Announcing angular-oauth2-oidc, Version 2

Today, I've released a new version of the angular library angular-oauth2-oidc, which allows for implementing token-based Security using OAuth2/ OpenId Connect and JWTs with Angular.

This new major version comes with some breaking changes. You find a list at the beginning of the updated readme. I think they won't affect everyone and even when you are affected you should be able to deal with them quite quickly.

Silent Token Refresh

Silent Refresh was the most requested feature for this library. It is a standard compliant way to refresh your tokens when/ before they expire using implicit flow.

If the application is prepared for it, performing a silent refresh is as easy as this:

this
    .oauthService
    .silentRefresh()
    .then(info => console.debug('refresh ok', info))
    .catch(err => console.error('refresh error', err));

By leveraging the new events observable, an application can automatically perform such a refresh when/ sometime before the current tokens expire:

this
    .oauthService
    .events
    .filter(e => e.type == 'token_expires')
    .subscribe(e => {
        this.oauthService.silentRefresh();
    });

More information about this can be found within the updated readme.

Validating the signature of id_tokens

The library can now directly validate the signature of received id_tokens. For this, just assign a ValidationHandler:

import { JwksValidationHandler } from 'angular-oauth2-oidc';

[...]

this.oauthService.tokenValidationHandler = new JwksValidationHandler();

The JwksValidationHandler shown here uses the JavaScript library jsrasign to validate the signature directly in the browser without the need to call the server.

You can also hook in an own ValidationHandler by implementing an interface.

More Security Checks

Some additional security checks have been added. The library insists on using https now and only makes an exception for localhost. It also validates the received discovery document.

Feedback

If you are using it or if you are trying it out, don't hesitate to send me some feedback -- either directly via my blog or via GitHub.

 

 
Sie wollen mehr zum Thema Announcing angular-oauth2-oidc, Version 2 wissen? Hier können Sie eine Anfrage für eine unverbindliche Schulung ode Beratung bzw. einen Workshop erstellen.
 
Unverbindliche Anfrage
 
 

Schulung und Beratung

Angular

Datenbindung, Formulare, Validierung, Routing, HTTP, Komponenten, ...

Details

Angular: Advanced

Erweiterte Aspekte von Angular

Details

Reaktive Architekturen mit Angular und Redux

Dieses interaktive Seminar vermittelt, wie Sie reaktive Anwendungen mit Angular entwickeln können.

Details

Migration von AngularJS 1.x auf Angular (2+)

Bestehende Projekte auf Angular 2 migrieren, ngUpgrade, ...

Details

Angular Review

Feedback und klärung offener Fragen, weiterführende Themen

Details

Angular Workshop

Start ohne Umwege

Details

Weitere Schulungen ...