Add silentAuthResponseMode configuration option

[rschick]

Changes

This PR adds a new silentAuthResponseMode configuration option to Auth0ClientOptions that allows developers to choose between 'web_message' (postMessage) and 'query' (URL polling) response modes for silent authentication flows.

What Changed

New Configuration Option (src/global.ts)

• Added silentAuthResponseMode?: 'web_message' | 'query' to Auth0ClientOptions
• Defaults to 'web_message' for backward compatibility
• Only affects getTokenSilently and checkSession methods
• Other methods (loginWithPopup, loginWithRedirect, getTokenWithPopup) remain unaffected with their hardcoded response modes

Refactored runIframe Function (src/utils.ts)

• Split runIframe into three functions:
  • runIframeWithWebMessage: Handles postMessage-based communication (existing behavior)
  • runIframeWithQueryMode: New URL polling implementation that checks iframe.contentWindow.location.href every 100ms
  • runIframe: Main delegator function that routes to the appropriate handler
• Updated signature: runIframe(authorizeUrl, eventOrigin, timeoutInSeconds, responseMode, redirectUri)

Updated Silent Auth Flow (src/Auth0Client.ts)

• Modified _getTokenFromIFrame method to:
  • Pass silentAuthResponseMode to _prepareAuthorizeUrl
  • Pass silentAuthResponseMode and redirect_uri to runIframe
  • Send the configured response_mode value to Auth0 in the authorization URL

Why This is Important

The 'query' response mode provides a fallback for restrictive environments where postMessage communication may be blocked or limited (e.g., certain enterprise security policies, iframe restrictions). This gives developers more flexibility when implementing silent authentication.

Usage

const auth0 = new Auth0Client({
  domain: 'example.auth0.com',
  clientId: 'YOUR_CLIENT_ID',
  silentAuthResponseMode: 'query' // or 'web_message' (default)
});

// This will now use query mode for silent auth
await auth0.getTokenSilently();

References

• Issue: Support for "query" response_mode for silent authentication #1470

Testing

All existing tests have been updated to account for the new 5-parameter runIframe signature.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md
• I have read the https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md
• All code quality tools/guidelines have been run/followed