I have an Angular app - I'm using OidcSecurityService v11 and have an implicit flow implementation with silentRenew=true as follows
oidcConfigService.withConfig({
stsServer: "https://localhost:44371",
redirectUrl: `${window.location.origin}/callback`,
clientId: 'spaCodeClient',
scope: 'openid profile MyWebProject',
responseType: 'code',
triggerAuthorizationResultEvent: true,
postLogoutRedirectUri: `${window.location.origin}`,
startCheckSession: false,
silentRenew: true,
silentRenewUrl: `${window.location.origin}/silent-renew.html`,
postLoginRoute: '/disclaimer',
forbiddenRoute: '/unauthorized',
unauthorizedRoute: '/unauthorized',
logLevel: LogLevel.Debug,
historyCleanupOff: true,
// iss_validation_off: false
// disable_iat_offset_validation: true
maxIdTokenIatOffsetAllowedInSeconds: 10,
disableIatOffsetValidation: true
});
My Identity Server 4 server-side Client timeout settings (for Development) are as follows
"IdentityTokenLifetime": 30, // one time only token --> Lifetime to identity token in seconds (defaults to 300 seconds / 5 minutes)
"AccessTokenLifetime": 120, // passed around the application --> Lifetime of access token in seconds (defaults to 3600 seconds / 1 hour)
"AuthorizationCodeLifetime": 30 // Lifetime of authorization code in seconds (defaults to 300 seconds / 5 minutes)
"AbsoluteRefreshTokenLifetime": 180, // Maximum lifetime of a refresh token in seconds. Defaults to 2592000 seconds / 30 days
"SlidingRefreshTokenLifetime": 150, // Sliding lifetime of a refresh token in seconds. Defaults to 1296000 seconds / 15 days
I want to check for the expiry of a token, session, etc to log the user off (and ideally warn ahead of time). Up to now the refresh token simply looks like it is refreshing (via the silent-renew processing) past the expiry (eventually I get a 401 for http.get calls but well past the timeouts above)
I've seen some solutions (which leverage the token, id_token, timeouts) however as I'm using the implicit flow with silent-renew, as I understand it these tokens/timeouts are not as relevant. Is the recommended solution to set startCheckSession to true then subscribe to the corresponding event to then send the user to the unauthorized screen as in https://github.com/damienbod/angular-auth-oidc-client/issues/568 (user:rekosko:24-Jan-2020 - note that this is in answer to a v10 question) ?
I've added the following to my AuthService
checkSessionExpired(): Observable<boolean> {
console.log("checkSessionExpired");
return this.oidcSecurityService.checkSessionChanged$.pipe(
map((isSessionChanged: boolean) => {
console.log("checkSessionExpired-checkSessionChanged$:" + isSessionChanged);
if (isSessionChanged) {
return true;
}
return false;
})
);
}
... however I'm not sure how/where this might be called (interceptor, a timer perhaps - from where?) or whether this is the correct approach
Does anyone know whether this is the preferred solution (for v11) given the above scenario - if so, are you able to provide more detail than is in the solution for the above link (what this looks like in v11, where it is called from, etc)