feat(oidc-client): add no redirect support for response type none

Author: vatsalparikh

e2e/oidc-app/src/ping-am/index.html

@@ -21,7 +21,8 @@ <h1>OIDC App | PingAM Login</h1>
       <button id="logout">Logout</button>
       <button id="user-info-btn">User Info</button>
       <button id="revoke">Revoke Token</button>
-      <button id="session-check-btn">Session Check (none)</button>
+      <button id="session-check-btn">Session Check (none, iframe)</button>
+      <button id="session-check-no-redirect-btn">Session Check (none, no redirect)</button>
       <button id="session-check-id-token-btn">Session Check (id_token)</button>
       <a href="/ping-am/">Start Over</a>
     </div>

e2e/oidc-app/src/ping-one/index.html

@@ -21,7 +21,8 @@ <h1>OIDC App | P1 Login</h1>
       <button id="logout">Logout</button>
       <button id="user-info-btn">User Info</button>
       <button id="revoke">Revoke Token</button>
-      <button id="session-check-btn">Session Check (none)</button>
+      <button id="session-check-btn">Session Check (none, iframe)</button>
+      <button id="session-check-no-redirect-btn">Session Check (none, no redirect)</button>
       <button id="session-check-id-token-btn">Session Check (id_token)</button>
       <a href="/ping-one/">Start Over</a>
     </div>

e2e/oidc-app/src/utils/oidc-app.ts

@@ -21,7 +21,14 @@ let tokenIndex = 0;
 
 function displayError(error: unknown) {
   const errorEl = document.createElement('div');
-  errorEl.innerHTML = `<p><strong>Error:</strong> <span class="error">${JSON.stringify(error, null, 2)}</span></p>`;
+  const p = document.createElement('p');
+  const strong = document.createElement('strong');
+  strong.textContent = 'Error:';
+  const span = document.createElement('span');
+  span.className = 'error';
+  span.textContent = JSON.stringify(error, null, 2);
+  p.append(strong, document.createTextNode(' '), span);
+  errorEl.appendChild(p);
   document.body.appendChild(errorEl);
 }
 
@@ -53,7 +60,14 @@ function displayTokenResponse(
     }
 
     const tokenInfoEl = document.createElement('div');
-    tokenInfoEl.innerHTML = `<p><strong>Access Token:</strong> <span id="accessToken-${tokenIndex}">${response.accessToken}</span></p>`;
+    const tokenP = document.createElement('p');
+    const tokenStrong = document.createElement('strong');
+    tokenStrong.textContent = 'Access Token:';
+    const tokenSpan = document.createElement('span');
+    tokenSpan.id = `accessToken-${tokenIndex}`;
+    tokenSpan.textContent = response.accessToken;
+    tokenP.append(tokenStrong, document.createTextNode(' '), tokenSpan);
+    tokenInfoEl.appendChild(tokenP);
     appEl?.appendChild(tokenInfoEl);
     tokenIndex++;
   }
@@ -162,7 +176,14 @@ export async function oidcApp({
 
       const appEl = document.getElementById('app');
       const userInfoEl = document.createElement('div');
-      userInfoEl.innerHTML = `<p><strong>User Info:</strong> <span id="userInfo">${JSON.stringify(userInfo, null, 2)}</span></p>`;
+      const userInfoP = document.createElement('p');
+      const userInfoStrong = document.createElement('strong');
+      userInfoStrong.textContent = 'User Info:';
+      const userInfoSpan = document.createElement('span');
+      userInfoSpan.id = 'userInfo';
+      userInfoSpan.textContent = JSON.stringify(userInfo, null, 2);
+      userInfoP.append(userInfoStrong, document.createTextNode(' '), userInfoSpan);
+      userInfoEl.appendChild(userInfoP);
       appEl?.appendChild(userInfoEl);
     }
   });
@@ -178,7 +199,9 @@ export async function oidcApp({
     } else {
       const appEl = document.getElementById('app');
       const revokeEl = document.createElement('div');
-      revokeEl.innerHTML = `<p>Token successfully revoked</p>`;
+      const revokeP = document.createElement('p');
+      revokeP.textContent = 'Token successfully revoked';
+      revokeEl.appendChild(revokeP);
       appEl?.appendChild(revokeEl);
     }
   });
@@ -218,7 +241,30 @@ export async function oidcApp({
     const result = await oidcClient.user?.session();
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
-    el.innerHTML = `<p><strong>Session Check (none):</strong></p><pre id="session-check-result">${JSON.stringify(result, null, 2)}</pre>`;
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (none, iframe):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
+    appEl?.appendChild(el);
+  });
+
+  document.getElementById('session-check-no-redirect-btn')?.addEventListener('click', async () => {
+    const options: SessionCheckOptions = { redirectUri: '' };
+    const result = await oidcClient.user?.session(options);
+    const appEl = document.getElementById('app');
+    const el = document.createElement('div');
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (none, no redirect):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-no-redirect-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
     appEl?.appendChild(el);
   });
 
