Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal: Add implicit flow through popup #468

Merged
merged 1 commit into from
Jul 17, 2019

Conversation

leonardochaia
Copy link
Contributor

This PR adds a new method initImplicitFlowInPopup which opens a new Window to the silentRefreshRedirectUri with the display=popup query param.
It performs the implicit flow inside the popup, inspired on how silent renewal is being done.

@leonardochaia
Copy link
Contributor Author

The corresponding html for the iframe needs to be changed to consider window.opener.
We may want to use a different config property for this iframe url to allow consumers to use a different one.

<html>

<body>
  <script>
    (window.opener || window.parent).postMessage(location.hash, location.origin);
  </script>
</body>

</html>

@jeroenheijmans
Copy link
Collaborator

👍 LGTM, nice feature! (Disclaimer: haven't tested it though, just skimmed through the changes.)

@Jrubzjeknf
Copy link

Tested it by copying it to my project, as we require this functionality at short notice.

The implementation works well. It does require modifying the silent-refresh.html as per @leonardochaia's comment. Also, you may want to modify the calculatePopupFeatures() to allow users to login using a new window/tab instead of a popup.

All in all, nice job! Saved me a lot of time. 👍

@cgatian
Copy link
Contributor

cgatian commented Jul 17, 2019

@manfredsteyer is there any reason this shouldnt be merged?

@manfredsteyer
Copy link
Owner

Great. THX!

@manfredsteyer manfredsteyer merged commit 617e7f8 into manfredsteyer:master Jul 17, 2019
@pieterdb4477
Copy link

Is this feature documented somewhere?

@leonardochaia
Copy link
Contributor Author

Hi @pieterdb4477, unfortunately it's not.
Hopefully this can help you get started:

  1. Change the iframe HTML like my so: (notice the window.opener)
<html>

<body>
  <script>
    (window.opener || window.parent).postMessage(location.hash, location.origin);
  </script>
</body>

</html>
  1. Call authService.initImplicitFlowInPopup()
  2. A new window should open to the authorize endpoint of your IDP.
  3. After you login, it should be closed new tokens should be obtained

Regards,
Leo.

@lamnv5490
Copy link

lamnv5490 commented Dec 25, 2019

The problem I am facing is I don't know what to do after system finished popup flow. I have tried this out but nothing return.

this._authService.initImplicitFlowInPopup().then(value => { console.log(value); });

What if I clear local storage then refresh browser. The flow still shows popup but there is something wrong in local storage. Here it is:

image

Regard,

@leonardochaia
Copy link
Contributor Author

hey @lamnv5490 , if I remember correctly after you've called initImplicitFlowInPopup and the popup closes, you should be able to get the token with authService.accessToken

I'm did not understand the last part of your comment tho.

@lamnv5490
Copy link

lamnv5490 commented Dec 26, 2019

The last part happened when I delete all local storage and press F5 button. The popup still shows up but I didn't get any access token.

I know that when the popup closes, I would able to get the token. But it would be great that we could observe our initImplicitFlowInPopup whenever we receive the token :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants