Angular (Code Flow) + OpenIddict - multiple compatibility issues after IdentityServer migration #10735

Environment:

• ABP Commercial (latest), Angular UI, Separated architecture (AuthServer + HttpApi.Host + Angular SPA)
• Migrated from IdentityServer to OpenIddict following ABP documentation
• All backend layers migrated successfully, issues are Angular-side

Issues encountered:

1. Infinite redirect loop after login (auth guard vs code exchange race)

After the auth server redirects back with the authorization code, ABP's AuthGuard on the root route (/) fires immediately. At that point, the code exchange has not completed yet, so hasValidAccessToken() returns false. The guard redirects to login, the auth server auto-authenticates (session still active), redirects back - infinite loop. We had to create a dedicated /oauth/code callback route without an auth guard, and update the redirect_uri in both the Angular config and the OpenIddict application registration. Is there a recommended callback route for the code flow, or should ABP's auth guard wait for an in-progress code exchange before redirecting?

2. tryLogin() silently fails due to nonce validation

After the authorization code redirect, ABP's OAuth module calls tryLogin() without passing disableNonceCheck. The angular-oauth2-oidc library validates the nonce from the state parameter, fails, and rejects the promise - but ABP catches it with .catch(noop). The authorization code is consumed and discarded with no error surfaced to the developer. Is there a recommended way to disable nonce validation, or should ABP's OAuth module be passing disableNonceCheck: true for OpenIddict?

3. PKCE code_verifier lost between redirects

The library stores the PKCE verifier in sessionStorage by default. After the redirect back from the auth server, the verifier is gone and the token exchange fails with "code_verifier missing". We resolved this with saveNoncesInLocalStorage: true. Should this be the default for ABP's OpenIddict configuration?

4. CHECK_AUTHENTICATION_STATE_FN clears tokens on startup

After a successful code exchange, the token is stored in memory. ABP then calls /api/abp/application-configuration. If there is any timing issue or the API does not recognize the token immediately, ABP's checkAccessToken function clears all token storage. Is there a recommended approach to prevent this race condition, or is the no-op override for CHECK_AUTHENTICATION_STATE_FN_KEY intentional for OpenIddict setups?

5. revokeTokenAndLogout does not redirect on CORS failure

During logout, ABP calls oAuthService.revokeTokenAndLogout() without setting ignoreCorsIssues = true. If the revocation endpoint returns a CORS error (status 0), the logOut() method (which redirects to the end_session endpoint) is never called - the user appears stuck. Should ABP's code flow strategy be passing ignoreCorsIssues = true, or is there a CORS configuration we are missing?

Workarounds applied:

• Created /oauth/code route without auth guard as callback URL
• Monkey-patched tryLogin() to inject disableNonceCheck: true
• Set saveNoncesInLocalStorage: true in oAuthConfig
• Overrode CHECK_AUTHENTICATION_STATE_FN_KEY with no-op
• Monkey-patched revokeTokenAndLogout() to force ignoreCorsIssues = true

Question: Are these known issues with the Angular + OpenIddict code flow? Is there planned documentation or a fix in ABP's @abp/ng.oauth module to handle these scenarios, or are we expected to apply these workarounds manually? We would also appreciate guidance on which workarounds are safe for production vs temporary.