Incorrect authentication request caused when page is refreshed whilst silent-renew is happening or after it has failed.

Describe the bug If the page is refreshed whilst a silent renew is happening (or fails) then the wrong combination of parameters are sent to the authentication server, causing an error.

To Reproduce

• Disable the silent-renew functionality in the silent-renew.html file.
• Wait for silent renew to trigger
• Refresh the browser

Notice that in devtools, the request contains parameters for the silent renew still (including the redirect url) - this causes our authentication server (IDS4) to return a HTTP 400 error. It writes a log message indicating it was expecting this auth request to redirect back to our normal auth complete endpoint, not silent-renew.html

Expected behavior No error, correct redirect url supplied.

Possible solution It seems to me that the cause of this bug is that the storageSilentRenewRunning object is stored in sessionStorage (via the storage service). If this were in memory it wouldn’t round-trip during the refresh and be accidentally picked up.

I have verified this logic in a work around by always clearing this object from sessionStorage when the app is initialized

[chad-smith]

Would it be possible to update to version 12?

Hi Damien. I’m deep in the middle of some other work at the moment, but I will update and test as soon as I get a chance - might be a couple of weeks though.

Thanks for the update and your continued work on the library 👍

[damienbod]

Closing this as Angular is now V13