add iframe attribute sandbox to allow access to local storage

[pamapa]

Closes/fixes #1735

Checklist

• This PR makes changes to the public API
• I have included links for closing relevant issue numbers

[pamapa]

@deanmaster Does this make it work for you?

[pamapa]

@thejurassic Does this fix your signin popup too?

[deanmaster]

hi @pamapa, the iframe setting is enough, but in order to make it works we need to be able to set the place holder iframe (asking Storage Access API) before the actual silent renew url called (in the same iframe). I believe the Iframe need and ID as well for easier access.

[pamapa]

@deanmaster Thanks for clarification. I will try to put something together of your patch you posted within #1735. My company recently switched to Entra ID and this IDP works with a refresh token and trusted device concept, thus i can no longer test this code path myself...

[deanmaster]

thank you @pamapa the idea of using Refresh Token and trusted device is a good idea. But I don't know how scale it could be, with a wide range of users across the world how do we do trusted device implement ? Could you point me to specification ?

[pamapa]

thank you @pamapa the idea of using Refresh Token and trusted device is a good idea. But I don't know how scale it could be, with a wide range of users across the world how do we do trusted device implement ? Could you point me to specification ?

Trusted device is a concept implemented on the server side (IdP), i am not aware of a specification. When you search the internet for "trusted device" you can find some documentations from most IdPs...

[deanmaster]

thank you @pamapa the idea of using Refresh Token and trusted device is a good idea. But I don't know how scale it could be, with a wide range of users across the world how do we do trusted device implement ? Could you point me to specification ?

Trusted device is a concept implemented on the server side (IdP), i am not aware of a specification. When you search the internet for "trusted device" you can find some documentations from most IdPs...

Thank you, I need to evaluate the Refresh Token flow if it's "safe" to use due to long expired time of it. Do you have best practice to implement renew based on Refresh Token (ideally specification) ? Is this what you're using https://github.com/authts/oidc-client-ts/blob/main/docs/protocols/refresh-token-grant.md I need to discuss with our security expert.

[pamapa]

thank you @pamapa the idea of using Refresh Token and trusted device is a good idea. But I don't know how scale it could be, with a wide range of users across the world how do we do trusted device implement ? Could you point me to specification ?

Trusted device is a concept implemented on the server side (IdP), i am not aware of a specification. When you search the internet for "trusted device" you can find some documentations from most IdPs...

Thank you, I need to evaluate the Refresh Token flow if it's "safe" to use due to long expired time of it. Do you have best practice to implement renew based on Refresh Token (ideally specification) ? Is this what you're using https://github.com/authts/oidc-client-ts/blob/main/docs/protocols/refresh-token-grant.md I need to discuss with our security expert.

yes, in this library there is a switch in signinSilent. See https://github.com/authts/oidc-client-ts/blob/main/src/UserManager.ts#L302-L357