{"action":"created","issue":{"url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/429","repository_url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc","labels_url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/429/labels{/name}","comments_url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/429/comments","events_url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/429/events","html_url":"https://github.com/manfredsteyer/angular-oauth2-oidc/issues/429","id":361746332,"node_id":"MDU6SXNzdWUzNjE3NDYzMzI=","number":429,"title":"Library not handling 401 error response?","user":{"login":"michaelbazos","id":4216141,"node_id":"MDQ6VXNlcjQyMTYxNDE=","avatar_url":"https://avatars2.githubusercontent.com/u/4216141?v=4","gravatar_id":"","url":"https://api.github.com/users/michaelbazos","html_url":"https://github.com/michaelbazos","followers_url":"https://api.github.com/users/michaelbazos/followers","following_url":"https://api.github.com/users/michaelbazos/following{/other_user}","gists_url":"https://api.github.com/users/michaelbazos/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelbazos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelbazos/subscriptions","organizations_url":"https://api.github.com/users/michaelbazos/orgs","repos_url":"https://api.github.com/users/michaelbazos/repos","events_url":"https://api.github.com/users/michaelbazos/events{/privacy}","received_events_url":"https://api.github.com/users/michaelbazos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-09-19T13:20:57Z","updated_at":"2018-09-19T15:53:43Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nI was reading the [part related to interceptors](https://manfredsteyer.github.io/angular-oauth2-oidc/docs/additional-documentation/working-with-httpinterceptors.html) in the documentation, which states:\r\n\r\n> Since 3.1 the library uses a default HttpInterceptor that takes care about transmitting the access_token to the resource server and about error handling for security related errors (HTTP status codes 401 and 403) received from the resource server.\r\n\r\nReading at the library code version 4+ (4.0.2 to be precise), I can see that the `Authorization` header is sent, providing that the flag `sendAccessToken` is set, however I don't see any handling of the \"401 Unauthorized\" http response.\r\n\r\nCan anyone shed some light? Maybe I'm missing something?"},"comment":{"url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/comments/422856616","html_url":"https://github.com/manfredsteyer/angular-oauth2-oidc/issues/429#issuecomment-422856616","issue_url":"https://api.github.com/repos/manfredsteyer/angular-oauth2-oidc/issues/429","id":422856616,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMjg1NjYxNg==","user":{"login":"jeroenheijmans","id":1590536,"node_id":"MDQ6VXNlcjE1OTA1MzY=","avatar_url":"https://avatars1.githubusercontent.com/u/1590536?v=4","gravatar_id":"","url":"https://api.github.com/users/jeroenheijmans","html_url":"https://github.com/jeroenheijmans","followers_url":"https://api.github.com/users/jeroenheijmans/followers","following_url":"https://api.github.com/users/jeroenheijmans/following{/other_user}","gists_url":"https://api.github.com/users/jeroenheijmans/gists{/gist_id}","starred_url":"https://api.github.com/users/jeroenheijmans/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeroenheijmans/subscriptions","organizations_url":"https://api.github.com/users/jeroenheijmans/orgs","repos_url":"https://api.github.com/users/jeroenheijmans/repos","events_url":"https://api.github.com/users/jeroenheijmans/events{/privacy}","received_events_url":"https://api.github.com/users/jeroenheijmans/received_events","type":"User","site_admin":false},"created_at":"2018-09-19T15:53:43Z","updated_at":"2018-09-19T15:53:43Z","author_association":"NONE","body":"Hah, good points. I clarified the other issue as well.\r\n\r\nThe retries mentioned there are secondary, the actual important thing is logging the user in (silently, if possible). Same as your intention, I still think? It's just that you seem to prefer what I called \"Option 4\", making the login upon 401/403 (and retry if the login was done silently), whereas I think it's an application concern and thus lean to \"Option 1\".\r\n\r\nIn any case, I would agree that the current documentation you quoted is not appropriate. Possibly the original author intended to suggest that 401s/403s are \"prevented\" by the default interceptor provided by the library, which _is_ the case.\r\n\r\nSo in any case, I'm all for changing that bit of documentation to match current library behavior.\r\n\r\nI'm not so sure if I'm fore \"Option 4\" / having the library redirec on 401s (certainly not _by default_), since those flows can vary greatly between applications."}}
{"actor":{"display_login":"jeroenheijmans"}}