Check session does not work when autoUserinfo is set to false in code flow with PKCE

[mustafakachwala]

Describe the bug
I have integrated the latest version 11.2.0 of angular auth oidc client. When autoUserinfo is set to false, the check session polling fails because session_state is not set in persistent storage

To Reproduce
Steps to reproduce the behavior:

1. Set autoUserinfo to false
2. Set checkSession to true
3. Enable logs
4. Continuous error in console "OidcSecurityCheckSession pollServerSession session_state is blank"

Expected behavior
Even when I set autoUserinfo to false and load user details from the idToken, the session_state should be saved in persistent storage and check session should work fine

Desktop (please complete the following information):

• OS: Windows
• Browser chrome

Additional context
In flow-service.ts, I see that we are setting the session_state only when the userinfo endpoint response is received. This should also be set when I do not want to use auto user info, that is when userData is set to the id_token decoded Check session should work in both cases

@damienbod @FabianGosebrink please suggest

[damienbod]

Hi @mustafakachwala Thanks for you issue.

This looks like a bug, thanks for reporting, fixing and testing

Greetings Damien