Session Checks enabled causing token refreshes every 2 seconds on inkognito mode

[HeiDTB]

Hi, i hope i adress it right.

As soon as i enable Session Checks:
sessionChecksEnabled: true,
i noticed in Chrome & Firefox Inkognito Modes, that the "session_changed" Event is always fired (hence refreshes the token every 1-2 seconds).

Is this intended? I guess it has something to do with the MessageEvent which fires a "change" every 1-2 seconds on inkognito mode.

[jeroenheijmans]

Difficult to tell without the code to reproduce this, but you might be running into the fact that 3rd party cookies are blocked in incognito mode?

If you could help the community reproduce it by providing minimal steps to do so, someone might be able to further investigate. Otherwise we'll depend on you to debug this on your local environment and report back what root cause you find...

[HeiDTB]

Hi @jeroenheijmans ,
the code is really simple to reproduce. I just enabled session checks...

   this.oauthService.configure({
      issuer: 'issuerUrl',  // all just examples
      redirectUri: 'redirectUri,
      clientId: 'kcClient',
      scope: 'openid profile email',
      requestAccessToken: true,
      responseType: 'code',
      disableAtHashCheck: true,
      sessionChecksEnabled: true, <------ this causes the problem
    });
    
    this.oauthService.setupAutomaticSilentRefresh();
    this.oauthService.loadDiscoveryDocumentAndLogin().then(() => {
    this.getEventType().subscribe((type) => {
        console.log(type); // just to show you how many times the "session_expired" is emitted
    };

Log Output in inkognito mode:
session_changed token_received token_refreshed session_changed token_received token_refreshed session_changed token_received token_refreshed session_changed token_received token_refreshed ....continues...

Without inkognito mode:
70 session_unchanged