I use angular-oauth2-oidc lib in Angular and Identity Server on my project. And I use another client is MVC. When I sign out on MVC I want logout in Angular. But token is not expire in Angular app. When I go to Angular app I get authorize user. I get it
this.oauthService.hasValidAccessToken(); // true
My angular settings:
const authConfig: AuthConfig = {
clientId: this.configurationService.config.audience,
issuer: `${this.configurationService.config.issuer}`,
redirectUri: `${location.origin}/auth-callback`,
loginUrl: `${this.configurationService.config.issuer}/connect/authorize`,
logoutUrl: `${this.configurationService.config.issuer}/connect/revocation`,
requestAccessToken: true,
clearHashAfterLogin: true,
responseType: 'id_token token',
sessionChecksEnabled: true,
showDebugInformation: true,
postLogoutRedirectUri: `${this.configurationService.config.issuer}/Account/Logout`,
requireHttps: this.configurationService.config.requireHttps,
scope: this.configurationService.config.scope,
};
Identity settings:
new Client
{
AccessTokenType = AccessTokenType.Jwt,
RefreshTokenExpiration = TokenExpiration.Absolute,
AccessTokenLifetime = coreSettings.AbsoluteRefreshTokenLifetimeInSeconds,
IdentityTokenLifetime = coreSettings.AbsoluteRefreshTokenLifetimeInSeconds,
UpdateAccessTokenClaimsOnRefresh = true,
AllowOfflineAccess = true,
ClientId = "jsclient",
ClientName = "JavaScript client",
ClientSecrets =
{
new Secret("personal-cabinet".Sha256())
},
AllowedGrantTypes = GrantTypes.Implicit,
AllowAccessTokensViaBrowser = true,
AlwaysIncludeUserClaimsInIdToken = true,
RequireConsent = false,
RedirectUris =
{
$"{coreSettings.PersonalCabinet}/auth-callback"
},
PostLogoutRedirectUris =
{
coreSettings.IdentityServer
},
AllowedCorsOrigins =
{
coreSettings.PersonalCabinetApiService,
coreSettings.PersonalCabinet
},
AllowedScopes =
{
StandardScopes.OpenId,
StandardScopes.Profile,
"personal-cabinet-api"
}
}
How can I expire token in Angular? Maybe need I add something logout url? I add in settings
logoutUrl:
${this.configurationService.config.issuer}/connect/revocation
but it does not work.
Maybe need I send something url for logout?
Any ideas? Thanks