Inline authentication by damencho · Pull Request #16910 · jitsi/jitsi-meet

damencho · 2026-02-06T22:11:29Z

No description provided.

…roviders like keycloak.

squash: Adds refresh token use when refresh token is needed on connection resuming. squash: Fix bugs and move to PKCE flow.

hristoterezov · 2026-02-10T22:57:16Z

react/features/app/getRouteToRender.web.ts

-    const config = state['features/base/config'];
-
-    // if we have auto redirect enabled, and we have previously logged in successfully
-    // let's redirect to the auth url to get the token and login again


We don't need this anymore? Why?

Well this was setting the jwt on prejoin without clicking join. But this means it is invoked without user interaction and that does not work with popups, the browser blocks them. So I moved this to happen before we join, after clicking the join button.

hristoterezov · 2026-02-10T23:09:52Z

react/features/authentication/actions.web.ts

+
+        const nonce = generateNonce();
+
+        sessionStorage.setItem('oauth_nonce', nonce);


do we need this? where do we use it? I see that we remove it but I don't see where we get it?

This is sessionStorage.setItem( so we set it here. We generate it.
Hum, I think it was used for verifying the response in sso.html. Probably we do not do it at the moment, but we can add it. I will double check when I do the changes for the other PR.

It is now implemented.

hristoterezov · 2026-02-10T23:13:09Z

react/features/authentication/actions.web.ts

+        window.addEventListener('message', handler);
+
+        // Check if popup was closed
+        const checkClosed = setInterval(() => {


this seems kind of dirty. Maybe we can do a message that will let us know that the popup will close so that we can cleanup or something else?

We do close it on error or success few lines above, this is the backup plan.

sure but still. Don't we have another option of handling this?

Also currently if we close the popup from the handler this interval will still run and execute and will call reject....

Ok I dropped the auto closing logic ... if something goes wrong we need to see it and have the popup open otherwise there is no trace what happened.

react/features/authentication/actions.web.ts

hristoterezov · 2026-02-11T21:44:45Z

react/features/authentication/actions.web.ts

+
+        const nonce = generateNonce();
+
+        sessionStorage.setItem('oauth_nonce', nonce);


We should check if the session storage is enabled. If it is disabled trough the browser settings this will throw an exception.

hristoterezov · 2026-02-11T21:45:44Z

react/features/authentication/actions.web.ts

+        };
+
+        // Listen for messages from the popup
+        window.addEventListener('message', handler);


Maybe we should add the listener to popup. this way if the user closes the popup the listener will be auto removed! otherwise in this use case we will be leaking listeners.

hristoterezov · 2026-02-11T21:47:41Z

react/features/authentication/functions.any.ts

-    const state = {
+        tenant: string | undefined,
+        refreshToken?: string | undefined): object => {
+    const state: any = {


why the any? If we need to specify a type lets define a real one and use it. It might be useful to have a type for this state anyway...

hristoterezov · 2026-02-11T22:03:39Z

react/features/authentication/functions.web.ts

-        tenant: string | undefined): Promise<string | undefined> => {
+        tenant: string | undefined,
+        // eslint-disable-next-line max-params
+        refreshToken?: string | undefined): Promise<string | undefined> => {


I'm wondering since we have ? do we need the undefined type?

hristoterezov · 2026-02-11T23:55:54Z

react/features/base/jwt/middleware.ts

+        const refreshToken = state['features/base/jwt'].refreshToken;
+
+        if (typeof APP !== 'undefined' && jwt
+                && validateJwt(jwt).find((e: any) => e.key === JWT_VALIDATION_ERRORS.TOKEN_EXPIRED)) {


do we need to do this since from the error we know the jwt is expired?

Yeah, I will drop it.

hristoterezov · 2026-02-12T00:00:07Z

react/features/base/jwt/middleware.ts

+                .then((url: string | undefined) => {
+                    if (url) {
+                        // only if it is inline token auth and token is about to expire
+                        // if not expired yet use it to refresh the token


I'm confused from this comment. Isn't the token expired for sure in this case?

Yeah the other check was checking 30 seconds earlier ... but in the ljm I did it exact check. Will fix the comment.

hristoterezov · 2026-02-12T00:35:54Z

react/features/base/jwt/middleware.ts

+                    if (url) {
+                        // only if it is inline token auth and token is about to expire
+                        // if not expired yet use it to refresh the token
+                        dispatch(showNotification({


I'm wondering about the use case where the jwt is passed externally from the URL.

It seems to me that even in this case the user will be prompted to login again which would be wrong I guess because the embedder of the meeting would expect to work only with their jwt token. Is this correct or I'm missing something? If this is the case maybe we should show different error message in this case and have a config that would disable the whole login thingy. WDYT?

Yeah, you are right. I will check it as jaas case is different than this ...

hristoterezov · 2026-02-12T00:37:56Z

react/features/base/jwt/middleware.ts

            store.dispatch(setDelayedLoadOfAvatarUrl());
            store.dispatch(setKnownAvatarUrl(delayedLoadOfAvatarUrl));
        }
+        break;


interesting. was this an old bug?

