Skip to content

Commit

Permalink
chore: apply prettier in repo
Browse files Browse the repository at this point in the history
  • Loading branch information
wermanoid authored and guillaume-chervet committed Jul 18, 2024
1 parent 02b00e0 commit e4f4d97
Show file tree
Hide file tree
Showing 131 changed files with 7,213 additions and 6,140 deletions.
14 changes: 8 additions & 6 deletions .prettierrc.cjs
Original file line number Diff line number Diff line change
@@ -1,12 +1,14 @@
module.exports = {
printWidth: 100,
semi: true,
singleQuote: true,
jsxSingleQuote: true,
tabWidth: 2,
trailingComma: 'es5',
useTabs: true,
plugins: [],
trailingComma: 'all',
arrowParens: 'avoid',
endOfLine: 'auto',
bracketSameLine: false,
bracketSpacing: true,
singleQuote: true,
useTabs: false,
semi: true,
overrides: [
{
files: ['.*', '*.json', '*.md', '*.toml', '*.yml'],
Expand Down
234 changes: 86 additions & 148 deletions CHANGELOG.md

Large diffs are not rendered by default.

5 changes: 4 additions & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ pnpm install
pnpm run dev
# then navigate to http://localhost:3001
```

You are now ready to contribute!

## Pull Request
Expand All @@ -39,21 +40,23 @@ Packages are automatically published on npm when a PR is merged on main.
Example of commit messages :

To publish a patch version (0.0.x) :

- fix(oidc): my message (alpha) => will publish next patch as an alpha
- chore(oidc): my message (beta) => will publish next patch as an beta
- refactor(oidc): my message (release) => will publish next patch release (with automatic git tag and release)

To publish a minor version (0.x.0) :

- feat(oidc): my message (alpha) => will publish next minor as an alpha
- feat(oidc): my message (beta) => will publish next minor as an beta
- feat(oidc): my message (release) => will publish next minor release (with automatic git tag and release)

To publish a major version (x.0.0) :

- fix(oidc): my message containing BREACKING word (alpha) => will publish next major as an alpha
- fix(oidc): my message containing BREACKING word (beta) => will publish next major as an beta
- fix(oidc): my message containing BREACKING word (release) => will publish next major release (with automatic git tag and release)


## Issue

Please respect the following [ISSUE_TEMPLATE.md](./ISSUE_TEMPLATE.md)
31 changes: 15 additions & 16 deletions FAQ.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# FAQ (Frequently Asked Questions)

## Condition to make silent signing work
## Condition to make silent signing work

Third-party cookies are blocked by default on Safari and will be blocked on all browsers soon.
Today, silent signing works on Safari only if the OIDC provider and the client application are on the same domain.
Expand All @@ -17,24 +17,24 @@ It opens an IFrame in the background, directed to a specific page on your OIDC p

## Condition to make Single Logout to work

The same domain constraint for "silent signing" applies to Single Logout.
The same domain constraint for "silent signing" applies to Single Logout.

Single Logout allows you to disconnect from multiple OIDC Client sessions in one action, even if you are connected to different applications.

## Condition to make Monitor Session to work

Same domain constraint for "silent signing" applies to "monitorSession".
Same domain constraint for "silent signing" applies to "monitorSession".

Monitor session notifies you when your session expires or when you are disconnected from your OIDC provider.

## Does Service Worker is mandatory ?

Service Worker can be disable.
Service Worker can be disable.
You can use classic mode without Service Worker.

Just comment "service_worker_relative_url" like bellow:

