Potential client issues when cache contains invalid values

Search terms you've used

session, cache

Impacted package

Which packages do you think might be impacted by the bug ?

• solid-client-authn-browser

Bug description

This is not really a bug (I think), but more of a potential situation that can arise. I'm mostly curious about who is responsible here and how this behaviour should be caught. I accidentally discovered this when doing tests with mashlib, but this can be reproduced using packages/browser/examples/demoClientApp.

To Reproduce

1. Start CSS (or any Solid server I would imagine) and register a user
2. Change this line to point to your local server (e.g., const defaultIssuer = 'http://localhost:3000/;): https://github.com/inrupt/solid-client-authn-js/blob/9d3ed0a1a995efc4359a6bab57570627145bc1e8/packages/browser/examples/demoClientApp/src/DemoClientApp.js#L27
3. Start the demo client app (at http://localhost:3001) and log in
4. Remove the registered clients from the Solid server (can be done in CSS by remove the .internal/idp/adapter/ folder).
5. Refresh http://localhost:3001.
6. The page will immediately try to redirect to something like http://localhost:3000/.oidc/auth?client_id=4CFIF-J_Ul8JTW2Yvk-Oc&redirect_uri=http%3A%2F%2Flocalhost%3A3001%2F&response_type=code&scope=openid%20offline_access%20webid&state=9e26631265fe40bb859b8760e81c9311&code_challenge=Lz5wSueifjca4C2uxsz8y0H0Myozx-UC72yODlrjjgU&code_challenge_method=S256&prompt=none&response_mode=query
7. The user will get stuck on a 400 page showing the error that the client_id is unknown by the server

The error is expected as the server no longer knows the client. The problem is that there is now no way to use the client any more: every time the user tries to browse to the client it will immediately get the redirect above. The only way to solve it is to clear the browser cache for localhost.

The thing I'm wondering now is: is this expected/acceptable behaviour?
If not, who should handle this more gracefully?
Should the server still call the callback URI even in case of error?
Should the client somehow check if the browser cache still contains valid values?
Should it not automatically try to redirect if it detects a cache?

Environment

v1.11.7 of the browser authn client

Start with packages/browser/examples/demoClientApp and the defaultIssuer setting in src/DemoClientApp.js, then reproduce the cached-client scenario against a local Solid server. Trace the browser authentication flow to determine whether the client or server should handle the unknown client_id, and document an agreed recovery behavior that avoids trapping the user in repeated redirects.