feat(oidc-client): add no redirect support for response type none

Author: vatsalparikh

e2e/oidc-app/src/ping-am/index.html

@@ -21,7 +21,8 @@ <h1>OIDC App | PingAM Login</h1>
       <button id="logout">Logout</button>
       <button id="user-info-btn">User Info</button>
       <button id="revoke">Revoke Token</button>
-      <button id="session-check-btn">Session Check (none)</button>
+      <button id="session-check-btn">Session Check (none, iframe)</button>
+      <button id="session-check-no-redirect-btn">Session Check (none, no redirect)</button>
       <button id="session-check-id-token-btn">Session Check (id_token)</button>
       <a href="/ping-am/">Start Over</a>
     </div>

e2e/oidc-app/src/ping-one/index.html

@@ -21,7 +21,6 @@ <h1>OIDC App | P1 Login</h1>
       <button id="logout">Logout</button>
       <button id="user-info-btn">User Info</button>
       <button id="revoke">Revoke Token</button>
-      <button id="session-check-btn">Session Check (none)</button>
       <button id="session-check-id-token-btn">Session Check (id_token)</button>
       <a href="/ping-one/">Start Over</a>
     </div>

e2e/oidc-app/src/utils/oidc-app.ts

@@ -21,7 +21,14 @@ let tokenIndex = 0;
 
 function displayError(error: unknown) {
   const errorEl = document.createElement('div');
-  errorEl.innerHTML = `<p><strong>Error:</strong> <span class="error">${JSON.stringify(error, null, 2)}</span></p>`;
+  const p = document.createElement('p');
+  const strong = document.createElement('strong');
+  strong.textContent = 'Error:';
+  const span = document.createElement('span');
+  span.className = 'error';
+  span.textContent = JSON.stringify(error, null, 2);
+  p.append(strong, document.createTextNode(' '), span);
+  errorEl.appendChild(p);
   document.body.appendChild(errorEl);
 }
 
@@ -53,7 +60,14 @@ function displayTokenResponse(
     }
 
     const tokenInfoEl = document.createElement('div');
-    tokenInfoEl.innerHTML = `<p><strong>Access Token:</strong> <span id="accessToken-${tokenIndex}">${response.accessToken}</span></p>`;
+    const tokenP = document.createElement('p');
+    const tokenStrong = document.createElement('strong');
+    tokenStrong.textContent = 'Access Token:';
+    const tokenSpan = document.createElement('span');
+    tokenSpan.id = `accessToken-${tokenIndex}`;
+    tokenSpan.textContent = response.accessToken;
+    tokenP.append(tokenStrong, document.createTextNode(' '), tokenSpan);
+    tokenInfoEl.appendChild(tokenP);
     appEl?.appendChild(tokenInfoEl);
     tokenIndex++;
   }
@@ -162,7 +176,14 @@ export async function oidcApp({
 
       const appEl = document.getElementById('app');
       const userInfoEl = document.createElement('div');
-      userInfoEl.innerHTML = `<p><strong>User Info:</strong> <span id="userInfo">${JSON.stringify(userInfo, null, 2)}</span></p>`;
+      const userInfoP = document.createElement('p');
+      const userInfoStrong = document.createElement('strong');
+      userInfoStrong.textContent = 'User Info:';
+      const userInfoSpan = document.createElement('span');
+      userInfoSpan.id = 'userInfo';
+      userInfoSpan.textContent = JSON.stringify(userInfo, null, 2);
+      userInfoP.append(userInfoStrong, document.createTextNode(' '), userInfoSpan);
+      userInfoEl.appendChild(userInfoP);
       appEl?.appendChild(userInfoEl);
     }
   });
@@ -178,7 +199,9 @@ export async function oidcApp({
     } else {
       const appEl = document.getElementById('app');
       const revokeEl = document.createElement('div');
-      revokeEl.innerHTML = `<p>Token successfully revoked</p>`;
+      const revokeP = document.createElement('p');
+      revokeP.textContent = 'Token successfully revoked';
+      revokeEl.appendChild(revokeP);
       appEl?.appendChild(revokeEl);
     }
   });
@@ -218,7 +241,30 @@ export async function oidcApp({
     const result = await oidcClient.user?.session();
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
-    el.innerHTML = `<p><strong>Session Check (none):</strong></p><pre id="session-check-result">${JSON.stringify(result, null, 2)}</pre>`;
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (none, iframe):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
+    appEl?.appendChild(el);
+  });
+
+  document.getElementById('session-check-no-redirect-btn')?.addEventListener('click', async () => {
+    const options: SessionCheckOptions = { redirectUri: '' };
+    const result = await oidcClient.user?.session(options);
+    const appEl = document.getElementById('app');
+    const el = document.createElement('div');
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (none, no redirect):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-no-redirect-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
     appEl?.appendChild(el);
   });
 
