cookie not send on silent renew auth request

[Dynamic91]

Hello, I am using oidc-client-ts v2.0.5 in my front-end application for getting access tokens. The issue I have is that on silent renew flow, the cookie is not send to /connect/authorize endpoint, therefore on silent callback page I get login_required error issued by the auhorization server.

I have read some articles that because the browsers are getting more strict with how they handle cookies, the silent renew flow will not work anymore. Is this true? If so, what is the recommended way to get new access tokens? If not, what can cause oidc-client-ts to not send the cookie on silent renew flow and how can I solve the problem?

Thanks in advance!

[pamapa]

Are you using silent renew with refresh token or without?

With refresh token: In this case fetch is used. See exchangeRefreshToken here https://github.com/authts/oidc-client-ts/blob/main/src/TokenClient.ts#L109. This code is using postForm in https://github.com/authts/oidc-client-ts/blob/main/src/JsonService.ts#L122. The postForm is then using fetch.

In fetch we do not pass credentials?: RequestCredentials;, then it should refer to the default (same-origin).

Without refresh token: This library is doing a silent renew with an iframe request (without fetch). Depending on the authz server and browser the cookie policy can be different. e.g. same-site.

When using this library on an exposed client like customer browser its not recommended to use a refresh token!

[Dynamic91]

I am trying to use it without refresh token, because like you said, it is not recommended. But the browser doesn't send the cookie to auth server when trying to get a new access token on /connect/authorize. Why is that and how can i fix it? Thanks!

[pamapa]

You will need to debug that on your side. Check if you have a cookie, verify its settings. Verify that the browser is allowed to send it to the request host (authz host for silent renew). Eventually CORS is in your way, if that is the case you need to whitelist your site on the authz server, ...

[admir86]

same behavior with v2.0.3, it worked fine a few weeks ago. for about 2-3 weeks I have the problem but only in Firefox.

SameSite policy has not changed:

[Dynamic91]

You will need to debug that on your side. Check if you have a cookie, verify its settings. Verify that the browser is allowed to send it to the request host (authz host for silent renew). Eventually CORS is in your way, if that is the case you need to whitelist your site on the authz server, ...

Works if I perform a login. It sends the cookie to /connect/authorize endpoint and I get a succesful login and valid access and id tokens. But on silent renew it doen't send the cookie and therefore I get a login_required error.

[admir86]

same behavior with v2.0.3, it worked fine a few weeks ago. for about 2-3 weeks I have the problem but only in Firefox.

SameSite policy has not changed:

I only have the problem locally (ng serve). In production it works (that's probably why nobody reported it 😄 ) I think it's a CORS problem, I just don't understand why it's only in Firefox and was working a few weeks ago