Tokens are not set immediately after redirect
See original GitHub issueHello,
I am using version 3.1.4 of this library.
My set-up is as follows:
after users enters his credentials on the identity server he is redirected to a protected resource.
My canActivate method looks as follows.
canActivate(): boolean {
const validIdToken = this.oauthService.hasValidIdToken;
const validAccessToken = this.oauthService.hasValidAccessToken();
return (validIdToken && validAccessToken);
}
However, at the time when canActivate() is called both tokens are not available immediately
(even though user is authenticated and they should be set).
canActivate() also returns false.
I can see they eventually arrive:
this.oauthService.events.subscribe(({ type } : OAuthEvent) => {
switch (type) {
case 'token_received':
const idToken = this.oauthService.getIdToken();
const accessToken = this.oauthService.getAccessToken();
if (accessToken && idToken) {
console.log(accessToken);
console.log(idToken);
}
}
});
Is there some way to prevent this - ensuring that they are already set when canActivate() is called?
Issue Analytics
- State:
- Created 6 years ago
- Reactions:2
- Comments:16 (5 by maintainers)
Top Results From Across the Web
Grabbing the OAuth Token From URL After Redirect URI ...
Any idea how can I achieve the same with useHash set to true since keycloak doesn't allow # in the redirect_uri? – Junaid....
Read more >OAuth redirect after getting access token - the Tyk community
I am not speaking about redirect to login page that is working fine. I am talking about after reaching login, then getting authorisation...
Read more >Redirect URL Validation - OAuth 2.0 Simplified
If the redirect URL is not one of the registered redirect URLs, then the server must immediately show an error indicating such, and...
Read more >Stealing OAuth Tokens With Open Redirects - Okta Security
For example, if you are logged into “facebook.com”, you won't have to ... Some sites will redirect to the Referer automatically after ......
Read more >Redirect Users - Auth0
Describes how to redirect users to URLs that have not been added to the AllowList. ... your application after validating their ID Tokens...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@Razzeee In my app, on routing i use CanActivate - which secure access to component before you are not login ( You are not logged - component cannot be load, first login bro!)
My app.component.ts
Routing:
And finally guard
you’ll need to resolve the above event that you demonstrate subscribing to within your guard because you must wait for the discovery document to load, which is async. canActivate can accept a promise return, or better yet an Observable<boolean>. One option might be to use the OAuthService.TryLogin() which returns a promise, something like:
*The above is pseudo-code, your implementation will most likely vary. HTH