Make `silentRefresh()` trap incorrect `silentRefreshRedirectUri` configuration values

EDIT: Please read on below this original post, the actual issue (and associated title) was changed slightly.

Original post:

---

Describe the bug

I’m using silentRefresh() more or less as in the tutorial Angular 6 with Auth0 using this library linked from the README, but with a code flow.

When the user is not logged in, the iframe generates a login_required error that the service catches tryLoginCodeFlow() here, but that does not cause the Promise returned from silentRefresh() to trigger the catch() clause. Instead, we wait until we get a timeout.

Expected behavior

the “login_required” error should cause the promise to reach the catch() handler.

Desktop (please complete the following information):

• OS: Linux
• Browser: Chrome
• Version: 85

[guss77]

2. `silentRefreshRedirectUri` is `""`: the silentRefresh assumes the user explicitly wanted the redirect uri to be the application's root

Sounds reasonable, except maybe I would suggest using false for the “stop bothering me, I know what I’m doing” magic value. The test code can then be something like:

if (!this.silentRefreshRedirectUri && this.silentRefreshRedirectUri !== false) throw new Error(...);

It’s a bit more explicit and readable than checking against an almost invisible '', IMHO.

[jeroenheijmans]

I mistakenly thought that the config setting was a path on the serving site, but it is a full URI anyways. So an empty string is indeed weird and probably a configuration mistake. 👍