Angular2 Hybrid Flow about node-openid-client

[panva]

Hey @gulatiy, do you have any particular reason for using Hybrid? I can certainly help or advise but would need more details and insights to do it properly.

[gulatiy]

We are using Hybrid Flow to use the features like refresh tokens and it is a combination of both the flows also it is the part of our requirements.
We are building a SPA using Angular 2 and we need some advice setting up this repository with angular 2.

[panva]

Hey @gulatiy, that's not really more descriptive ;) But let's see how far we can get.

It is actually rather easy. Basically you must collect the authorization callback params (serialized in fragment on your redirect_uri) and get them (via any means) to your node backend, where you will run the usual #authorizationCallback() function of your client. This will run the code flow for the received code as well as validate the tokens in a usual fashion.

It is essential that you forward all received parameters to your backend for validation using openid-client because the id_token may contain claims which can only be validated if the other token values are also present.

If you are using the tokens received in fragment in your SPA right away (before waiting for the validation response from your backend) then please beware that you MUST validate them yourself before use.

If in fact you are waiting for the backend to respond then i see no need for a hybrid flow. You may as well do standard code flow only with a response_mode=fragment.

[gulatiy]

Hi @panva I am a newbie to the security so maybe i was a little brief, thanks for this amazing reply.

I now understand the flow of the process, thanks for your time. :-)