angular-auth-oidc-client: [Bug]: Silent refresh fails using localStorage when multiple tabs trying to refresh at the same time

Version

5.0.3

Please provide a link to a minimal reproduction of the bug

No response

Please provide the exception or error you saw

silent renew failed! Error: Error: authorizedCallback, token(s) validation failed, resetting.

Steps to reproduce the behavior

1) Set up OIDC Code Flow PKCE using refresh tokens (used 'ng add angular-auth-oidc-client')

2) Set up custom storage using localStorage (used example from https://angular-auth-oidc-client.com/docs/documentation/custom-storage)

4) To speed up testing, setup your authority to have short lived access and refresh tokens. (i.e. 1 or 2 minutes) 

3) Login using one browser [chrome] tab (i.e. this.oidcSecurityService.authorize()). Open console and verify refresh is working

4) Open a few more tabs. Open console and verify they are authorized and refreshing

5) Wait until error occurs. It shouldn't take long - usually 2-10 minutes with 1 minute tokens. Open more tabs if needed.

A clear and concise description of what you expected to happen.

access token should refresh successfully and all tabs remain authorized

Additional context

It seems that multiple tabs simultaneously attempting to refresh the token using a shared localStorage is causing a race condition, resulting in validation failure.

About this issue

Original URL
State: closed
Created a year ago
Reactions: 1
Comments: 19 (4 by maintainers)

Most upvoted comments

We found a temporary solution with localStorage, which we’re still experimenting right now :

We set the renewTimeBeforeTokenExpiresInSeconds with a random value between 100 and 500. This allows us to reduce the probability of tabs refreshing the token at the same time, as each tab will rarely has the same value (but, of course, zero risk does not exist…)

renewTimeBeforeTokenExpiresInSeconds: Math.floor(Math.random() * 400) + 100

Adrii77 on Apr 20, 2023

@medeirosrich I guess not. Damien answered on this topic : https://github.com/damienbod/angular-auth-oidc-client/issues/1716#issuecomment-1510416354

My client often need to open my app into another tab. If I use sessionStorage, he’ll need to sign in on each tab… that’s not a great UX.

Adrii77 on Apr 20, 2023

@Adrii77 We did not. We switched to using sessionStorage for now.

medeirosrich on Apr 13, 2023