As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow.

Can you indicate some way of getting a new access token when it expires (without interrupting the SPA UX state (no redirects...)?

If the use refresh tokens were the only solutions, what are the ways we can minimize the risk of leakeage? E.g: is storing it in the browser's session storage safe enough? Do IdPs provide a some form of refresh_token expiration, etc.


Once the access_token has expired you need to re-authenticate against the openid provider to get a new access token. The openid provider should take care of remembering who is logged in (e.g. through a persistent cookie), and immediately redirect back to the application without re-authenticating the user. If you want this to happen with no redirects visible to the use then you can complete this in an iframe.

If the openid provider requires that the user re-authenticates then you are out of luck - if you perform the re-authentication in an iframe then you will want to have some sort of detection for this case as it won't be visible to the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.