signinSilent using refresh token clears profile info

[MathiasFrost]

I have a question.

1. I call signinPopup and log in.
2. User is stored in localStorage with id_token, access_token, refresh_token as well as decoded user info from id_token stored as a profile object.
3. Call signinSilent.
4. oidc-client-ts exchanges the refresh_token for a new access_token and a new refresh_token.
5. localStorage is updated with a new refresh_token and access_token, but the profile object is now empty (id_token was unchanged).

Is that supposed to happen and am I doing something wrong?

Thank you.

[pamapa]

Id_token + more are taken from initial request if not coming from refresh token request. This was fixed some time ago, make sure you are using a recent version of this library.

The relevant code is here:

oidc-client-ts/src/ResponseValidator.ts

Lines 74 to 101 in ec554af

	public async validateRefreshResponse(response: SigninResponse, state: RefreshState): Promise<void> {
	const logger = this._logger.create("validateRefreshResponse");
	response.userState = state.data;
	// if there's no session_state on the response, copy over session_state from original request
	response.session_state ??= state.session_state;
	// if there's no scope on the response, then assume all scopes granted (per-spec) and copy over scopes from original request
	response.scope ??= state.scope;
	// OpenID Connect Core 1.0 says that id_token is optional in refresh response:
	// https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse
	if (response.isOpenId) {
	if (response.id_token) {
	this._validateIdTokenAttributes(response, state.id_token);
	logger.debug("ID Token validated");
	}
	else {
	// if there's no id_token on the response, copy over id_token from original request
	response.id_token = state.id_token;
	// and decoded part too
	response.profile = state.profile;
	}
	}
	const hasIdToken = response.isOpenId && !!response.id_token;
	await this._processClaims(response, false, hasIdToken);
	logger.debug("claims processed");
	}

[MathiasFrost]

Thanks for the answer.
Yes, I read through the previous issues related to this, which is why I am scratching my head at this.
I am using version 2.1.0 which is a recent release.

My guess from the method you referenced is that in my case we do not get past this if:

oidc-client-ts/src/ResponseValidator.ts

Line 85 in ec554af

if (response.isOpenId) {

I'm not familiar with that part of the response. Will do some debugging :)

[MathiasFrost]

Okay, so I'm relatively certain of what is happening:

1. The response from identity provider when exchanging refresh_token does not contain id_token at this point.
2. response is created with field profile initialized at ctor as empty object.
3. Scope does not contain openid, which means we do not enter this if.
4. This results in the profile field containing values is overridden by the empty object mentioned in step 2.

So the question if is this is by design or not.
In my case I am using Azure AD and can't ask for openid at the same time as a resource (secured API).

[pamapa]

The if if (response.isOpenId) { is there for historically reasons and i never saw a real world use-case to change that. Now i know such a case. I guess we can remove that if together with ...response.isOpenId &&...

Can you test this first and if all good providing a merge request?

[MathiasFrost]

Sure, but I'm not sure I know what you mean by

...together with ...response..isOpenId &&...

Care to elaborate?

[pamapa]

@MathiasFrost I have added a merge request, can you please test if that helps you?

[MathiasFrost]

@MathiasFrost I have added a merge request, can you please test if that helps you?

Aye, works perfectly ^^