microsoft-authentication-library-for-js: Can't catch invalid_grant error after refresh token revoke
Core Library
MSAL.js v2 (@azure/msal-browser)
Core Library Version
2.14.1
Wrapper Library
Not Applicable
Wrapper Library Version
none
Description
We have an Azure AD B2C with custom policies configured. By our security policy we are going to revoke all refresh tokens once user changed his password. The expected behavior is like that;
- Revoke all refresh tokens for a particular user
- Access token is expired for that user
- User initiates any request which under the hood is calling
acquireTokenSilent
- Token endpoint returns
invalid_grant
error - We catch that error and sign the user out immediately.
Even though Msal.js v2 receives this error under the hood, it doesn’t allow developers to detect it and does a silent renew of the access/refresh token pair.
FYI: I’ve explored the source code a little bit and found that there’s no way to abandon silent request execution in the iframe in case of invalid_grant
error. Does it mean that the new feature/flag is required? What do you think?
Here is a reference to the code for your information:
https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/0e8a18c059bbacbd7f68057d1e760d9e52bdfa02/lib/msal-browser/src/app/ClientApplication.ts#L325
Error Message
Only network error with invalid_grant
token endpoint error, which is correct.
Msal Logs
MSAL Configuration
Any relevant B2C config from this repository can be used.
Relevant Code Snippets
Any B2C example from this repository can be used
Reproduction Steps
- Sign in under any Azure AD B2C user.
- Wait for access token expiration (I used minimal access token’s expiration time = 5min).
- In Azure Portal click ‘Revoke sessions’ button for the user.
- In the web app put a breakpoint on
catch
clause of forPublicClientApplication.acquireTokenSilent
- Initiate a request in the web application which will cause a new token acquisition.
Problems:
- Error is not caught (execution flow won’t stop on the breakpoint).
- New refresh token/access token received successfully.
Expected Behavior
- I wanna be able to catch the
invalid_grant
(revoked/expired refresh token) exception and sign the user out immediately.
Generally, we are going to revoke all refresh tokens once user’s changed his password. That’s a part of our security policy.
Identity Provider
Azure B2C Custom Policy
Browsers Affected (Select all that apply)
Chrome, Safari
Regression
No response
Source
External (Customer)
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 16 (3 by maintainers)
I’m facing the same issue. In my case the function
acquireTokenSilent
returnsundefined
when the refresh token is expired. Below follows the log (for readability and privacy purposes, I removed some parts of text).Description
acquireTokenPopup
acquireTokenSilent
, the promise is fulfilled but the authentication result isundefined
Expected behavior
The promise returned by
acquireTokenSilent
is rejected.Actual behavior
It fulfills the promise returned by
acquireTokenSilent
withundefined
.The request logs instead shows the
invalid_grant
error with descriptionAADSTS700084: The refresh token was issued to a single page app (SPA), and therefore has a fixed, limited lifetime of 1.00:00:00, which cannot be extended. It is now expired and a new sign in request must be sent by the SPA to the sign in page.
.Logs
General
Request Headers
Response Header
Request Payload
Response
The library receiving a 400 error from the token endpoint when calling
acquireTokenSilent
is expected and by design. This error should be caught and handled by the library, which will either result in the tokens successfully renewed, or in an interaction required error (if the library is unable to silently renew the refresh token, i.e. the user no longer an active session or third-party cookies are blocked in their browser). Unfortunately, even though we are catching the 400 error, it will still get printed in the console, but that can be ignored (unless if your application is receiving the 400 error in your error handler). Please confirm whether or not your error handler is receiving this error (as opposed to having it just be printed to the console).@Codeluck This would be an enhancement that we do not currently support. You can potentially get the behavior you desire by providing a custom implementation of
INetworkModule
, where you write logic to detect this scenario and throw a new error that isn’t caught by the library.Links:
system.networkClient
in your configuration: https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/src/config/Configuration.ts#L73We are facing the same issue as well, I’m unable to catch the exception in acquireTokenSilent subscription block with instance of InteractionRequiredAuthError