Angular 7 - Auth0 - parseHash response null

1
votes

Auth0 issue.

My application is re-triggering the login event after sign-out on browser refresh and having issues with user profile. I tracked it down to parseHash in the authentication service:

  this.auth0.parseHash({ hash: window.location.hash }, (err, authResult) => {
  ...
  }

which is fired with the ngrx effect:

  @Effect()
  init$ = defer(() => {
    const userData = localStorage.getItem("user");

    if (userData != null && userData != 'undefined') {
       let authActionObservable = of(new Login({user: JSON.parse(userData)}));
       this.authService.handleAuthentication();
       return authActionObservable;
    }
    this.authService.handleAuthentication();
  });

It seems this.auth0.parseHash is returning null for both authResult and err after page refresh but on initial login authResult is populated correctly.

Technically the login is successful and I get the tokens. I checked the whole configuration, domain etc and everything seems fine. I also tried playing around with { hash: window.location.hash }.

2
angulartypescriptauthenticationauth0

2 Answers

2
votes

The problem was the fact the state of the in-memory variables containing the tokens on the service was reset on each page refresh. Once I re-initialized the values in the constructor of the service, the issue went away.

Here example with localStorage for what I mean:

  constructor(public router: Router, private store: Store<State>, private http: HttpClient) {
    this._idToken = localStorage.getItem("Auth0IdToken");
    this._accessToken = localStorage.getItem("Auth0AccessToken");
    this._expiresAt = parseInt(localStorage.getItem("Auth0ExpiresAt"));
  }
1
votes

Often times I've seen HAR files get captured to help narrow down exactly what is happening during the logout workflow. Without seeing that exactly there are a couple things I could suggest taking a look at.

  1. Review the Logout Documentation
  2. Check out this Doc on how to handle Redirects after logout and evaluate how you are handling logouts.
  3. You need to make sure you are passing the client_id parameter to the logout endpoint along with setting the Allowed Logout URL at the client level.

Now I could be wrong at the core of what's going on here but off the cuff that's a good fundamental place to start. Thanks!