Category Security
angular-auth-oidc-client Release, an OpenID Implicit Flow client in Angular
I have been blogging and writing code for Angular and OpenID Connect since Nov 1, 2015. Now after all this time, I have decided to create my first npm package for Angular: angular-auth-oidc-client, which makes it easier to use the Angular Auth OpenID client. This is now available on npm. npm package: https://www.npmjs.com/package/angular-auth-oidc-client github code: […]
OpenID Connect Session Management using an Angular application and IdentityServer4
The article shows how the OpenID Connect Session Management can be implemented in an Angular application. The OpenID Connect Session Management 1.0 provides a way of monitoring the user session on the server using iframes. IdentityServer4 implements the server side of the specification. This does not monitor the lifecycle of the tokens used in the […]
Implementing a silent token renew in Angular for the OpenID Connect Implicit flow
This article shows how to implement a silent token renew in Angular using IdentityServer4 as the security token service server. The SPA Angular client implements the OpenID Connect Implicit Flow ‘id_token token’. When the id_token expires, the client requests new tokens from the server, so that the user does not need to authorise again. Code: […]
Anti-Forgery Validation with ASP.NET Core MVC and Angular
This article shows how API requests from an Angular SPA inside an ASP.NET Core MVC application can be protected against XSRF by adding an anti-forgery cookie. This is required, if using Angular, when using cookies to persist the auth token. Code: https://github.com/damienbod/AspNetCoreMvcAngular Blogs in this Series Using Angular in an ASP.NET Core View with Webpack […]
ASP.NET Core IdentityServer4 Resource Owner Password Flow with custom UserRepository
This article shows how a custom user store or repository can be used in IdentityServer4. This can be used for an existing user management system which doesn’t use Identity or request user data from a custom source. The Resource Owner Flow using refresh tokens is used to access the protected data on the resource server. […]
Implementing OpenID Code Flow with PKCE using OpenIddict and Angular
This article shows how to implement the OpenID Connect Code Flow with PKCE using OpenIddict hosted in an ASP.NET Core application, an ASP.NET Core Web API and an Angular application as the client. Code: https://github.com/damienbod/AspNetCoreOpeniddict 2021-12-24 Updated to ASP.NET Core 6, Angular 13 2020-12-26 Updated to ASP.NET Core 5, Angular 11, OpenIddict 3 2017-05-27 Updated […]
Extending Identity in IdentityServer4 to manage users in ASP.NET Core
This article shows how Identity can be extended and used together with IdentityServer4 to implement application specific requirements. The application allows users to register and can access the application for 7 days. After this, the user cannot log in. Any admin can activate or deactivate a user using a custom user management API. Extra properties […]
IdentityServer4, Web API and Angular in a single ASP.NET Core project
This article shows how IdentityServer4 with Identity, a data Web API, and an Angular SPA could be setup inside a single ASP.NET Core project. The application uses the OpenID Connect Implicit Flow with reference tokens to access the API. The Angular application uses webpack to build. Code: https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow History: 2019-09-20: Updated ASP.NET Core 3.0, Angular […]
Full Server logout with IdentityServer4 and OpenID Connect Implicit Flow
The article shows how to fully logout from IdentityServer4 using an OpenID Connect Implicit Flow. Per design when using an access token to use protected data from a resource server, even if the client has logged out from the server, the access token can be used so long it is valid (AccessTokenLifetime) as it is […]
Software Engineering 