useHttpBasicAuthForPasswordFlow not working when refreshToken

[97lynk]

Hi everybody!
I use password flow for OAuth2.
I've configured with useHttpBasicAuthForPasswordFlow: true, it works fine with fetchTokenUsingPasswordFlow.
But when I want to refresh the token, stop as it does not work

 this.oauthService.events.subscribe (e => {
      console.log ('oauth / oidc event', e);
      if (e.type == 'token_expires') this.oauthService.refreshToken (). then (value => console.log (value));
    };

I checked the Http Request Header, which does not have the Authorization header with Basic.
Please help me. Thank you very much!

[smainz]

Hi,

I was about to file the same issue at the moment. The method refreshToken() does not set the Basic Authentication Header (oauth-service.ts, line 738):

        const headers = new HttpHeaders().set(
            'Content-Type',
            'application/x-www-form-urlencoded'
        );

as it does in fetchTokenUsingPasswordFlow():

        if (this.useHttpBasicAuthForPasswordFlow) {
            const header = btoa(`${this.clientId}:${this.dummyClientSecret}`);
            headers = headers.set(
                'Authorization',
                'Basic ' + header);
        }

        if (!this.useHttpBasicAuthForPasswordFlow) {
            params = params.set('client_id', this.clientId);
        }

        if (!this.useHttpBasicAuthForPasswordFlow && this.dummyClientSecret) {
            params = params.set('client_secret', this.dummyClientSecret);
       }

The obvious workaround would be to to copy this code into refreshTocken() or to extract a method and call it at both places, but I do not know what happen when using implicit flow if I did that.

@manfredsteyer: Any advice how I can help?

At the moment my workaround is crude (in the interceptor):

if (this.isLoggedIn) {
  // FIXME: oauth url is hard coded.
  if (!request.url.endsWith('/token')) {
    request = request.clone({
      setHeaders: {
        'Authorization': `Bearer ${this.auth.getToken()}`
      }
    });
  } else {
    // TODO: Workaround: angular-oauth2-oidc does not set Basic Authentication header
    //       in refreshToken(). We require it.
    // FIXME: user name and password are hardcoded.
    const auth = btoa('client' + ':' + 'secret');
    request = request.clone({
      setHeaders: {
        'Authorization': `Basic ${auth}`
      }
    });
  }
}
return next.handle(request);

[jeroenheijmans]

Seems like an omission to me then? A PR to fix this would be good.

The reason this might've been overlooked (apart from lacking tests) is that the Password Flow isn't very popular (as it's considered unsuitable for JS apps, meant for if you're stuck with legacy architecture), and even when you do use that flow a client secret is quite useless (since the JS is public, not secret).

(I understand and appreciate that you and others might just have to deal with this flow, and the bug should of course be fixed. But at the same time I want to warn others landing here that still have a choice to consider other OAuth/OIDC flows.)

[mikelhamer]

@jeroenheijmans Can you point me in the direction of where to start for creating such a PR?

[jeroenheijmans]

No sorry, I'd have to dive into it myself as well. Perhaps the posts above are helpful pointers?

[smainz]

@mikelhamer Are you going to test my fix with current version? I have uploaded a patched version here:
https://github.com/smainz/angular-oauth2-oidc (branch fix/#488)

If you confirm it works, I will file a pull request.

[CarlosTorrecillas]

Hello @mikelhamer , not sure if this still applies, but if you haven't created the PR, I think it's better if you it to get the code reviewed and hopefully merged in