do not use node-fetch, let user polyfill it

[sibelius]

I'm submitting this issue for the package(s):

• jwt-verifier
• okta-angular
• oidc-middleware
• okta-react
• okta-react-native
• okta-vue

I'm submitting a:

• Bug report
• Feature request
• Other (Describe below)

Current behavior

It uses node-fetch

Expected behavior

It should let user polyfill fetch instead

Minimal reproduction of the problem with instructions

remove node-fetch, and add docs saying that user should polyfill it

using isomorphic-fetch sounds a good option

Extra information about the use case/user story you are trying to implement

Environment

• Package Version: 2.0.0
• Browser:
• OS: mac
• Node version (node -v): 10
• Other:

[swiftone]

Thanks for the comment @sibelius - Can you give us some more detail on your use case?

We want to minimize the effort of users of this package. isomorphic-fetch wasn't used for three reasons:

• The last update to isomorphic-fetch was 3 years ago, and most of the code is untouched for 4 years. That not necessarily bad, but the list of issues is growing and the JS environment has evolved quite a bit in that time.
• oidc-middleware is explicitly backend - there are no frontend calls, so the explicit goal of isomorphic-fetch (isomorphic) was outside our scope.
• isomorphic-fetch implements a global, and we want to minimize the impact on user environments (and vice-versa).

Can you share a bit of info about

• Why node-fetch causes you problems
• Why isomorphic-fetch is better?

Thanks in advance - hopefully we can figure out how best to address any issues you are experiencing.

[sibelius]

it is recommend to let user code provide the polyfill not every package/library

so the bundle can be small if you are doing serveless

[swiftone]

Sorry, @sibelius, I'm not quite following your point here and need some clarification.

it is recommend to let user code provide the polyfill not every package/library

node-fetch isn't a polyfill - it's a server-side library that doesn't polyfill anything, server-side or browser-side.

so the bundle can be small if you are doing serveless

I'm used to 'bundle' referring to what is being sent to a browser user on page load. oidc-middleware isn't sent to the browser user at all, it runs the server, and thus node-fetch shouldn't be sent to a browser user at all. Are you using 'bundle' to mean something different?