Listen for storage to receive auth hash from popup #935

l1b3r · 2020-09-13T14:34:06Z

Currently, initLoginFlowInPopup method is expecting to receive a message from the popup via postMesage by subscribing to it via:

window.addEventListener('message', listener);

Unfortunately this doesn't always work: when the auth provider is on a different domain and the auth process includes redirects within the popup to even more upstream authentication authorities on a third domain and the flow eventually comes back to the original application domain, the popup no longer "remembers" its window.opener. AFAIU this is done for security reasons.. This means that the popup has no one to postMessage to, and the parent application is left there waiting forever.

This MR suggests adding a storage event fallback. The parent application launches the popup and listens for two sources instead of one: 'message' events (received by postMessage on the other side) and 'storage' events, which the popup can fallback to if it has no parent or opener to refer to.

Here's an example of the silent-refresh.html to support the idea:

<html>
<body>
<script>
    if (window.parent && window.parent !== window) {
        // if loaded as an iframe during silent refresh
        window.parent.postMessage(location.hash, location.origin);
    } else if (window.opener && window.opener !== window) {
        // if loaded as a popup during initial login
        window.opener.postMessage(location.hash, location.origin);
    } else {
        // last resort for a popup which has been through redirects and can't use window.opener
        localStorage.setItem('auth_hash', location.hash);
        localStorage.removeItem('auth_hash');
    }
</script>
</body>
</html>

l1b3r · 2020-09-13T15:16:44Z

Also reflected the necessary changes to silent-refresh.html in the docs and in the sample application.

Nikolay Dolzhenkov added 2 commits September 13, 2020 17:14

listen for storage to receive auth hash from popup

8797d01

edited the docs and sample app to support the MR

8cb450e

manfredsteyer merged commit 9e2dc91 into manfredsteyer:master Jul 16, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Listen for storage to receive auth hash from popup #935

Listen for storage to receive auth hash from popup #935

l1b3r commented Sep 13, 2020 •

edited

Loading

l1b3r commented Sep 13, 2020

Listen for storage to receive auth hash from popup #935

Listen for storage to receive auth hash from popup #935

Conversation

l1b3r commented Sep 13, 2020 • edited Loading

l1b3r commented Sep 13, 2020

l1b3r commented Sep 13, 2020 •

edited

Loading