Session is not restored properly inside of an iframe

Search terms you've used

iframe

Impacted package

Which packages do you think might be impacted by the bug ?

• solid-client-authn-browser
• solid-client-authn-node
• solid-client-authn-core
• oidc-client-ext
• Other (please specify): ...

Bug description

An app running inside of an iframe won't restore the session properly, because the callback url is sent to the parent window instead.

To Reproduce

It would take me some time to create a small reproduction, and I think the issue is clear enough. It it isn't, let me know and I'll provide the reproduction.

Expected result

I expect the library to restore the session properly even if running inside of an iframe.

Actual result

The library does not restore the session properly and sends the callback url to the parent window.

Environment

I don't think my environment is relevant to this issue.

Additional information

So far you may be wondering why do I even need to run the library inside of an iframe. Well, there is a perfectly good explanation, and that is that I use Cypress :). Cypress is an automated test framework that runs tests in a real browser, and the app is run within an iframe.

So this is not a problem that I will face in production, but it's broken my tests and makes it impossible to use in my development workflow. Although I could see this becoming an issue for some app that does run in an iframe.

Start in packages/browser/src/Session.ts around lines 329-334, where the issue identifies the callback URL handling, and inspect how it behaves when the library runs inside an iframe. Reproduce the session-restoration flow through Cypress, then verify that the callback stays in the iframe and the session restores correctly without sending the URL to the parent window.