refresh token rotation should be optional (fixes #1338)

[mduriancik]

Proposed solution to #1338. The idea is to separate the refresh token from authResult in the storage.
I have tested the solution and it resolves my problem.

Of course more refactoring and more tests could be needed.

[damienbod]

Hi @mduriancik firstly thanks for the PR. I'm thinking about this. I think we need an allowUnsafeReUseRefreshToken: boolean configuration to activate this feature. Secondly not sure about having the refresh token saved twice to the session storage.

Not sure of a solution at present.

Greetings Damien

[FabianGosebrink]

Any news on this?

[mduriancik]

Hi Fabien,

Thank's for your feedback. Yes, good idea, I can add the property allowUnsafeReuseRefreshToken (default true?).

Yes it is not quite "DRY" to store the refresh token twice (authResult and refresh_token), but as refresh_token can outlive the immediate authResult it looks to me the simplest solution.

Other solution: to modify the new authResult transfering the refresh_token form the previous authResult -> It looks to me less "elegant", but if you prefer this one I can change my PR. Do you see there other possibilities?

Milan

[damienbod]

allowUnsafeReuseRefreshToken (default false?). We do not want to encourage this, this should only be used if the IDP is missing the feature. This is not a good idea and I'm not even sure we should support this. Maybe ADFS federation to AAD for public IDP would be better.

Greetings Damien

[mduriancik]

added allowUnsafeReuseRefreshToken
a little bit of refactoring:

• the storage property renamed: reusable_refresh_token -> to clarify the its purpose of this token
• default refresh token location is in 'authnResult'
• refresh token is stored in "reusable_refresh_token" only if the property is enabled

[damienbod]

Hi @mduriancik I will add this to the next release , Thanks!

Greetings Damien

[sonzo]

@damienbod

What is the status on this?

i can see the build didnt go through
https://github.com/damienbod/angular-auth-oidc-client/runs/4779278390?check_suite_focus=true