'Does MSAL.js support the check_session_iframe OIDC endpoint?

I'm working on an SPA which depends on an instance of Identity Server for authenticating users. I need a solution that manages my tokens locally, but Duende (the owners of Identity Server) lean towards a Backend For Frontend (BFF) pattern over Javascript libraries. This isn't going to work for us. Since the original oidc-client that was written by the authors of Identity Server is no longer maintained I've been looking at Javascript alternatives. The most likely candidate would seem to be Microsoft's MSAL.js which is built for Azure AD, but supposedly supports OIDC standards.

From what I can tell, MSAL.js forces you down an offline_access path using refresh tokens to renew security tokens. Even if I don't expressly require an offline_access scope the library appends one anyway! But my use case doesn't require refresh tokens. Instead I want my client to keep the session on the identity provider fresh using OIDC session mamnagement standards (via the check_session_iframe endpoint exposed by the provider's well-known JSON).

I have found that if I ignore the offline_access scope requested by the MSAL.js library so my identity provider only issues and ID token and an access token then MSAL continues to work just fine. It even has an ssoSilent option for explicitly renewing the tokens via a connect/authorize request in a hidden iframe. But as far as I can tell I can't have the library keeping that session fresh via an iframe like the old oidc-client used to.

So given that session management is part of the OIDC specification, and MSAL is supposed to be an OIDC-compliant library, am I missing something here?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source