@@ -227,7 +273,14 @@ export async function oidcApp({
     const result = await oidcClient.user?.session(options);
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
-    el.innerHTML = `<p><strong>Session Check (id_token):</strong></p><pre id="session-check-id-token-result">${JSON.stringify(result, null, 2)}</pre>`;
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (id_token):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-id-token-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
     appEl?.appendChild(el);
   });
 

e2e/oidc-suites/src/session.spec.ts

@@ -50,7 +50,7 @@ test.describe('user.session() tests', () => {
       }
     });
 
-    await page.getByRole('button', { name: 'Session Check (none)', exact: true }).click();
+    await page.getByRole('button', { name: 'Session Check (none, iframe)', exact: true }).click();
     await expect(page.locator('#session-check-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-result').textContent();
     expect(resultText).not.toContain('"error"');
@@ -79,22 +79,22 @@ test.describe('user.session() tests', () => {
       }
     });
 
-    await page.getByRole('button', { name: 'Session Check (none)', exact: true }).click();
+    await page.getByRole('button', { name: 'Session Check (none, iframe)', exact: true }).click();
     await expect(page.locator('#session-check-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-result').textContent();
     expect(resultText).toContain('"error": "login_required"');
   });
 
-  test('session check (none) fails when no session exists', async ({ page }) => {
+  test('session check (none) fails with no_id_token_hint when not logged in', async ({ page }) => {
     const { navigate } = asyncEvents(page);
-    // Navigate without logging in — no tokens in storage, no browser session
+    // Navigate without logging in — no tokens in storage means no id_token_hint to send
     await navigate('/ping-am/');
 
-    await page.getByRole('button', { name: 'Session Check (none)', exact: true }).click();
+    await page.getByRole('button', { name: 'Session Check (none, iframe)', exact: true }).click();
     await expect(page.locator('#session-check-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-result').textContent();
-    // PingAM returns login_required or interaction_required when there is no session
-    expect(resultText).toMatch(/"error": "(login_required|interaction_required)"/);
+    // response_type=none requires a stored id_token; fails early before reaching the AS
+    expect(resultText).toContain('"error": "no_id_token_hint"');
   });
 
   test('session check (id_token) succeeds with valid JWT in hash', async ({ page }) => {
@@ -183,7 +183,7 @@ test.describe('user.session() tests', () => {
       }
     });
 
-    await page.getByRole('button', { name: 'Session Check (none)', exact: true }).click();
+    await page.getByRole('button', { name: 'Session Check (none, iframe)', exact: true }).click();
     await expect(page.locator('#session-check-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-result').textContent();
     expect(resultText).not.toContain('"error"');
@@ -221,6 +221,67 @@ test.describe('user.session() tests', () => {
     expect(resultText).toContain('"error": "nonce_mismatch"');
   });
 
+  test('session check (none, no redirect) succeeds after login', async ({ page }) => {
+    const { navigate } = asyncEvents(page);
+    await navigate('/ping-am/');
+
+    await loginPingAm(page, pingAmUsername, pingAmPassword);
+
+    await page.route('**/authorize**', async (route, request) => {
+      const url = new URL(request.url());
+      if (url.searchParams.get('prompt') === 'none' && !url.searchParams.has('redirect_uri')) {
+        await route.fulfill({ status: 204 });
+      } else {
+        await route.continue();
+      }
+    });
+
+    await page.getByRole('button', { name: 'Session Check (none, no redirect)' }).click();
+    await expect(page.locator('#session-check-no-redirect-result')).not.toBeEmpty();
+    const resultText = await page.locator('#session-check-no-redirect-result').textContent();
+    expect(resultText).not.toContain('"error"');
+  });
+
+  test('session check (none, no redirect) fails with login_required', async ({ page }) => {
+    const { navigate } = asyncEvents(page);
+    await navigate('/ping-am/');
+
+    await loginPingAm(page, pingAmUsername, pingAmPassword);
+
+    await page.route('**/authorize**', async (route, request) => {
+      const url = new URL(request.url());
+      if (url.searchParams.get('prompt') === 'none' && !url.searchParams.has('redirect_uri')) {
+        await route.fulfill({
+          status: 400,
+          contentType: 'application/json',
+          body: JSON.stringify({
+            error: 'login_required',
+            error_description: 'User not authenticated',
+          }),
+        });
+      } else {
+        await route.continue();
+      }
+    });
+
+    await page.getByRole('button', { name: 'Session Check (none, no redirect)' }).click();
+    await expect(page.locator('#session-check-no-redirect-result')).not.toBeEmpty();
+    const resultText = await page.locator('#session-check-no-redirect-result').textContent();
+    expect(resultText).toContain('"error": "login_required"');
+  });
+
+  test('session check (none, no redirect) fails with no_id_token_hint when not logged in', async ({
+    page,
+  }) => {
+    const { navigate } = asyncEvents(page);
+    await navigate('/ping-am/');
+
+    await page.getByRole('button', { name: 'Session Check (none, no redirect)' }).click();
+    await expect(page.locator('#session-check-no-redirect-result')).not.toBeEmpty();
+    const resultText = await page.locator('#session-check-no-redirect-result').textContent();
+    expect(resultText).toContain('"error": "no_id_token_hint"');
+  });
+
   test('session check (none) fails with iframe_timeout when AS does not respond', async ({
     page,
   }) => {
@@ -239,7 +300,7 @@ test.describe('user.session() tests', () => {
       }
     });
 
