Silent Auth Demo

A look at what keeps you signed in across visits, without a login screen every time.

Loading…

Event log

Nothing has happened yet.

Advanced: the real OIDC prompt=none request

What actually keeps you signed in above is this app's own persisted session — closer to what the SDK's background token refresh does than to the OIDC spec's silent-authentication mechanism. That spec mechanism is a real request you can send yourself: a top-level redirect to Descope's /authorize endpoint with prompt=none, asking Descope directly whether it considers you signed in, independent of anything stored in this app.

Expect this to say error=login_required even right after logging in above — confirmed by testing against a live project, not assumed. Two things get in the way of a third-party silent check on Descope as currently configured, and both are real browser security behavior, not bugs in this demo:

  • A hidden iframe (the technique most production silent-refresh implementations use) can't even load: Descope's hosted pages send X-Frame-Options: SAMEORIGIN, so Chrome refuses to display them in a cross-origin iframe at all.
  • A top-level redirect (what this button does instead) avoids that, but Descope's session cookie is SameSite=Strict — which means the browser never attaches it to a request that originates from a different site, including a redirect this app initiates. It only gets sent once you're already on api.descope.com, which is exactly the case a cross-app silent check needs to work.

Both are why the signed-in state above comes from this app's own persisted session instead — it's the mechanism that actually works, confirmed live.