renewAuth does not work anymore due to location.hash being empty in SilentAuthenticationHandler

[damien-gl]

Hi!
The renewAuth does not work anymore for us on v8.12.1 on Chrome (Windows & MacOS).

It seems that the location.hash in SilentAuthenticationHandler. getCallbackHandler is empty here:
https://github.com/auth0/auth0.js/blob/v8/src/web-auth/silent-authentication-handler.js#L68

Here is the value of eventData.sourceObject.contentWindow.location that we get:

{
    "href": "about:blank",
    "ancestorOrigins": {
        "0": "http://localhost:5000"
    },
    "origin": "null",
    "protocol": "about:",
    "host": "",
    "hostname": "",
    "port": "",
    "pathname": "blank",
    "search": "",
    "hash": ""
}

We suspect that this bug got introduced with this commit:
2d7243d
Because the iframe source URL is set after addEventListener and the event is then called for the about:blank Chrome page being loaded instead of the actual renewal URL page being loaded.

Can you please have a look.
Thanks!

[luisrudge]

What version were you using before?

[damien-gl]

Version 8.10.x

[luisrudge]

how do you use the renewAuth method? there's more context about this issue here: #565 (comment)

[damien-gl]

Thanks for the info regarding the issue.
We are simply using renewAuth like this:

renewAuth({
      scope: 'openid email user_metadata app_metadata',
      responseType: 'token',
      responseMode: 'fragment',
      redirectUri: ...
    }, (err, result) => {...})

To fix this issue can you maybe do the following check here:
https://github.com/auth0/auth0.js/blob/v8/src/web-auth/silent-authentication-handler.js#L56

case 'load': 
          if (eventData.sourceObject.contentWindow.location.protocol === 'about:') {
            return false;
          }
// Fall through to default
default:
          return true;

[luisrudge]

Can you send a PR with that change and a test?

[damien-gl]

Hi @luisrudge

Here are the 2 PRs.
V9: #619
V8: #620

Please have a look.
Thanks

[damien-gl]

Hi @luisrudge
Any update on this? We are looking forward to have this fix merged for our production release.
Thx.

[damien-gl]

Any update on this? (@luisrudge @aaguiarz)

[luisrudge]

@damien-gl thanks for both PRs! Sorry to keep you waiting, I was on vacation 🌴 I'm still catching up with stuff, but I'll cut a new release today 🎉

[damien-gl]

thanks @luisrudge