Login via pop-up window

[fernandomg]

In the project we're working on, we leave all the auth flow to the SDK.

Occasionally, the session is lost or expired and needs to re-connect.

It would be cool if the SDK provided a solution to handle the log in via a popup window, so we don't leave the site and don't need to handle all the state persistence/rehydration.

Something around: https://github.com/authts/oidc-client-ts/blob/94c3bdc/src/UserManager.ts#L270

Is it possible? Or may it cause potential security issues?

[einaralex]

Hey! Great idea, I have made a few attempts at this with our current setup, but I suspect it needs some work in our backend as well.
To open the authflow, we call an endpoint in our API that returns a temporary redirect.
When the redirect happens within the popup, that window gets 'window.closed === true' and loses the connection with the origin/parent window so that no messages can be posted between them.

We will get to this at some point; we want to separate the KYC flow and make this auth flow better.