fix: remove the iFrame Silent Refresh from the default checkSession b…

…ecause of Cross Domain issues with the iFrames. Added TODO to investigate and pick up later. For now the functionality is turned off because it is just inconvenient, not blocking.

src/flows/implicit-flow/implicit-flow.ts

@@ -106,22 +106,23 @@ export async function implicitFlow(
   }
 
   // 4. get the auth result from a silent refresh
-  const authResultFromSilentRefresh = await silentRefresh(
-    authValidationOptions,
-  ).catch(() => null);
-  if (authResultFromSilentRefresh) {
-    if (await isValidNewAuthResult(authResultFromSilentRefresh)) {
-      storeAuthResult(authResultFromSilentRefresh);
-      if (
-        isValidStoredAuthResult(
-          authResultFromSilentRefresh,
-          authValidationOptions?.extraAuthFilters || [],
-        )
-      ) {
-        return authResultFromSilentRefresh;
-      }
-    }
-  }
+  // TODO: Reenable this once we find a way to Catch the `ERROR DOMException: Blocked a frame with origin 'origin'` error.
+  // const authResultFromSilentRefresh = await silentRefresh(
+  //   authValidationOptions,
+  // ).catch(() => null);
+  // if (authResultFromSilentRefresh) {
+  //   if (await isValidNewAuthResult(authResultFromSilentRefresh)) {
+  //     storeAuthResult(authResultFromSilentRefresh);
+  //     if (
+  //       isValidStoredAuthResult(
+  //         authResultFromSilentRefresh,
+  //         authValidationOptions?.extraAuthFilters || [],
+  //       )
+  //     ) {
+  //       return authResultFromSilentRefresh;
+  //     }
+  //   }
+  // }
 
   // There is no auth result; try to get one for the next time we call this
   // function, by redirecting to the authorize endpoint.

src/utils/iframe.ts

@@ -47,10 +47,6 @@ export function loadIframeUrl(url: string): Promise<string> {
       resolve(iFrame.contentWindow.location.href);
     };
 
-    iFrame.onerror = () => {
-      reject('iframe error (possible reasons: COR / CSP / Frame Ancestors / other iFrame security issues');
-    }
-
     timeout(20000).then(() => {
       reject('iFrame rejected');
     });