Skip to content

Commit 5925f4e

Browse files
manfredsteyermanfredsteyer
committed
chore: merge
2 parents 65f8a2b + 96df840 commit 5925f4e

37 files changed

+1560
-488
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Support for OAuth 2 and OpenId Connect (OIDC) in Angular. Already prepared for t
66

77
## Credits
88

9-
- [jsrasign](https://kjur.github.io/jsrsasign/) for validating token signature and for hashing
9+
- [jsrsasign](https://kjur.github.io/jsrsasign/) for validating token signature and for hashing
1010
- [Identity Server](https://github.com/identityserver) for testing with an .NET/.NET Core Backend
1111
- [Keycloak (Redhat)](http://www.keycloak.org/) for testing with Java
1212
- [Auth0](https://auth0.com/)

‎docs-src/authsvr-auth0.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ This should work as shown in the other examples in this documentation and in the
4141

4242
## Logging out
4343

44-
Auth0's logout endpoint expects the parameters ``client_id and ``returnTo``:
44+
Auth0's logout endpoint expects the parameters ``client_id`` and ``returnTo``:
4545

4646
```typescript
4747
this.oauthService.revokeTokenAndLogout({
@@ -54,4 +54,4 @@ The optional 2nd parameter set to ``true`` ignores CORS issues with the logout e
5454

5555
## Example
5656

57-
Please find a [demo](https://github.com/manfredsteyer/auth0-demo) for using Auth0 with angular-oauth2-oidc [here](https://github.com/manfredsteyer/auth0-demo).
57+
Please find a [demo](https://github.com/manfredsteyer/auth0-demo) for using Auth0 with angular-oauth2-oidc [here](https://github.com/manfredsteyer/auth0-demo).

‎docs-src/custom-date-time-provider.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Custom DateTimeProvider
2+
3+
If your Identity Provider's clock is not synchronized, the validation of the token could fail.
4+
If the deviation is only some seconds, you can use the `AuthConfig.clockSkewInSec` setting to allow a bigger time window deviation.
5+
6+
However, you may need to adjust the base time, that is used for the token validation and make sure, that the `AuthConfig.clockSkewInSec` is still a small reasonable number, then you can implement a custom `DateTimeProvider`.
7+
8+
To do so, create a new service that derives from `DateTimeProvider`:
9+
10+
```typescript
11+
export class MyCustomDateTimeProvider extends DateTimeProvider {
12+
now(): number {
13+
// Return your custom now.
14+
return Date.now();
15+
}
16+
17+
new(): Date {
18+
// Return your custom new Date().
19+
return new Date();
20+
}
21+
}
22+
```
23+
24+
Then, override the provider via dependency injection in your application:
25+
26+
```typescript
27+
@NgModule({
28+
imports: [
29+
// etc.
30+
OAuthModule.forRoot()
31+
],
32+
providers: [
33+
{ provide: DateTimeProvider, useClass: MyCustomDateTimeProvider } // <- add this
34+
],
35+
declarations: [
36+
AppComponent,
37+
// etc.
38+
],
39+
bootstrap: [
40+
AppComponent
41+
]
42+
})
43+
export class AppModule {
44+
}
45+
```

‎docs-src/silent-refresh.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,6 @@ This simple implementation within silent-refresh.html is sufficient in most case
6767
var checks = [/[\?|&|#]code=/, /[\?|&|#]error=/, /[\?|&|#]token=/, /[\?|&|#]id_token=/];
6868
6969
function isResponse(str) {
70-
var count = 0;
7170
if (!str) return false;
7271
for(var i=0; i<checks.length; i++) {
7372
if (str.match(checks[i])) return true;
@@ -77,12 +76,24 @@ This simple implementation within silent-refresh.html is sufficient in most case
7776
7877
var message = isResponse(location.hash) ? location.hash : '#' + location.search;
7978
80-
(window.opener || window.parent).postMessage(message, location.origin);
79+
if (window.parent && window.parent !== window) {
80+
// if loaded as an iframe during silent refresh
81+
window.parent.postMessage(message, location.origin);
82+
} else if (window.opener && window.opener !== window) {
83+
// if loaded as a popup during initial login
84+
window.opener.postMessage(message, location.origin);
85+
} else {
86+
// last resort for a popup which has been through redirects and can't use window.opener
87+
localStorage.setItem('auth_hash', message);
88+
localStorage.removeItem('auth_hash');
89+
}
8190
</script>
8291
</body>
8392
</html>
8493
```
94+
The above example checks if the message in the URL (either hash or query string) is indeed a message returned with a response from an authentication provider and not an arbitrary value and then attempts to forward this message to a parent widow either by `.parent` (when this html is loaded in an iframe as a result of silent refresh) or by `.opener` (when the html is loaded into a popup during initial login) or finally using a storage event (as a fallback for complex cases, e.g. initial login in a popup with a cross-domain auth provider).
8595

