1

As answered in this question, Single Page Applications shouldn't be given a refresh token with the OIDC Authorization Code Flow.

Can you indicate some way of getting a new access token when it expires (without interrupting the SPA UX state (no redirects...)?

If the use of refresh tokens is the only solution, what are the ways we can minimize the risk of leakage? E.g., is storing it in the browser's session storage safe enough? Do IdPs provide some form of refresh_token expiration, etc.

Improve this question

1 Answer 1

Reset to default
1

Once the access_token has expired you need to re-authenticate against the openid provider to get a new access token. The openid provider should take care of remembering who is logged in (e.g. through a persistent cookie), and immediately redirect back to the application without re-authenticating the user. If you want this to happen with no redirects visible to the use then you can complete this in an iframe.

If the openid provider requires that the user re-authenticates then you are out of luck - if you perform the re-authentication in an iframe then you will want to have some sort of detection for this case as it won't be visible to the user.

Improve this answer
1
  • The process of getting new access token for SPA application without is called "silent refresh" which includes performing "hidden" iframed request to authorization server (authentication request) with additional id_token_hint parameter (which is OPTIONAL). It should renew session if OpenID Provider still has valid session. If not, unfortunately user will have to re-login.
    – Bartosz Rosa
    Apr 7, 2020 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .