Angular client: After successful login, backend is flooded with token refresh requests

[lgadola]

ABP 5.1.2
Angular
EF Core

Hi guys,

I have created an Angular frontend with "abp new" and added Ionic to it.
Added a login dialog and changed authentication to Resource Owner Password Flow.
Login with AuthenticationService.login() is successful and ID token is received.
But then the frontend goes into an indefinite loop, flooding the backend with /connect/token requests to get refresh tokens.
I have not found out, why this happens. The same behaviour is shown when changing back to Authorization Code Flow.

I created a repository where the behaviour can easily be reproduced.

Extract from the server log:

Thanks for your help!

[yinchang0626]

@lgadola hi
try to downgrade rxjs :
"rxjs": "~6.6.0"

It work for me

[EngincanV]

We use the angular-oauth2-oidc package for authentication. This problem is related to that package, as @yinchang0626 mentioned downgrading the package to v6 can fix your problem.

[lgadola]

Thanks guys!
That works.

[islam-b]

angular-oauth2-oidc package uses rxjs operator delay to set the token expiration timer which is used to trigger the expiration event :

of(new OAuthInfoEvent('token_expires', 'access_token') )
        .pipe(delay(timeout))
        .subscribe((e) => {
           //...
       })

The issue occurs in the delay operator, it takes a max number value 2147483647 (as milliseconds), so when setting the access token lifetime (as seconds) big enough it will reach the limit and causes the unexpected behavior, (ReactiveX/rxjs#3015),

The max token lifetime that you can set is : 2863311,52 seconds (approximatively 1 month)

Explanation:

• 2863311,52(s) * 1000 * 0.75 = 2 147 483 647 (which is the max value that can be with delay operator)
• 0.75 is a timeut factor used by angular-oauth2-oidc package, the default value 0.75, the expiration is triggered after 75% of the token's life time (see https://manfredsteyer.github.io/angular-oauth2-oidc/docs/classes/AuthConfig.html#timeoutFactor)

[f-belhocine]

Many thanks for the detailed explanation.