Comments (28)
@damienbod I completed the test of the branch.
In my opnion, it is ready to be published (v1.2.0 because there are new features).
Changelog:
- Add support for Server Side Rendering
- Add support for custom storage, for example for using cookies (provide class-interface
OidcSecurityStorage
): see README
BREAKING CHANGES
- Setting of storage (sessionStorage or localStorage) has been moved to
AuthConfiguration
(by default, however, sessionStorage is always used).
This version, in my opinion, fixes: #37, #36, #28.
from angular-auth-oidc-client.
I think we should store userData using DI (only in memory), and not the Storage. Then if a dev wants to save them in a Storage it's his decision.
from angular-auth-oidc-client.
Please stop commits. Later I'll do the new storage.
from angular-auth-oidc-client.
I solved the problems with VS. Please wait to use the new branch because I'm still working on it.
from angular-auth-oidc-client.
@robisim74 I made a test branch for storage using the example from crazyht. Haven't had any success with this yet. I think I will scrap it and start again.
from angular-auth-oidc-client.
Testing with SSR and the 1.1.5 version. I get the following error:
Exception: Call to Node module failed with error: ReferenceError: sessionStorage is not defined at OidcSecurityCommon.setupModule
I believe we need to fix the storage before the SSR works.
from angular-auth-oidc-client.
This error is not related to SSR. Where are you testing?
from angular-auth-oidc-client.
If you are using the version with "custom storage", it's wrong.
from angular-auth-oidc-client.
Not using the version with custom storage. Using the last version from the branch origin/SSR.
Created a new default Angular project using the ASP.NET Core 2.0 Angular template.
Added the auth module => error
I'll check it in if it would help. I need to read up on the SSR then.
Greetings Damien
from angular-auth-oidc-client.
Damien, where can I find this project? I had no problems to run the client project using https://github.com/damienbod/angular-auth-oidc-client-SSR-test
In the meantime, I pushed a new branch: https://github.com/damienbod/angular-auth-oidc-client/tree/New_storage
That branch contains the support for SSR & the support for custom storage. For now I can't test it, not even in the normal test app, because I have VS crashed and I'm reinstalling everything.
Later I'll update you.
from angular-auth-oidc-client.
thanks, funny I have the same problem with the https://github.com/damienbod/angular-auth-oidc-client-SSR-test, maybe it's something local.
from angular-auth-oidc-client.
For me the problems started when I installed .net Core preview 2...
from angular-auth-oidc-client.
Yes, I haven't had any success with .NET Core 2.0 either.
from angular-auth-oidc-client.
For me it works only from the command line.
from angular-auth-oidc-client.
Really big thanks! I test tomorrow, update the samples and release.
from angular-auth-oidc-client.
released 1.2.0, tested the browser applications. Will test the SSR ones tomorrow
from angular-auth-oidc-client.
@damienbod and @robisim74 - thanks for attacking this issue--I really appreciate the time you're taking to try to make the SSR scenario work.
I was wondering, though, if it would be possible to use the standard JavaScript Storage interface instead of a custom one (OidcSecurityStorage
) ? There already exist many libraries that implement this interface using a variety of underlying storage mechanisms (see, for example, cookie-storageand memorystorage). If angular-auth-oidc-client
spoke this language, it would be much easier to simply plug in one of these implementations without a lot of ceremony or shimming code.
(this might make your life easier inside the class, too, since the Storage
interface is exactly what localStorage
and sessionStorage
implement).
I forsee the need to swap out storage getting more popular as people increasingly adopt SSR, and I want to make it as easy as possible for people to do it right.
I'm happy to help out here, too, if you like the idea. (Although I'm not super familiar with the internal working of angular-auth-oidc-client
, so any pointers would be appreciated.
from angular-auth-oidc-client.
if it would be possible to use the standard JavaScript Storage
By default, the library already uses this interface.
OidcSecurityStorage
is only an abstract class, that you can customize using what you want (cookies, nodejs storage etc., also through other libraries), if you don't want use the default storage (sessionStorage or localStorage).
from angular-auth-oidc-client.
I think what I was suggesting was a tweak to the way that a consumer of angular-auth-oidc-client
would provide a custom storage implementation: instead of needing to implement OidcSecurityStorage
, you could just pull an implementation of Storage (e.g. cookie-storageand memorystorage) off the shelf, and plug it in directly. Something like this:
import { CookieStorage } from "cookie-storage";
imports: [
AuthModule.forRoot({storage: CookieStorage})
],
The thought is that would be easier for consumers of the library in many cases, since well-tested, complete implementations of Storage
already exist.
(As I said before I'm happy to help out with the implementation if you like the idea).
from angular-auth-oidc-client.
My opinion:
- Maybe you can find a compatibility with those libraries, but tomorrow another dev could ask us a compatibility with another library and so on
- You lose the possibility to implement another kind of storage, like Ionic storage or a database
The only improvement that I think is necessary is to make asynchronous abstract methods (especially if a user wants to use db as a storage) but this requires to make asynchronous the whole operation of the library.
from angular-auth-oidc-client.