Yes, but it was not cause any problem because of the first if in setJwt functinon.

hristoterezov · 2026-02-12T01:02:57Z

react/features/base/jwt/middleware.ts

+                                store.dispatch(hideNotification(PROMPT_LOGIN_NOTIFICATION_ID));
+
+                                if (isTokenAuthInline(state['features/base/config'])) {
+                                    // Use refresh token if available, otherwise fall back to silent login


Can you elaborate on the comment? I don't understand it.

It seems to me that we always open a popup. What is the silent login?

Will take a look and fix it. I experimented with several options, there is this silent login that is supported from keycloak but modern browsers stop it most of the times, due to security concerns.

hristoterezov · 2026-02-12T01:03:36Z

react/features/base/conference/middleware.any.ts


-        dispatch(authStatusChanged(true, email || ''));
+        // it may happen to be already set (silent login)
+        dispatch(authStatusChanged(true, email || getState()['features/base/conference'].authLogin || ''));


I'm kind of lost what is the silent login?

See the comment above, I will go through the comments and fix them all.

hristoterezov · 2026-02-12T01:07:08Z

react/features/base/jwt/middleware.ts

+                        });
+                    }
+
+                    store.dispatch(authStatusChanged(true, jwtPayload.email));


why do we started setting the email?

So we can show it in settings -> profile which is the indication that you are logged in.
If email is missing from the state of authentication feature (if I remember correctly) it means you are not logged in.

hmm I thought it is the first argument which we set to true here, isn't it?

Nope ... it has some other semantics ... and some comment that we will remove it ...

Actually you are correct! but why did we started dispatching this one here?

I see that we also do the same on connection established. do we need both?

do we have the email from jwt on connection established ... if we are going from anonymous (no token) to setting a token we need it here I think.

damencho · 2026-02-12T01:42:34Z

hristoterezov · 2026-02-12T17:54:43Z

react/features/prejoin/components/web/Prejoin.tsx

-        joinConference();
+        // if we have auto redirect enabled, and we have previously logged in successfully
+        // let's redirect to the auth url to get the token and login again
+        if (tokenPreAuthConfig) {


actually why did we moved this to be executed on join and not when the user loads the page?

yes, cause when you join the page there is no user interaction, while clicking join button is user interaction. Otherwise popups do not work and are blocked by the browser.

hristoterezov · 2026-02-12T23:25:27Z

static/logout.html

+<script>
+    // Notify parent window that logout is complete
+    if (window.parent) {
+        window.parent.postMessage({


How do we use this file?

hristoterezov · 2026-02-12T23:29:36Z

static/sso.html

+    <div id="error" class="error"></div>
+</div>
+
+<script>


This seems like pretty large JS. Does it make sense to put it in a separate file? Maybe even a new bundle to be sure about browser compatibility and maybe we will be able to reuse some code? WDYT?

hristoterezov · 2026-02-12T23:30:51Z

static/sso.html

+                    window.opener.postMessage(message, window.location.origin);
+
+                    // Auto-close after a short delay
+                    setTimeout(() => window.close(), 1000);


isn't the opener already closing the popup?

hristoterezov · 2026-02-12T23:40:27Z

static/sso.html

+                }
+
+                // Get authorization code
+                const code = urlParams.get('code');


where is this coming from?

damencho added 2 commits February 2, 2026 16:04

fix(meeting_id): Depends on jitsi_session(uses session.user_region).

7424f03

feat(authentication): A static page that can be used with some auth p…

7cbc638

…roviders like keycloak.

damencho force-pushed the authentication-update branch from 7535a5b to d856378 Compare February 6, 2026 22:27

fix(authentication): Implements inline authentication.

7a93da7

squash: Adds refresh token use when refresh token is needed on connection resuming. squash: Fix bugs and move to PKCE flow.

damencho force-pushed the authentication-update branch from d856378 to 7a93da7 Compare February 7, 2026 15:21

aaronkvanmeerten approved these changes Feb 9, 2026

View reviewed changes

hristoterezov reviewed Feb 10, 2026

View reviewed changes

react/features/authentication/actions.web.ts Show resolved Hide resolved

hristoterezov reviewed Feb 10, 2026

View reviewed changes

react/features/authentication/actions.web.ts Show resolved Hide resolved

hristoterezov reviewed Feb 10, 2026

View reviewed changes

react/features/authentication/actions.web.ts Show resolved Hide resolved

damencho added 3 commits February 11, 2026 07:34

squash: Adds nonce verification.

2e4961e

squash: Drops the closing logic.

91ea707

squash: Replace resuming event with CONNECTION_TOKEN_EXPIRED one.

1cc639a

damencho force-pushed the authentication-update branch from 6179ba6 to 1cc639a Compare February 11, 2026 15:01

hristoterezov reviewed Feb 11, 2026

View reviewed changes

hristoterezov reviewed Feb 12, 2026

View reviewed changes

static/sso.html

}

// Get authorization code

const code = urlParams.get('code');

Copy link

Member

hristoterezov Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where is this coming from?


		const nonce = generateNonce();

		sessionStorage.setItem('oauth_nonce', nonce);

Conversation

damencho commented Feb 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hristoterezov Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

damencho commented Feb 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hristoterezov Feb 12, 2026 •

edited

Loading