96+
8697
Please make sure that this file is copied to your output directory by your build task. When using the CLI you can define it as an asset for this. For this, you have to add the following line to the file ``.angular-cli.json``:
8798

8899
```JSON

‎docs-src/token-refresh.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
When using code flow, you can get an ``refresh_token``. While the original standard DOES NOT allow this for SPAs, the mentioned [OAuth 2.0 Security Best Current Practice](https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13) document proposes to ease this limitation. However, it specifies a list of requirements one should take care about before using ``refresh_tokens``. Please make sure you respect those requirements.
44

5-
Please also note, that you have to request the ``offline_access`` scope to get an refresh token.
5+
Please also note, that you have to request the ``offline_access`` scope to get a refresh token.
66

77
To refresh your token, just call the ``refreshToken`` method:
88

‎docs/additional-documentation/custom-datetimeprovider.html‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
<!doctype html>
2+
<html class="no-js" lang="">
3+
<head>
4+
<meta charset="utf-8">
5+
<meta http-equiv="x-ua-compatible" content="ie=edge">
6+
<title>angular-oauth2-oidc</title>
7+
<meta name="description" content="">
8+
<meta name="viewport" content="width=device-width, initial-scale=1">
9+
10+
<link rel="icon" type="image/x-icon" href="../images/favicon.ico">
11+
<link rel="stylesheet" href="../styles/style.css">
12+
</head>
13+
<body>
14+
15+
<div class="navbar navbar-default navbar-fixed-top visible-xs">
16+
<a href="../" class="navbar-brand">angular-oauth2-oidc</a>
17+
<button type="button" class="btn btn-default btn-menu ion-ios-menu" id="btn-menu"></button>
18+
</div>
19+
20+
<div class="xs-menu menu" id="mobile-menu">
21+
<div id="book-search-input" role="search"><input type="text" placeholder="Type to search"></div> <compodoc-menu></compodoc-menu>
22+
</div>
23+
24+
<div class="container-fluid main">
25+
<div class="row main">
26+
<div class="hidden-xs menu">
27+
<compodoc-menu mode="normal"></compodoc-menu>
28+
</div>
29+
<!-- START CONTENT -->
30+
<div class="content additional-page">
31+
<div class="content-data">
32+
33+
34+
35+
36+
37+
38+
39+
40+
41+
42+
43+
44+
45+
46+
47+
48+
49+
50+
51+
<h1 id="custom-datetimeprovider">Custom DateTimeProvider</h1>
52+
<p>If your Identity Provider&#39;s clock is not synchronized, the validation of the token could fail.
53+
If the deviation is only some seconds, you can use the <code>AuthConfig.clockSkewInSec</code> setting to allow a bigger time window deviation.</p>
54+
<p>However, you may need to adjust the base time, that is used for the token validation and make sure, that the <code>AuthConfig.clockSkewInSec</code> is still a small reasonable number, then you can implement a custom <code>DateTimeProvider</code>.</p>
55+
<p>To do so, create a new service that derives from <code>DateTimeProvider</code>:</p>
56+
<div><pre class="line-numbers"><code class="language-typescript">export class MyCustomDateTimeProvider extends DateTimeProvider {
57+
now(): number {
58+
// Return your custom now.
59+
return Date.now();
60+
}
61+
62+
new(): Date {
63+
// Return your custom new Date().
64+
return new Date();
65+
}
66+
}</code></pre></div><p>Then, override the provider via dependency injection in your application:</p>
67+
<div><pre class="line-numbers"><code class="language-typescript">&#64;NgModule({
68+
imports: [
69+
// etc.
70+
OAuthModule.forRoot()
71+
],
72+
providers: [
73+
{ provide: DateTimeProvider, useClass: MyCustomDateTimeProvider } // &lt;- add this
74+
],
75+
declarations: [
76+
AppComponent,
77+
// etc.
78+
],
79+
bootstrap: [
80+
AppComponent
81+
]
82+
})
83+
export class AppModule {
84+
}</code></pre></div>
85+
</div><div class="search-results">
86+
<div class="has-results">
87+
<h1 class="search-results-title"><span class='search-results-count'></span> result-matching "<span class='search-query'></span>"</h1>
88+
<ul class="search-results-list"></ul>
89+
</div>
90+