@@ -227,7 +273,14 @@ export async function oidcApp({
     const result = await oidcClient.user?.session(options);
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
-    el.innerHTML = `<p><strong>Session Check (id_token):</strong></p><pre id="session-check-id-token-result">${JSON.stringify(result, null, 2)}</pre>`;
+    const title = document.createElement('p');
+    const titleStrong = document.createElement('strong');
+    titleStrong.textContent = 'Session Check (id_token):';
+    title.appendChild(titleStrong);
+    const pre = document.createElement('pre');
+    pre.id = 'session-check-id-token-result';
+    pre.textContent = JSON.stringify(result, null, 2);
+    el.append(title, pre);
     appEl?.appendChild(el);
   });
 

packages/oidc-client/README.md

@@ -180,6 +180,53 @@ Logs out the user by revoking tokens and clearing the storage. Uses the end sess
 const logoutResponse = await oidcClient.user.logout();
 ```
 
+#### `user.session(options?)`
+
+Checks whether the user has an active session at the AS without prompting for login (`prompt=none`).
+
+- **Parameters**: `SessionCheckOptions` (optional)
+- **Returns**: `Promise<SessionCheckSuccess | GenericError>`
+
+```js
+const session = await oidcClient.user.session();
+if ('error' in session) {
+  // No active session
+}
+```
+
+##### `responseType: 'none'` (default)
+
+Use when you only need to know if a session is alive — no claims are returned.
+
+Requires a stored `id_token` to send as `id_token_hint`. Fails immediately with `no_id_token_hint` if storage is empty.
+
+How the check runs depends on `redirectUri`:
+
+- **With `redirectUri`** (iframe): a hidden iframe loads the authorization URL. The AS redirects to `redirectUri` on success or appends error params on failure. The `redirectUri` must be same-origin — the browser blocks cross-origin iframe content access.
+- **Without `redirectUri`** (fetch): a plain GET to the authorization endpoint — no iframe. The AS returns `204` on success or `400` on failure. Use this when no same-origin callback page is available.
+
+Returns `{ mode: 'none' }` on success.
+
+##### `responseType: 'id_token'`
+
+Use when you need the user's claims back from the session. The AS issues a fresh `id_token` whose decoded claims are returned on success.
+
+Always uses the iframe path — `redirectUri` is required. A stored `id_token` is sent as `id_token_hint` if available but is not required.
+
+`state` and `nonce` are validated before claims are returned. If `subject` is provided, the `sub` claim must also match — otherwise any active session's claims are returned.
+
+```js
+const session = await oidcClient.user.session({
+  responseType: 'id_token',
+  subject: knownUserId, // optional — omit to get claims for whoever is logged in
+});
+if (!('error' in session)) {
+  console.log(session.claims); // JWTPayload
+}
+```
+
+Returns `{ mode: 'id_token', claims: JWTPayload }` on success.
+
 ## Usage Examples
 
 ### Redirect-Based Login (`authorize.url()`)

packages/oidc-client/api-report/oidc-client.api.md

@@ -135,6 +135,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;
@@ -177,6 +182,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;

packages/oidc-client/api-report/oidc-client.types.api.md

@@ -135,6 +135,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;
@@ -177,6 +182,11 @@ responseType: SessionCheckResponseType;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
 params: Record<string, string>;
 }, "oidc", unknown>;
+sessionCheckFetch: MutationDefinition<    {
+url: string;
+}, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, {
+status: 204;
+}, "oidc", unknown>;
 authorizeIframe: MutationDefinition<    {
 url: string;
 }, BaseQueryFn<string | FetchArgs, unknown, FetchBaseQueryError, {}, FetchBaseQueryMeta>, never, AuthorizationSuccess, "oidc", unknown>;

packages/oidc-client/src/lib/client.store.test.ts

@@ -734,9 +734,8 @@ describe('user.session()', async () => {
     customStorage.remove(storageKey);
   });
 
-  it('returns a GenericError when no tokens are stored (best-effort: dispatch is attempted)', async () => {
-    // No tokens in storage — best-effort: id_token_hint is omitted, dispatch still runs.
-    // In Vitest (no real DOM), the iframe manager cannot run and surfaces a session_check_error.
