Chris

We got around this in our team by disabling web security in chrome when running testcafe, eg. `testcafe -e "chrome:headless --disable-web-security" ...` See https://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome/3177718#3177718

@pamapa @Badisi Thankyou both for your excellent feedback. I've made the suggested changes to try and satisfy the rules described above, such that the `silentRequestTimeoutInSeconds` setting is not overridden by...

> @pamapa @Badisi Thankyou both for your excellent feedback. I've made the suggested changes to try and satisfy the rules described above, such that the `silentRequestTimeoutInSeconds` setting is not overridden...

Let me know if this does the trick @pamapa @Badisi 🙏

Will work on getting the code coverage up over the next week or so.

> I am thinking about if it makes sense to add an extended userStore for dpop. Within that store we could handle/ isolate stuff like `await IndexedDbCryptoKeyPairStore.remove("oidc.dpop");`. We might even...

> > Anyway, I suppose I'm not fully clear on what you are after as far as extending the WebStorageStateStore class. > > I was more thinking about this: >...

> > Okay, yep - and would you like to try and apply the same idea to all the methods on the WebStorateStateStore class - e.g. set, get, getAllKeys such...

> > One option might be to alter the WebStorateStateStore to handle DPoP as well as what it already does (we'd still need to alter the StateStore interface). > >...

> > Have a look and let me know what you think. If you're happy with the approach, I will move the IndexedDBCryptoKeyPairStore logic directly into the DPoPStorageStateStore and incorporate...