Angular Apps Using Same IdentityServer – Silent Refresh Fails When Redirecting Between Two Apps

I have two independent Angular applications (url1 and url2), both hosted on Azure Kubernetes Service (AKS) and configured to use the same IdentityServer (OIDC-based) for authentication.

Application URLs: url1: https://aks-tf.eastus.cloudapp.azure.com/iam-admin-web

url2: https://aks-tf.eastus.cloudapp.azure.com/iam-admin

Both applications use the same IdentityServer endpoint for authentication: https://aks-tf.eastus.cloudapp.azure.com/iam-auth-web

Use Case: I’m enabling navigation between these two apps using simple anchor links that open the target in a new tab.

From url1 to url2: html Copy Edit

url2 From url2 back to url1: html Copy Edit url1 Problem: When redirecting from url1 to url2, everything works fine.
But when redirecting from url2 back to url1, the application at url1 immediately logs out.

Upon inspecting, I found that silent token refresh fails, resulting in a logout.

Technical Setup: Both applications use angular-oauth2-oidc library for OIDC authentication.

silentRefresh is configured and working fine within each individual app.

IdentityServer settings are consistent across both apps.

Session cookies are being used (not tokens stored in localStorage).

Both apps are hosted under the same domain but different sub-paths.

CheckSessionIFrame is enabled.

What I've Tried: Ensured that both apps are configured with the same client_id, redirectUri, and silentRefreshRedirectUri (where applicable).

Verified CORS settings and postMessage event flow for silent refresh iframe.

Added logs to listen for session changes:

this.oauthService.events
.pipe(filter(e => ['session_terminated', 'session_changed'].includes(e.type)))
.subscribe(e => {
console.warn('Session changed — triggering silent refresh');
this.oauthService.silentRefresh().catch(err => {
console.error('Silent refresh failed', err);
});
});


Observed that on navigating back from url2 to url1, the silent refresh fails with an error, causing logout.

Continue reading...