<div class="no-results">
91+
<h1 class="search-results-title">No results matching "<span class='search-query'></span>"</h1>
92+
</div>
93+
</div>
94+
</div>
95+
<!-- END CONTENT -->
96+
</div>
97+
</div>
98+
99+
<script>
100+
var COMPODOC_CURRENT_PAGE_DEPTH = 1;
101+
var COMPODOC_CURRENT_PAGE_CONTEXT = 'additional-page';
102+
var COMPODOC_CURRENT_PAGE_URL = 'custom-datetimeprovider.html';
103+
var MAX_SEARCH_RESULTS = 15;
104+
</script>
105+
106+
<script src="../js/libs/custom-elements.min.js"></script>
107+
<script src="../js/libs/lit-html.js"></script>
108+
<!-- Required to polyfill modern browsers as code is ES5 for IE... -->
109+
<script src="../js/libs/custom-elements-es5-adapter.js" charset="utf-8" defer></script>
110+
<script src="../js/menu-wc.js" defer></script>
111+
112+
<script src="../js/libs/bootstrap-native.js"></script>
113+
114+
<script src="../js/libs/es6-shim.min.js"></script>
115+
<script src="../js/libs/EventDispatcher.js"></script>
116+
<script src="../js/libs/promise.min.js"></script>
117+
<script src="../js/libs/zepto.min.js"></script>
118+
119+
<script src="../js/compodoc.js"></script>
120+
121+
<script src="../js/tabs.js"></script>
122+
<script src="../js/menu.js"></script>
123+
<script src="../js/libs/clipboard.min.js"></script>
124+
<script src="../js/libs/prism.js"></script>
125+
<script src="../js/sourceCode.js"></script>
126+
<script src="../js/search/search.js"></script>
127+
<script src="../js/search/lunr.min.js"></script>
128+
<script src="../js/search/search-lunr.js"></script>
129+
<script src="../js/search/search_index.js"></script>
130+
<script src="../js/lazy-load-graphs.js"></script>
131+
132+
133+
</body>
134+
</html>

‎docs/additional-documentation/silent-refresh.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949

5050

5151
<h2 id="refreshing-when-using-implicit-flow-implicit-flow-and-code-flow">Refreshing when using Implicit Flow (Implicit Flow and Code Flow)</h2>
52-
<p><strong>Notes for Code Flow</strong>: You can also use this strategy for refreshing tokens when using code flow. However, please note, the strategy described within <a href="./token-refresh.md">Token Refresh</a> is far easier in this case.</p>
52+
<p><strong>Notes for Code Flow</strong>: You can also use this strategy for refreshing tokens when using code flow. However, please note, the strategy described within <a href="./refreshing-a-token.html">Token Refresh</a> is far easier in this case.</p>
5353
<p>To refresh your tokens when using implicit flow you can use a silent refresh. This is a well-known solution that compensates the fact that implicit flow does not allow for issuing a refresh token. It uses a hidden iframe to get another token from the auth server. When the user is there still logged in (by using a cookie) it will respond without user interaction and provide new tokens.</p>
5454
<p>To use this approach, setup a redirect uri for the silent refresh.</p>
5555
<p>For this, you can set the property silentRefreshRedirectUri in the config object:</p>

‎docs/classes/AuthConfig.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -596,7 +596,7 @@ <h3 id="inputs">
596596
<div class="io-description"><p>This property has been introduced to disable at_hash checks
597597
and is indented for Identity Provider that does not deliver
598598
an at_hash EVEN THOUGH its recommended by the OIDC specs.
599-
Of course, when disabling these checks the we are bypassing
599+
Of course, when disabling these checks then we are bypassing
600600
a security check which means we are more vulnerable.</p>
601601
</div>
602602
</td>
@@ -2313,7 +2313,7 @@ <h3 id="inputs">
23132313
* This property has been introduced to disable at_hash checks
23142314
* and is indented for Identity Provider that does not deliver
23152315
* an at_hash EVEN THOUGH its recommended by the OIDC specs.
2316-
* Of course, when disabling these checks the we are bypassing
2316+
* Of course, when disabling these checks then we are bypassing
23172317
* a security check which means we are more vulnerable.
23182318
*/
23192319
public disableAtHashCheck? &#x3D; false;

0 commit comments

Comments
 (0)