sessionCheckEventListener logs wrong origin whenever changed is detected

[ggjersund]

I've tried following the advice given in #283 #257 however I still can't seem to solve the issues.

The local setup I am running is an Open ID Connect Provider written in Django at http://127.0.0.1:8000/openid/. Angular is served at http://localhost:4200.

The following error is what I get in the console:

Also a more detailed overview

So my question is simply, is there a way to fix this wrong origin problem?

[manfredsteyer]

Thanks for this. Can you compare you example with the demo application? There is effect does not occur. What's different there?

[ggjersund]

@manfredsteyer My own Angular application is requesting a different response_type than the sample one. My application is requesting id_token token and the sample application is requesting token. The problem is that only token is not valid for my own backend. So where is this configured? I'm currently using the exact same config.

[ggjersund]

Possibly related to the newest update in #397?

This is what my provider returns from discovery document:

Yet, the response_type used is token.

[manfredsteyer]

It must be sth different. The client is also using id_token token. However, it's set dynamically at runtime b/c the user can control with the checkbox wether to go with id_token or id_token token.

[ggjersund]

@manfredsteyer If you'd like to test what I mean you can try the demo application I created here. There seems to be a problem running in on stackblitz, so I suggest downloading and running it locally.

[manfredsteyer]

If the origin is not the right one, it's likely we received a different message which is not about token refresh (e. g. silent refresh or something different going on in the SPA). Hence, you can ignore this debug info.

We can solve this by also sending and checking a message-type. Currently, we first check the origin and than try to make sense of the received playload.

With version 9.1 - which lands quite soon - session checks will also work with code flow. Please have a look to the docs when it lands.