Promise AbstractStorageProvider

[jamesikanos]

I'm looking at creating a PWA so I'm using Refresh Tokens. I, therefore, desire to move away from the default SessionStorage implementation.

IndexedDB and the CacheStorage API (the current recommendations for storing data within PWA's) are only available as asynchronous promise-based APIs.

I would like the AbstractStorageProvider to implement promise-based methods for Read/Write. When being used with SessionStorage/LocalStorage these can simply be returned with empty promises, not affecting the existing implementations.

I've looked into use LocalStorage but this is no longer recommended. See here: https://dev.to/rdegges/please-stop-using-local-storage-1i04

Thank you

[damienbod]

@jamesikanos Thanks for reporting.

This is a good enhancement. We need this. @FabianGosebrink agree?

Greetings Damien

[Johnnyrook777]

This also allows using the cordova secure storage - https://github.com/pradeep1991singh/cordova-plugin-secure-key-store#readme

[FabianGosebrink]

We wanted to redo the storage support anyway so I think this might be a good enhancement.

[jeffreyabecker]

Do you have any design goals on this? My current work-around is more than a bit of a kludge and I'll take a swing at implementing it.

[philjones88]

Just echoing support. I wrote an async storage class using Capacitor (using Ionic so like OP, local storage for refresh tokens isn't great) and their Storage plugin (see https://capacitorjs.com/docs/apis/storage ).

Here's what I wrote. To try and give you an idea of how people might implement an async provider. I'll just have to await v12 :)

import { Injectable } from '@angular/core';
import { AbstractSecurityStorage } from 'angular-auth-oidc-client';
import { Plugins } from '@capacitor/core';

@Injectable()
export class CapacitorStorage implements AbstractSecurityStorage {
  public async read(key: string): Promise<any> {
    const result = await Plugins.Storage.get({ key });
    return JSON.parse(result.value);
  }

  public async write(key: string, value: any): Promise<boolean> {
    await Plugins.Storage.set({ key, value: JSON.stringify(value) });
    return true;
  }

  public async remove(key: string): Promise<boolean> {
    await Plugins.Storage.remove({ key });
    return true;
  }
}

[SSchwaiger]

Hello!

I'm trying to store the refresh token using "keytar" in an Electron app. keytar only offers an asynchronous interface so... is this feature part of V12 or is it deplyed?

[damienbod]

Hi @SSchwaiger this will not make it in V12. We want to release V12 soon, and don't have the capacity to support this. The session storage and the local storage are synchronous which is the 95% use case of the lib. So supporting both synchronous and asynchronous would require a large effort to implement.

We do plan this feature but have no timeline.

Greetings Damien

[marklagendijk]

I stumbled upon this and want to react to the claim that LocalStorage is 'not secure'.

I've looked into use LocalStorage but this is no longer recommended. See here: https://dev.to/rdegges/please-stop-using-local-storage-1i04

This article claims that LocalStorage is not secure, because if you are vulnerable to an XSS attack, the attacker could read the contents of the storage. This is true, however, that doesn't mean that LocalStorage should never be used for storing sessions. It means that you need to protect against XSS attacks, which you also should do if you don't store sensitive stuff in LocalStorage. If you comply with the following rules, you won't be easily vulnerable to an XSS attack:

• Use a proper Content-Security-Policy (without unsafe-* directive for the script-src). Don't use any external Javascript files, host them yourself.
• Don't support Internet Explorer, or if you must, only IE >= 10, and add the header under the name X-Content-Security-Policy
• Use Angular or an other SPA framework for developing the web app. With frameworks like Angular it is hard to introduce an XSS vulnerability.
• Run the web app on its own (sub-)domain. This way only the web app can access the sensitive data, and the web app is protected by 2 very strong layers of security.

Also see this comment on the article.

[trytuna]

+1 for this feature

[evancjohnson]

@FabianGosebrink, I hope all is well!

Thank you for contributing as much as you do to this library. I understand this a breaking change, I was wondering if any progress has been made on this? Is this something that I could help complete? I am working on an Ionic application, and I would love to be able to persist the token to the native platform's storage.

I know this would be a large API change, anything I can do to help. Is this ticket on the roadmap for V14? V15?

[FabianGosebrink]

Is this issue still relevant? Ionic only supports Promises?

[evancjohnson]

Is this issue still relevant? Ionic only supports Promises?

IMO, I think at least supporting an observable implementation make sense so custom storage developers can choose to go down the async route or observable.

[Spinnenzunge]

Yes still relevant. We would love to use the Module in our App but we are using an Async Storage solution that is Promise based.

[mariusbolik]

Would be nice if we could use Capacitor Preferences or Capacitior Secure Storage to store Access Token securely.