Silent Refresh not working after Google Chrome updated to Version 85

1.1k views Asked by At

I am using angular-oidc-auth2 v9.0.3 to request token renewal by silent refresh. I am using implicit flow. it was working good until google chrome updated version to 85. I have observed the request and found that Google chrome used to have Referrer Policy: no-referrer-when-downgrade before and all was good. then from version 85 they have defaulted to Referrer Policy: strict-origin-when-cross-origin. and after that it started failing the token refresh. For security reason I cannot share the code however our identity server is in the different domain than application. Is there anyway I can set header for referrer policy Silent refresh request? Or any other way it can be resolved?

2

There are 2 answers

2
user2489234 On

Sorry https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default says that you need to only refer to your own site in a script.

You will need to write a proxy script in the form...

0
user1898171 On

I got my solution and its not Implicit flow. Required PKCE + Code flow and works perfectly. Implicit flow is dead bow or will be dead soon