Description
Core Library
MSAL.js (@azure/msal-browser)
Core Library Version
4.0.2
Wrapper Library
Not Applicable
Wrapper Library Version
None
Public or Confidential Client?
Public
Description
Force refresh not working as intended with NAA
In the 4.0.2 release to msal-browser, support for forceRefresh was added to NAA. This doesn't help with what it's supposed to though.
There is a known issue with expired ID tokens being served from cache. Regular workaround for this is would be to use forceRefresh, but it doesn't do any good with NAA. Setting this flag to true, will skip the cache check, and then call bridgeProxy.getTokenSilent which will yield the same tokens, which aren't refreshed.
This is a huge issue, as there is no way to force refresh an expired ID token using NAA.
Error Message
No response
MSAL Logs
Network Trace (Preferrably Fiddler)
- Sent
- Pending
MSAL Configuration
auth: {
clientId: config.entraAppClientId,
authority: 'https://login.microsoftonline.com/common',
},
cache: {
cacheLocation: 'localStorage',
},
...(debugEnabled && {
system: {
loggerOptions: {
logLevel: LogLevel.Verbose,
loggerCallback: (level: LogLevel, message: string) => {
switch (level) {
case LogLevel.Error:
console.error(message);
return;
case LogLevel.Info:
console.info(message);
return;
case LogLevel.Verbose:
console.debug(message);
return;
case LogLevel.Warning:
console.warn(message);
return;
}
},
piiLoggingEnabled: false,
},
},
})Relevant Code Snippets
const pca = await createNestablePublicClientApplication({
auth: {
authority: 'https://login.microsoftonline.com/common',
clientId: <clientId>
},
cache: {
cacheLocation: 'localStorage'
}
})
const forceRefreshResult = await pca.acquireTokenSilent({
scopes,
forceRefresh: true,
});
// see tokens are always the same, not being refreshed as should
console.log(forceRefreshResult)Reproduction Steps
- Set up NAA flow to acquire tokens (e.g office-js repo's official example here)
- Set
forceRefreshto true when callingacquireTokenSilent - Use the example add-in and inspect the tokens returned
- See that same tokens are returned over and over again, not being refreshed.
Expected Behavior
When setting forceRefresh to true, refreshed tokens should be returned (expiry extended).
Identity Provider
Entra ID (formerly Azure AD) / MSA
Browsers Affected (Select all that apply)
Chrome, Firefox, Edge
Regression
No response