postMessage interfering issue

[maxisam]

Describe the bug
on

angular-oauth2-oidc/projects/lib/src/oauth-service.ts

Line 825 in a1652dc

const message = this.processMessageEventMessage(e);

and

angular-oauth2-oidc/projects/lib/src/oauth-service.ts

Line 938 in a1652dc

const message = this.processMessageEventMessage(e);

If there is another postmessage popping pup, it will be caught by the event listener and set message as undefined.

I think we should check if the message is not undefined or from oauth process before calling

angular-oauth2-oidc/projects/lib/src/oauth-service.ts

Line 940 in a1652dc

this.tryLogin({

In the popup case, it will close the popup right away and remove the listener if there is any postMessage executed first.

[manfredsteyer]

Thanks for pointing this out. Will take care about this in the next version (which will land very soon).

[lamnv5490]

Hi guys, I read the issue above. Is this the reason why initImplicitFlowInPopup doesn't work ?
I am trying to implement that case but the data which returned from popup is always undefined. In other case, Silent Refresh works perfectly for me.

Here is my setup

[manfredsteyer]

should work in version 9 which lands soon.

[manfredsteyer]

I'm really not sure if we shall merge the claims in the id_token with the existing claims. What if they are really old? Can we relay on them? Hence, I think your solution with the event is not bad.

Any other thoughts? //cc @jeroenheijmans

[jolle22]

Hi @jeroenheijmans ,

sorry, to comment on this closed issue.
I observed the behaviour of this bug in version 10.0 of angular-oauth2-oidc.

I would expect something like:

this.silentRefreshPostMessageEventListener = (e: MessageEvent) => {
  const message = this.processMessageEventMessage(e);

  if (message) {
    this.tryLogin({
      customHashFragment: message,
      preventClearHashAfterLogin: true,
      customRedirectUri: this.silentRefreshRedirectUri || this.redirectUri
    }).catch(err => this.debug('tryLogin during silent refresh failed', err));
  }
};

Shall I create a new bug report for it?

Thank you very much for your help.