From 441d2b52a19f3f9dd91eb07938c3a39b07fd0e24 Mon Sep 17 00:00:00 2001
From: sumeyye <sum.the.developer@gmail.com>
Date: Fri, 26 Jun 2026 14:14:01 +0300
Subject: [PATCH 1/2] update: enhance MemoryTokenStorageService to support
 session storage for specific keys

---
 .../services/memory-token-storage.service.ts  | 73 ++++++++++++++-----
 1 file changed, 56 insertions(+), 17 deletions(-)

diff --git a/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts b/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
index 7d531dfefd0..c3d85770e99 100644
--- a/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
+++ b/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
@@ -22,6 +22,8 @@ export class MemoryTokenStorageService implements OAuthStorage {
     'granted_scopes',
   ];
 
+  private keysShouldStoreInSession = ['nonce', 'PKCE_verifier', 'session_state'];
+
   private worker?: any;
   private port?: MessagePort;
   private cache = new Map<string, string>();
@@ -89,38 +91,55 @@ export class MemoryTokenStorageService implements OAuthStorage {
   }
 
   getItem(key: string): string | null {
-    if (!this.keysShouldStoreInMemory.includes(key)) {
-      return this.localStorageService.getItem(key);
+    if (this.keysShouldStoreInMemory.includes(key)) {
+      return this.cache.get(key) || null;
+    }
+
+    if (this.keysShouldStoreInSession.includes(key)) {
+      return this.getSessionItem(key);
     }
-    return this.cache.get(key) || null;
+
+    return this.localStorageService.getItem(key);
   }
 
   setItem(key: string, value: string): void {
-    if (!this.keysShouldStoreInMemory.includes(key)) {
-      this.localStorageService.setItem(key, value);
+    if (this.keysShouldStoreInMemory.includes(key)) {
+      if (this.useSharedWorker && this.port) {
+        this.cache.set(key, value);
+        this.port.postMessage({ action: 'set', key, value });
+      } else {
+        this.cache.set(key, value);
+      }
+
       return;
     }
 
-    if (this.useSharedWorker && this.port) {
-      this.cache.set(key, value);
-      this.port.postMessage({ action: 'set', key, value });
-    } else {
-      this.cache.set(key, value);
+    if (this.keysShouldStoreInSession.includes(key)) {
+      this.setSessionItem(key, value);
+      return;
     }
+
+    this.localStorageService.setItem(key, value);
   }
 
   removeItem(key: string): void {
-    if (!this.keysShouldStoreInMemory.includes(key)) {
-      this.localStorageService.removeItem(key);
+    if (this.keysShouldStoreInMemory.includes(key)) {
+      if (this.useSharedWorker && this.port) {
+        this.cache.delete(key);
+        this.port.postMessage({ action: 'remove', key });
+      } else {
+        this.cache.delete(key);
+      }
+
       return;
     }
 
-    if (this.useSharedWorker && this.port) {
-      this.cache.delete(key);
-      this.port.postMessage({ action: 'remove', key });
-    } else {
-      this.cache.delete(key);
+    if (this.keysShouldStoreInSession.includes(key)) {
+      this.removeSessionItem(key);
+      return;
     }
+
+    this.localStorageService.removeItem(key);
   }
 
   clear(): void {
@@ -165,6 +184,26 @@ export class MemoryTokenStorageService implements OAuthStorage {
     }, 100);
   }
 
+  private getSessionStorage(): Storage | null {
+    try {
+      return this._document.defaultView?.sessionStorage ?? null;
+    } catch {
+      return null;
+    }
+  }
+
+  private getSessionItem(key: string): string | null {
+    return this.getSessionStorage()?.getItem(key) ?? null;
+  }
+
+  private setSessionItem(key: string, value: string): void {
+    this.getSessionStorage()?.setItem(key, value);
+  }
+
+  private removeSessionItem(key: string): void {
+    this.getSessionStorage()?.removeItem(key);
+  }
+
   private createWorkerDataUrl(): string {
     const workerScript = `const tokenStore = new Map();
 const ports = new Set();

From 449f61c30df242e0f0e2eeb4ad556d6950343b0a Mon Sep 17 00:00:00 2001
From: sumeyye <sum.the.developer@gmail.com>
Date: Fri, 26 Jun 2026 14:22:49 +0300
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../services/memory-token-storage.service.ts    | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts b/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
index c3d85770e99..e383ed78b00 100644
--- a/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
+++ b/npm/ng-packs/packages/oauth/src/lib/services/memory-token-storage.service.ts
@@ -193,15 +193,26 @@ export class MemoryTokenStorageService implements OAuthStorage {
   }
 
   private getSessionItem(key: string): string | null {
-    return this.getSessionStorage()?.getItem(key) ?? null;
+    const storage = this.getSessionStorage();
+    return storage ? storage.getItem(key) : this.localStorageService.getItem(key);
   }
 
   private setSessionItem(key: string, value: string): void {
-    this.getSessionStorage()?.setItem(key, value);
+    const storage = this.getSessionStorage();
+    if (storage) {
+      storage.setItem(key, value);
+    } else {
+      this.localStorageService.setItem(key, value);
+    }
   }
 
   private removeSessionItem(key: string): void {
-    this.getSessionStorage()?.removeItem(key);
+    const storage = this.getSessionStorage();
+    if (storage) {
+      storage.removeItem(key);
+    } else {
+      this.localStorageService.removeItem(key);
+    }
   }
 
   private createWorkerDataUrl(): string {