````javascript
```javascript
export const configuration = {
client_id: 'interactive.public.short',
redirect_uri: window.location.origin + '/#/authentication/callback',
Expand All @@ -44,24 +44,24 @@ export const configuration = {
// service_worker_relative_url: '/OidcServiceWorker.js',
service_worker_only: false,
};
````
```

If your Service Worker file is already registered on your browser, your need to unregister it. For example from chrome dev tool.
If your Service Worker file is already registered on your browser, your need to unregister it. For example from chrome dev tool.

## Tokens are always refreshed in background every seconds

The @axa-fr/oidc-client automatically refreshes tokens in the background.
It refreshes tokens before expiration to maintain valid tokens at all times.
It refreshes tokens before expiration to maintain valid tokens at all times.

If your token session lifetime is too short, frequent refreshes will occur.
Token refreshing starts 120 seconds before expiration.
Token refreshing starts 120 seconds before expiration.

Setting a session validity longer than 3 minutes is advisable.
Setting a session validity longer than 3 minutes is advisable.

By default, @axa-fr/oidc-client chooses the shorter lifetime between access_token and id_token.
Use the "token_renew_mode" option to change this behavior.

- **token_renew_mode**: String, // Optional, update tokens based on the selected token(s) lifetime: "access_token_or_id_token_invalid" (default), "access_token_invalid", "id_token_invalid"
- **token_renew_mode**: String, // Optional, update tokens based on the selected token(s) lifetime: "access_token_or_id_token_invalid" (default), "access_token_invalid", "id_token_invalid"

## window.crypto.subtle is unavailable over HTTP

Expand Down Expand Up @@ -103,23 +103,22 @@ Quick time-to-market: Start with client-side OIDC, migrate to server-side if nee
@axa-fr/oidc-client is the simplest and cheapest.
</p>


## Good Security Practices : does a Hacker can unregister the Service Worker and retrieve tokens via an Iframe ?

To block token retrieval via an Iframe call and prevent Service Worker unregistration, comply with these practices:

1 - Correctly configure the CSP (Content Security Policy) on the server side.
Example:
Example:

````bash
```bash
server: {
headers: {
"Content-Security-Policy": "script-src 'self';",
},
}
````
```

This blocks dynamic script injection into an iframe.
This blocks dynamic script injection into an iframe.

2 - Initialize `<OidcProvider>` for **React** or the redirect callback for **oidc-client** at the start of your application script.
Configure it before making any fetch calls to services.
Expand Down
35 changes: 19 additions & 16 deletions MIGRATION_GUIDE_V3_TO_V4.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,24 +18,25 @@ Main provider component have been renamed
```javascript
import { AuthenticationProvider } from '@axa-fr/react-oidc-context';

// old v3
// old v3

<AuthenticationProvider configuration={oidcConfiguration} loggerLevel={oidcLog.DEBUG}>
</AuthenticationProvider>
<AuthenticationProvider
configuration={oidcConfiguration}
loggerLevel={oidcLog.DEBUG}
></AuthenticationProvider>;

// in v4 becomes

import { OidcProvider } from '@axa-fr/react-oidc-context';

// loggerLevel : Logger property has been removed in v4
<OidcProvider configuration={oidcConfiguration}>
</OidcProvider>
<OidcProvider configuration={oidcConfiguration}></OidcProvider>;
```

Provider properties have changed, you need to keep only required properties for v4 else it won't work.

```javascript
// old v3
// old v3
const propTypes = {
notAuthenticated: PropTypes.elementType, // react component displayed during authentication
notAuthorized: PropTypes.elementType, // react component displayed in case user is not Authorised
Expand Down Expand Up @@ -75,7 +76,7 @@ const propTypes = {
UserStore: PropTypes.func,
};

// new v4
// new v4
const propTypes = {
loadingComponent: PropTypes.elementType, // you can inject your own loading component
sessionLostComponent: PropTypes.elementType, // you can inject your own session lost component
Expand All @@ -100,25 +101,27 @@ const propTypes = {
Manage Oidc actions and information

```javascript

// old v3
// old v3
import { useReactOidc } from '@axa-fr/react-oidc-context';
const { isEnabled, login, logout, oidcUser, events } = useReactOidc();
const { isEnabled, login, logout, oidcUser, events } = useReactOidc();


// new v4
import { useOidc, useOidcAccessToken, useOidcIdToken, useOidcUser } from '@axa-fr/react-oidc-context';
// new v4
import {
useOidc,
useOidcAccessToken,
useOidcIdToken,
useOidcUser,
} from '@axa-fr/react-oidc-context';

const { login, logout, isAuthenticated } = useOidc(); // login and logout return a Promise
const { oidcUser, isOidcUserLoading } = useOidcUser(); // Return user_info endpoint data
const { accessToken, accessTokenPayload } = useOidcAccessToken(); // Contain access_token metadata acess_token is a JWK
const { idToken, idTokenPayload } = useOidcIdToken(); // contain IDToken metadata

```

```javascript

// old v3
// old v3
import { withFetchRedirectionOn401,
withFetchSilentAuthenticateAndRetryOn401,
withFetchRedirectionOn403,
Expand Down Expand Up @@ -160,7 +163,7 @@ Then edit `OidcTrustedDomains.js` in "public" folder for your need
// OidcTrustedDomains.js
// Add here trusted domains, access tokens will be send to
const trustedDomains = {
default:["http://localhost:4200"],
default: ['http://localhost:4200'],
};
```

