Announcing Angular-Oauth2-Oidc, Version 2

Earlier today, I shipped a new major release of the angular-oauth2-oidc library, which brings token-based security to Angular apps through OAuth2/ OpenId Connect and JWTs.

This major bump introduces a handful of breaking changes, listed at the top of the updated readme. In my estimation, most projects won't be impacted, and even those that are should find the migration straightforward.

Silent Token Refresh

The most highly requested capability was Silent Refresh — a standards-compliant approach for renewing tokens during implicit flow, either just before or at the moment they would otherwise expire.

When the application has the right setup, kicking off a silent refresh is a single call:

this
    .oauthService
    .silentRefresh()
    .then(info => console.debug('refresh ok', info))
    .catch(err => console.error('refresh error', err));

With the new events observable in place, the app can listen in and trigger the refresh automatically as expiration approaches:

this
    .oauthService
    .events
    .filter(e => e.type == 'token_expires')
    .subscribe(e => {
        this.oauthService.silentRefresh();
    });

Full details can be found in the updated documentation.

Validating the signature of id_tokens

Signature verification for received id_tokens is now built directly into the library. Simply assign a ValidationHandler:

import { JwksValidationHandler } from 'angular-oauth2-oidc';

[...]

this.oauthService.tokenValidationHandler = new JwksValidationHandler();

In the example above, JwksValidationHandler relies on the jsrasign JavaScript library to perform validation entirely within the browser, eliminating the need for a round trip to the server.

If the default isn't suitable, you're free to implement this ValidationHandler interface yourself.

More Security Checks

A few extra safety measures were introduced. The library now enforces https connections, with localhost being the sole exception, and it validates the discovery document it receives.

Feedback

Whether you're already using it or just giving it a spin, I'd love to hear from you — leave a comment on the blog or open an issue on GitHub.