+  it('returns a GenericError when no tokens are stored', async () => {
+    // response_type=none requires a stored id_token; failing before dispatch.
     const oidcClient = await oidc({ config, storage: customStorageConfig });
     if ('error' in oidcClient) throw new Error('Error creating OIDC Client');
 
@@ -745,8 +744,8 @@ describe('user.session()', async () => {
     if (!('error' in result)) {
       expect.fail('Expected SessionCheckError, got success');
     }
-    expect(result.error).toBe('session_check_error');
-    expect(result.type).toBe('network_error');
+    expect(result.error).toBe('no_id_token_hint');
+    expect(result.type).toBe('argument_error');
   });
 
   it('returns wellknown_error when authorization_endpoint is missing from the wellknown config', async () => {

packages/oidc-client/src/lib/oidc.api.ts

@@ -192,7 +192,7 @@ export const oidcApi = createApi({
 
         const request: FetchArgs = { url };
 
-        logger.debug('OIDC session check iframe request', request);
+        logger.debug('OIDC session check iframe request', { responseType });
 
         const response = await initQuery(request, 'authorize')
           .applyMiddleware(requestMiddleware)
@@ -265,14 +265,82 @@ export const oidcApi = createApi({
           >;
         }
 
-        logger.debug('OIDC session check iframe response', response);
+        logger.debug('OIDC session check iframe response received');
         return response as QueryReturnValue<
           { params: Record<string, string> },
           FetchBaseQueryError,
           FetchBaseQueryMeta
         >;
       },
     }),
+    sessionCheckFetch: builder.mutation<{ status: 204 }, { url: string }>({
+      queryFn: async ({ url }, api, _, baseQuery) => {
+        const { requestMiddleware, logger } = api.extra as Extras;
+
+        const request: FetchArgs = {
+          url,
+          method: 'GET',
+          credentials: 'include',
+          headers: {
+            Accept: 'application/json',
+          },
+        };
+
+        logger.debug('OIDC session check fetch request');
+
+        const response = await initQuery(request, 'authorize')
+          .applyMiddleware(requestMiddleware)
+          .applyQuery(async (req: FetchArgs) => await baseQuery(req));
+
+        if (response.error) {
+          const responseError = response.error;
+          const isNetworkError = typeof responseError.status === 'string';
+          const errorData = responseError.data;
+          const message =
+            !isNetworkError &&
+            errorData &&
+            typeof errorData === 'object' &&
+            'error_description' in errorData &&
+            typeof errorData.error_description === 'string'
+              ? errorData.error_description
+              : 'The request requires login.';
+
+          logger.error('Error in session check fetch', responseError);
+
+          return {
+            error: {
+              status: 400,
+              statusText: 'SESSION_CHECK_ERROR',
+              data: {
+                error: isNetworkError ? 'session_check_error' : 'login_required',
+                message,
+                type: isNetworkError ? 'network_error' : 'auth_error',
+              } satisfies GenericError,
+            } as FetchBaseQueryError,
+          };
+        }
+
+        if (response.meta?.response?.status !== 204) {
+          logger.error('Unexpected status in session check fetch', {
+            status: response.meta?.response?.status,
+          });
+          return {
+            error: {
+              status: 'CUSTOM_ERROR',
+              error: 'SESSION_CHECK_ERROR',
+              data: {
+                error: 'session_check_error',
+                message: `Unexpected response status: ${response.meta?.response?.status}`,
+                type: 'network_error',
+              } satisfies GenericError,
+            } as FetchBaseQueryError,
+          };
+        }
+
+        logger.debug('OIDC session check fetch response received');
+        return { data: { status: 204 } };
+      },
+    }),
     authorizeIframe: builder.mutation<AuthorizationSuccess, { url: string }>({
       queryFn: async ({ url }, api) => {
         const { requestMiddleware, logger } = api.extra as Extras;