We are using latest library version with Angular 15 Our configuration is: PKCE with Code flow and Silent Refresh.

Everything works great in Chrome Browser. All flows work in Safari browser except silent refresh flow does not work. The silent refresh call redirects with following in Safari when timeout is reached:

Query String Parameters
error_description: The request requires some interaction that is not allowed.
state: MkJsaVpsOG1pbEVPVxxxxxxxxxxxxkdzbHJoNjVFVDIw
error: interaction_required

Following are the content of silent refresh html page:

<html>
    <body>
        <script>
            var checks = [/[\?|&|#]code=/, /[\?|&|#]error=/, /[\?|&|#]token=/, /[\?|&|#]id_token=/];

            function isResponse(str) {
                if (!str) return false;
                for(var i=0; i<checks.length; i++) {
                    if (str.match(checks[i])) return true;
                }
                return false;
            }

            var message = isResponse(location.hash) ? location.hash : '#' + location.search;

            if (window.parent && window.parent !== window) {
                // if loaded as an iframe during silent refresh
                window.parent.postMessage(message, location.origin);
            } else if (window.opener && window.opener !== window) {
                // if loaded as a popup during initial login
                window.opener.postMessage(message, location.origin);
            } else {
                // last resort for a popup which has been through redirects and can't use window.opener
                localStorage.setItem('auth_hash', message);
                localStorage.removeItem('auth_hash');
            }
        </script>
    </body>
</html>
bkrajendra commented 1 month ago

I have found some references about this issue:

The second one talks about deploying ForgeRock on subdomain and keeping application on TLD. Need to check if this works.