ABP OAuth Package

The authentication implementation was moved from @abp/ng.core to @abp/ng.oauth in v7.0. The core package defines the authentication abstractions and tokens, while the OAuth package supplies their angular-oauth2-oidc implementations.

The package is included in the Angular application templates. Install it if the application does not already reference it:

npm install @abp/ng.oauth

Standalone Setup

Add provideAbpOAuth() after provideAbpCore() in the providers array of app.config.ts:

import { ApplicationConfig } from '@angular/core';
import { provideAbpCore, withOptions } from '@abp/ng.core';
import { registerLocaleForEsBuild } from '@abp/ng.core/locale';
import { provideAbpOAuth } from '@abp/ng.oauth';
import { environment } from '../environments/environment';

export const appConfig: ApplicationConfig = {
  providers: [
    provideAbpCore(
      withOptions({
        environment,
        registerLocaleFn: registerLocaleForEsBuild(),
      }),
    ),
    provideAbpOAuth(),
  ],
};

AbpOAuthModule.forRoot() is deprecated. Use the standalone provider for new applications.

Registered Authentication Services

provideAbpOAuth() registers or replaces these public core abstractions:

• AuthService, AuthGuard, authGuard and asyncAuthGuard with their OAuth implementations.
• ApiInterceptor and its HTTP_INTERCEPTORS registration.
• PIPE_TO_LOGIN_FN_KEY with the function used when authentication is required.
• CHECK_AUTHENTICATION_STATE_FN_KEY with the function that checks and stores the current authentication state.
• NAVIGATE_TO_MANAGE_PROFILE with navigation to the authority's account-management page.
• AuthErrorFilterService with the OAuth error filter.
• OAuthStorage, using BrowserTokenStorageService or ServerTokenStorageService for an SSR-started application and MemoryTokenStorageService otherwise.

It also registers the OAuth configuration initializer and the providers from angular-oauth2-oidc.

Token Storage

MemoryTokenStorageService keeps the access token and the ID token in memory and shares them between the tabs of the application with a SharedWorker. A new tab waits for these tokens (up to 3 seconds) before it initializes the authentication. nonce, PKCE_verifier and session_state are kept in sessionStorage, so tabs that sign in at the same time don't overwrite each other's values. The refresh token is kept in localStorage.

The SharedWorker is created from a data: URL. If the application uses a Content Security Policy, allow it with worker-src data:. When the worker can't start, each tab keeps its tokens on its own.

An application started with server-side rendering uses cookie storage instead. If you register your own OAuthStorage provider (for example localStorage), it replaces this storage.

Signing In Again

Use authGuard on the routes that need a signed-in user. The guard starts the sign-in with the current route, so the user comes back to the same page. The default 401 handler of @abp/ng.theme.shared does the same when the access token has expired. When there is no access token, it signs the user out by default; set signInWithoutToken in withHttpErrorConfig to start the sign-in instead (for example when an anonymous page shouldn't call APIs that need a signed-in user). If you replace these, pass the returnUrl to AuthService.navigateToLogin yourself.

When refreshing the tokens fails because the authorization server can't be reached or returns a server error, the tokens are kept, since they can still be valid. When the server rejects the refresh token, the tokens are removed and the sign-in starts.

With the authorization code flow, AuthService.navigateToLogin and AuthService.login share one redirect to the login page, until the page leaves. If you open the login page in your own way (a custom openUri in the OAuth configuration, a custom initCodeFlow or your own strategy), every request is passed to it.

API Interceptor

For non-external requests, the OAuth API interceptor adds the X-Requested-With header and, when the corresponding values are available, an Authorization bearer token, Accept-Language and the configured tenant header. Existing authorization, language and tenant headers are preserved. Requests marked with the IS_EXTERNAL_REQUEST HTTP context token are sent without those ABP headers. The interceptor also integrates every request with the HTTP wait service.

To implement another authentication system, provide replacements for the core services and tokens used by the application instead of depending on the OAuth implementations.