Storage is a standard interface. You could create a Storage
shim for anything you could imagine, including ionic. I sympathize with not wanting to accommodate a bunch of one-off requests (I said it before, and I'll say it again--I really appreciate your taking the time to engage with SSR). But it seems like conforming to a standard is better, not worse for this goal.
One idea: I think it would be possible to let Storage
implementations be passed through if you simply renamed the read()
and write()
methods of OidcSecurityStorage
to be getItem()
and setItem()
to match the same methods in Storage
. (because of TypeScript duck-typing). I'll play around with this to get a PoC.
from angular-auth-oidc-client.
@astegmaier @robisim74 I prefer the custom class to wrap the storage. Per default and for most users, this is not needed. I would prefer that the lib is independent of the Storage class.
from angular-auth-oidc-client.
@damienbod @robisim74 No problem--I can accomplish what I need to for SSR either way--it was more of an ease-of-use/aesthetic suggestion.
I updated my test repo to try things out end-to-end with the new OidcSecurityStorage
interface. The client and server implementations are in storage-config.ts. Things are mostly working (awesome!).
(Also: I synced with the latest changes in @damienbod's fork and added both of you as collaborators on the main repo. Feel free to party there if you'd like).
There's two problems I hit, though:
-
The interface for
OidcSecurityStorage
mentioned in the readme calls for the parameters of thewrite()
method to be of typestring
:public write(key: string, value: string): void { ... }
But the actual interface in code allows for the
value
parameter to beany
. I found through testing that the lib was actually sending a full unserializedObject
in some cases (specifically, when it was setting userinfo data), so I had had to add some code tostringify
andparse
this (and handle edge cases likeundefined
). I was thinking it might be simpler for consumers if there was a tighter contract like the one suggested in the readme--less boilerplate, and less edge-cases where a person trying to use the library can mess up. Thoughts? -
There seems to be some problems calling
oidcSecurityService.getToken()
andoidcSecurityService.getUserData()
Specifically:a. They will work fine immediately after the user logs in, but if you hard-refresh and call them again, they return nothing
b. thegetUserData()
method does not work unless you wait a while (~2-3 seconds) afteroidcSecurityService.authorizedCallback()
starts before calling it. I might be doing something wrong, but if there is some kind of asynchronous dependency for getUserData(), maybe it should return a promise or observable?Both (a) and (b) appear to be unrelated to the storage used (I see the same problem if I turn off prerendering and use the default
sessionStorage
), so I can file a new issue with more details if you'd like.
from angular-auth-oidc-client.
Actually, after reading #41, I think I may have solved issue 2(b) above by changing the home component to:
ngOnInit() {
if (typeof location !== "undefined" && window.location.hash) {
this.oidcSecurityService.authorizedCallback();
}
this.oidcSecurityService.onUserDataLoaded.subscribe(() => {
this.checkUserInfo();
});
this.checkToken();
}
I'd love to hear your thoughts about (1) and (2)(a), though.
from angular-auth-oidc-client.
The type string in README (and in BrowserStorage class) is a my fault: later I'll fix it.
@damienbod I have a doubt: do we need to store objects?
from angular-auth-oidc-client.
@robisim74 thanks.
I don't think we should store objects, this would/could cause a security issue.
from angular-auth-oidc-client.
Fixed. Uhm... but at the time we are storing two objects:
- userData
- wellknownendpoints
from angular-auth-oidc-client.
wellknownendpoints does not matter, this is public.
userData, yes, need to think about this.
from angular-auth-oidc-client.
Related Issues (20)
- [Question]: How to build a `PartialRoutesGuard` without auto-login
- [Question]: Unable to find eagerLoadAuthWellKnownEndpoints in version 18.0.0
- [Bug]: Expected double-quoted property name in JSON at position 709 HOT 2
- [Bug]: AutoLoginPartialRoutesGuard is not trying to silentRenew if refresh token still valid HOT 2
- [Question]: How can I use urlHandler when using authorizeWithPopUp, is it supported in popup?
- [Question]: How can i use it with oidc-provider
- [Question]: Async provider loader with provideAuth HOT 3
- [Question]: Is there a handler for when the refresh token process returns id_token?
- [Question]: Angular 18 SSR
- [Bug]: Potential Infinite IFrame Creation When 'checkSessionIframe' Is undefined
- [Question]: Implementing Custom Storage in standalone api HOT 2
- [Feature Request]: Custom auth header
- [Question]: Error handling support with Azure
- [Bug]: Silent renew failed with error: invalid_grant HOT 1
- Documentation website down HOT 2
- [Bug]: Wellknown endpoints completely overwrite the authWellknownEndpoints configuration
- [Bug]: Firefox login crashes : this.cryptoService.getCrypto().subtle is undefined HOT 2
- [Bug]: Sample & Documentation site is down (404) HOT 2
- [Bug]: silentRenewTimeoutInSeconds does not timeout the token refresh http request
- [Question]: Manual token refreshing
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from angular-auth-oidc-client.