Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include redirect_uri query parameter in silent refresh? #581

Closed
n0rwin opened this issue Nov 9, 2022 · 3 comments
Closed

Include redirect_uri query parameter in silent refresh? #581

n0rwin opened this issue Nov 9, 2022 · 3 comments
Labels
question Further information is requested

Comments

@n0rwin
Copy link

n0rwin commented Nov 9, 2022

I am trying to use react-oidc-context to login with Azure AD B2C.
The login works as expected, but I cannot get the silent refresh to work.
Before the access token expires, the library sends a request to the auth endpoint including the refresh_token.
But Azure AD B2C also requires that you include the redirect_uri again in the query parameters.
I get the following error response: AADB2C90083: The request is missing required parameter: redirect_uri.

Is there a way I can control, that this parameter gets included in the silent refresh call?
I looked through the documentation and couldn't find a suitable configuration setting, that would take care of that.
I tried setting the extraQueryParams property in the oidcConfig object, but that will lead to the redirect_uri parameter ending up twice in the initial login request and still isn't included in the silent refresh call.

If it is not possible to adapt the silent refresh in that way. What would be my options implementing the token refresh myself?

@pamapa
Copy link
Member

pamapa commented Nov 14, 2022

See SigninSilentArgs in UserManager:
https://github.com/authts/oidc-client-ts/blob/2e49894fa76681fbab63ee3cd1f7ef094eea4fa2/src/UserManager.ts#L47

signinSilent({redirect_url: "123"})

@pamapa pamapa added the question Further information is requested label Nov 14, 2022
@n0rwin
Copy link
Author

n0rwin commented Nov 14, 2022

Thank you. If I understand your response correctly, that means, that I have to call signinSilent myself, passing the redirect_url as parameter in the SigninSilentArgs object.
So I guess there is no way, react-oidc-context passes this parameter on its own when just configuring automaticSilentRenew = true?
That would mean that I have to implement my own refresh mechanism, either time based, or by reacting to failed calls where the token has expired. Correct?

@pamapa
Copy link
Member

pamapa commented Nov 15, 2022

That would mean that I have to implement my own refresh mechanism, either time based, or by reacting to failed calls where the token has expired. Correct?

Yes, that was my idea, i just looked at the oidc-client-ts code, but your code path the args parameter is not taken into account yet, as such that will also not work yet:

public async signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {
        const logger = this._logger.create("signinSilent");
        const {
            silentRequestTimeoutInSeconds,
            ...requestArgs
        } = args;
        // first determine if we have a refresh token, or need to use iframe
        let user = await this._loadUser();
        if (user?.refresh_token) {
            logger.debug("using refresh token");
            const state = new RefreshState(user as Required<User>);
            return await this._useRefreshToken(state);
        }

You would need to provide a merge request in oidc-client-ts to add this feature.

  1. allow to pass args also into RefreshState and make use of it

I am not using the "the Refresh Token grant type".
Somehow i do not understand why a redirect_uri for the Refresh Token grant type. As this is a http post request and the direct response contains all information. Can you search in the official "Azure AD B2C" documentation for Refresh Token grant type.
aka grant_type = "refresh_token"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants