QuoteExceededError from localStorage

[luke-atp]

I am receiving errors from the oidc-client-ts library when storing data in localStorage. I also notice many values in localStorage over time, all with different keys.

My configuration user manager settings are:

{
      authority: '',
      client_id: '',
      redirect_uri: ``,
      scope: 'openid, profile ...',
      response_type: 'code',
      post_logout_redirect_uri: '',
      filterProtocolClaims: false,
      automaticSilentRenew: true,
      silent_redirect_uri: ''
}

Is there some configuration that I am missing that is not cleaning up the old values?

Below is a screenshot of the error.

[pamapa]

I guess you local storage exceeds the max. size of 10 MB. As local storage is shared between applications, it is probably caused by other applications, maybe a clean helps...

[luke-atp]

Cleaning localStorage does resolve the issue temporarily. However, it appears to be oidc-client data that is filling up the space.

Over time the records below continue to be added, and never removed from localStorage.

[pamapa]

Ups, that should not happen, can you debug (or enable Console logging) why that happens, on my side i have not seen that yet....

[luke-atp]

Yeah, I can enable DEBUG and log out everything that is happening. I'm not seeing any errors. Is there anything in particular that would be helpful?

[kherock]

I also see this, but it's never when I'm looking. Though I do know that this will happen under certain circumstances when a sign in request fails. For example, the sign-in attempt fails at the IDP, and the window never returns to the website to be cleaned up.

[kherock]

@pamapa currently this library never runs .clearStaleState() in any automatic fashion. I don't think we have a leak to patch here, I think it's just a problem of incomplete authorization requests piling up while developing a new application. How do you feel about automatically running it at the beginning of OidcClient#createSigninRequest()?

[luke-atp]

@kherock the application that I am working on has had the IdP functionality done for awhile, and was previously working with oidc-client. We shouldn't be getting errors or incomplete authorizations anymore than we would in a production environment.

[luke-atp]

After some time, I was finally able to find more records getting added to localStorage. @kherock may be on the right track. I got the errors when I killed my angular application. However, I wonder if it is also happening when my computer goes to sleep.

I'm seeing the following events in my logs that seem meaningful:

_tokenExpiring: ErrorTimeout from signinSilent: ErrorTimeout: IFrame timed out without a response
...
raise: Error: IFrame removed from DOM

[pamapa]

@luke-atp Background: Your silent renew process does not complete, due to a connection error. As long as that renew process does not fail this library retries. For each authorization request a temporary state object is created to recognize that request when we receive a response from the authorization server. The solution, which @kherock proposed should fix this.

[luke-atp]

@pamapa that makes sense. Does that mean I should call clearStaleState manually in my application? Something like this:

this._userManager.events.addSilentRenewError(err => {
  this._userManager.clearStaleState();
});

[pamapa]

@luke-atp until we have fixed in the library, that can be a possible workaround. Please also notice clearStaleState uses StaleStateAgeInSeconds settings (Default is 60*15) to know which ones to clear. If you need to tweak that setting please let us know...