Question: better flows description, improving documentation

[lomboboo]

Question

I find that this package implements a lot of cool features with clever ideas, but I feel like documentation doesn't match it.
I would really like to have some diagrams/charts that would explain how everything works or at least the most important flows.

I found some videos and articles that describes "How it works", but this is rather standard, basic OIDC docs rather than flows for this specific implementation. I would like to know more how ServiceWorker tied up with OIDC here (eg., debugging, storage, multi tabs with lock mechanisms etc).

Another field to improve docs for me would be events and in particular events related to this implementation (eg., lockNotAvailable, tryKeepExistingSession etc.).

Lastly, I think it would be so much easier for others to switch and start using this package if all the configuration options were described, preferably with examples and/or "gotchas", how/if they collide with other options, OidcTrustedDomains.js domains can be regex expressions etc. This also related to all the XHR requests developer can see during the flow (eg. OidcKeepAliveServiceWorker.json request - what does it do, how it affects the flow etc.).

I had to go through the source code to make it work in my setup, so I've spent some time with the library and found answers to some of the questions, but it really should be a part of the docs, which will speed the setup and understanding for new devs.

Thanks again for the great work with this package!

[guillaume-chervet]

hi @lomboboo completly agree ! I need to write more documentation. Thnak you for your feedback :)

[lomboboo]

I am also curious and it's not strictly related to the documentation - since monitor session is implemented via iframe it WILL NOT work with SameSite=Lax/Strict session cookie (only with SameSite=None), which is strongly advisable from the security perspective. Is there an alternative ?

[guillaume-chervet]

Hi @lomboboo, I will have time next week for updates.
In Fact iframe it works with the same domain/sub domains event (chat GPT said wrong things about this). I need to describe it more in details.

[lomboboo]

@guillaume-chervet Can you please elaborate a bit on the OidcServiceWorker.js and OidcTrustedDomains.js files?

Could it be a part of the configuration maybe?