Expand Down
36 changes: 20 additions & 16 deletions MIGRATION_GUIDE_V3_TO_V5.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,24 +20,25 @@ Main provider component have been renamed
```javascript
import { AuthenticationProvider } from '@axa-fr/react-oidc-context';

// old v3
// old v3

<AuthenticationProvider configuration={oidcConfiguration} loggerLevel={oidcLog.DEBUG}>
</AuthenticationProvider>
<AuthenticationProvider
configuration={oidcConfiguration}
loggerLevel={oidcLog.DEBUG}
></AuthenticationProvider>;

// in v5 becomes

import { OidcProvider } from '@axa-fr/react-oidc-context';

// loggerLevel : Logger property has been removed in v4
<OidcProvider configuration={oidcConfiguration}>
</OidcProvider>
<OidcProvider configuration={oidcConfiguration}></OidcProvider>;
```

Provider properties have changed, you need to keep only required properties for v4 else it won't work.

```javascript
// old v3
// old v3
const propTypes = {
notAuthenticated: PropTypes.elementType, // react component displayed during authentication
notAuthorized: PropTypes.elementType, // react component displayed in case user is not Authorised
Expand Down Expand Up @@ -103,24 +104,27 @@ const propTypes = {
Manage Oidc actions and information

```javascript

// old v3
// old v3
import { useReactOidc } from '@axa-fr/react-oidc-context';
const { isEnabled, login, logout, oidcUser, events } = useReactOidc();

const { isEnabled, login, logout, oidcUser, events } = useReactOidc();

// new v5
import { useOidc, useOidcAccessToken, useOidcIdToken, useOidcUser } from '@axa-fr/react-oidc-context';

const { login, logout, isAuthenticated} = useOidc(); // login and logout return a Promise
import {
useOidc,
useOidcAccessToken,
useOidcIdToken,
useOidcUser,
} from '@axa-fr/react-oidc-context';

const { login, logout, isAuthenticated } = useOidc(); // login and logout return a Promise
const { oidcUser, oidcUserLoadingState } = useOidcUser(); // Return user_info endpoint data
const { accessToken, accessTokenPayload } = useOidcAccessToken(); // Contain access_token metadata acess_token is a JWK
const { idToken, idTokenPayload } = useOidcIdToken(); // contain IDToken metadata
```

```javascript

// old v3
// old v3
import { withFetchRedirectionOn401,
withFetchSilentAuthenticateAndRetryOn401,
withFetchRedirectionOn403,
Expand All @@ -136,7 +140,7 @@ import { withOidcFetch } from '@axa-fr/react-oidc-context';

// withFetchToken in v3 have been rename to withOidcFetch and set inside '@axa-fr/react-oidc-context' package
withOidcFetch(</MyComponent/>)

```

If you need a very secure mode where refresh_token and access_token will be hide behind a service worker that will proxify requests.
Expand All @@ -162,7 +166,7 @@ Then edit `OidcTrustedDomains.js` in "public" folder for your need
// OidcTrustedDomains.js
// Add here trusted domains, access tokens will be send to
const trustedDomains = {
default:["http://localhost:4200"],
default: ['http://localhost:4200'],
};
```

Expand Down
14 changes: 6 additions & 8 deletions MIGRATION_GUIDE_V6_TO_V7.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,13 @@
- On version 7.3.0 configuration.service_worker_convert_all_requests_to_cors as been moved to TrustedDomains.js

```javascript

// Service worker will continue to give access token to the JavaScript client
// Ideal to hide refresh token from client JavaScript, but to retrieve access_token for some
// scenarios which require it. For example, to send it via websocket connection.
trustedDomains.config_show_access_token = {
domains: ['https://demo.duendesoftware.com'],
showAccessToken: true,
// convertAllRequestsToCorsExceptNavigate: false, // default value is false
// setAccessTokenToNavigateRequests: true, // default value is true
trustedDomains.config_show_access_token = {
domains: ['https://demo.duendesoftware.com'],
showAccessToken: true,
// convertAllRequestsToCorsExceptNavigate: false, // default value is false
// setAccessTokenToNavigateRequests: true, // default value is true
};

```
```
Loading

0 comments on commit e4f4d97

Please sign in to comment.