Browser/App: Restore session without silent login and redirect

Hey,

In NodeJS there is the possibility for an application to request a refresh token that can be stored on the server. I am developing a hybrid mobile application that will run in a secure context and I use the browser authentication to do so.

Everything works fine, I have a clientId: https://sembeacon.org/id.jsonld that could request a refresh_token, etc...
However, I want to disable the silent login that redirects the user away to the Authorization server whenever they reopen the app,
since other than a browser - this is a much more visible process in a mobile application. I already have my insecure and secure storage configured for localStorage - but this does not seem to work.

From what I see, the client authentication uses the following authentication flow: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth while the node implementation has a refresh token flow. There does not seem to be a possibility to change this flow since the login flow is defined in:
https://github.com/inrupt/solid-client-authn-js/blob/4902d206dcd6dea3d0fcf9393f9363d644c5709d/packages/browser/src/dependencies.ts#L81-L86
which can not be changed or configured before it is loaded by a session.

Is it possible to somehow to either:

1. Request a refresh token in the browser
2. Retrieve and reuse the id_token and access_token to restore the session when the access token has not expired yet?
3. My next attempt will be to override the clientAuthentication object in each session, to replace the login flow with something that has the RefreshTokenOidcHandler in an AggregateOidcHandler. However, I do not know if this will work and it also feels like a solution for an issue that should not be there. A configuration to use refresh tokens would be useful or at least a solution to persist the access token and id_token for page refresh.

Best,
Maxim

Start with packages/browser/src/dependencies.ts around lines 81-86 and trace how the browser authentication flow is selected for a session. Compare the browser flow with the referenced RefreshTokenOidcHandler and AggregateOidcHandler, then determine which requested behavior—refresh-token use or persisted token restoration—can be supported. Done means the chosen flow is configurable and its behavior is covered by the relevant tests, though no test files are named in the issue.