-    await page.getByRole('button', { name: 'Session Check (none)', exact: true }).click();
+    await page.getByRole('button', { name: 'Session Check (none, iframe)', exact: true }).click();
     await expect(page.locator('#session-check-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-result').textContent();
     expect(resultText).toContain('"error": "iframe_timeout"');

packages/oidc-client/README.md

@@ -180,6 +180,59 @@ Logs out the user by revoking tokens and clearing the storage. Uses the end sess
 const logoutResponse = await oidcClient.user.logout();
 ```
 
+#### `user.session(options?)`
+
+Checks whether the user has an active session at the AS without prompting for login (`prompt=none`).
+
+- **Parameters**: `SessionCheckOptions` (optional)
+- **Returns**: `Promise<SessionCheckSuccess | GenericError>`
+
+```js
+const session = await oidcClient.user.session();
+if ('error' in session) {
+  // No active session
+}
+```
+
+##### `responseType: 'none'` (default)
+
+Use when you only need to know if a session is alive — no claims are returned.
+
+Requires a stored `id_token` to send as `id_token_hint`. Fails immediately with `no_id_token_hint` if storage is empty.
+
+How the check runs depends on `redirectUri`:
+
+- **With `redirectUri`** (iframe): a hidden iframe loads the authorization URL. The AS redirects to `redirectUri` on success or appends error params on failure. The `redirectUri` must be same-origin — the browser blocks cross-origin iframe content access.
+- **Without `redirectUri`** (fetch): a plain GET to the authorization endpoint — no iframe. The AS returns `204` on success or `400` on failure. Use this when no same-origin callback page is available.
+
+Returns `{ mode: 'none' }` on success.
+
+##### `responseType: 'id_token'`
+
+Use when you need the user's claims back from the session. The AS issues a fresh `id_token` whose decoded claims are returned on success.
+
+Always uses the iframe path — `redirectUri` is required. A stored `id_token` is sent as `id_token_hint` if available but is not required.
+
+`state` and `nonce` are validated before claims are returned. If `subject` is provided, the `sub` claim must also match — otherwise any active session's claims are returned.
+
+```js
+const session = await oidcClient.user.session({
+  responseType: 'id_token',
+  subject: knownUserId, // optional — omit to get claims for whoever is logged in
+});
+if (!('error' in session)) {
+  console.log(session.claims); // JWTPayload
+}
+```
+
+Returns `{ mode: 'id_token', claims: JWTPayload }` on success.
+
+##### PingOne compatibility note
+
+PingOne SaaS does not support `response_type=none`. Its authorization server only accepts `code`, `token`, and `id_token` as response types — `none` is not listed as an option in the [PingOne application configuration](https://docs.pingidentity.com/pingone/applications/p1_edit_application_oidc.html), the [PingOne response types reference](https://docs.pingidentity.com/pingone/applications/p1_responsetypes.html), the [PingOne Platform API reference](https://developer.pingidentity.com/pingone-api/auth/openid-connect-oauth-2.html), or the [PingOne support for response_mode options](https://developer.pingidentity.com/pingone-api/auth/auth-config-options/browserless-authentication-flow-options.html#pingone-support-for-response_mode-options).
+
+Use `responseType: 'id_token'` when connecting to PingOne.
+
 ## Usage Examples
 
 ### Redirect-Based Login (`authorize.url()`)

packages/oidc-client/api-report/oidc-client.api.md

@@ -135,6 +135,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;
@@ -177,6 +182,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;

packages/oidc-client/api-report/oidc-client.types.api.md

@@ -135,6 +135,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;
@@ -177,6 +182,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;

packages/oidc-client/src/lib/client.store.test.ts

@@ -734,9 +734,8 @@ describe('user.session()', async () => {
     customStorage.remove(storageKey);
   });
 
-  it('returns a GenericError when no tokens are stored (best-effort: dispatch is attempted)', async () => {
-    // No tokens in storage — best-effort: id_token_hint is omitted, dispatch still runs.
-    // In Vitest (no real DOM), the iframe manager cannot run and surfaces a session_check_error.
+  it('returns a GenericError when no tokens are stored', async () => {
+    // response_type=none requires a stored id_token; failing before dispatch.
     const oidcClient = await oidc({ config, storage: customStorageConfig });
     if ('error' in oidcClient) throw new Error('Error creating OIDC Client');
 
@@ -745,8 +744,8 @@ describe('user.session()', async () => {
     if (!('error' in result)) {
       expect.fail('Expected SessionCheckError, got success');
     }
-    expect(result.error).toBe('session_check_error');
-    expect(result.type).toBe('network_error');
+    expect(result.error).toBe('no_id_token_hint');
+    expect(result.type).toBe('argument_error');
   });
 
   it('returns wellknown_error when authorization_endpoint is missing from the wellknown config', async () => {