Proposal: Setting to disable IFrame silent sign in?

[mcrio]

Hi,

Do you think it'll make sense to add a UserManager setting that disables the IFrame silent sign in, and allows just for refresh token renew when it exists?

Use case: Applications with multi-account support where we must not use IFrame.

It seems like it must be part of UserManagerSettings as signinSilent might be called from other places like the SilentRenewService.

[pamapa]

You can check for user?.refresh_token before calling signinSilent. The main question is what to do within the library when it is not possible to do a refresh (no refresh token and iframe not allowed), the only thing in the library would be to throw an exception...

[mcrio]

You can check for user?.refresh_token before calling signinSilent

Issue with that are processes like the SilentRenewService that just call signinSilent().

Currently there is a check in signinSilent() for an existing silent_redirect_uri:

const url = this.settings.silent_redirect_uri;
if (!url) {
    logger.throw(new Error("No silent_redirect_uri configured"));
}

This check should be sufficient, but it may be cleaner if we have a setting that explicitly disabled the IFrame.

The main question is what to do within the library when it is not possible to do a refresh (no refresh token and iframe not allowed), the only thing in the library would be to throw an exception.

I guess so as if we explicitly disable the IFrame we expect to always have a refresh token when calling signinSilent().

Anyway, I am just exploring an idea, and I'm definitely interested in the opinion of people more familiar with this library.

[mcrio]

As I see it the only way to disable IFrame would be to not set silent_redirect_uri.

But when silent_redirect_uri is set to undefined the library by default sets it to the value of redirect_uri which might be misleading to the consumer, so it has to be set to ''.

The way I see it, we could add a new setting to UserManagerSettings called signInSilentMethod: ('refresh-token' | 'iframe')[] = ['refresh-token', 'iframe'].
In the user manager we'd throw if there is no method set, otherwise we'd keep everything as is, return User | null.
The name signinSilentMethod is to keep it related to the signinSilent method used by the consumer or internally by SilentRenewService.

[pamapa]

Use case: Applications with multi-account support where we must not use IFrame.

Can you simply check if user?.refresh_token exists, if not do not call signinSilent at all?