forceRefresh does not work as intended with NAA

[tomaskukk]

Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

4.0.2

Wrapper Library

Not Applicable

Wrapper Library Version

None

Public or Confidential Client?

Public

Description

Force refresh not working as intended with NAA

In the 4.0.2 release to msal-browser, support for forceRefresh was added to NAA. This doesn't help with what it's supposed to though.

There is a known issue with expired ID tokens being served from cache. Regular workaround for this is would be to use forceRefresh, but it doesn't do any good with NAA. Setting this flag to true, will skip the cache check, and then call bridgeProxy.getTokenSilent which will yield the same tokens, which aren't refreshed.

This is a huge issue, as there is no way to force refresh an expired ID token using NAA.

Error Message

No response

MSAL Logs

Network Trace (Preferrably Fiddler)

• [ ] Sent
• [ ] Pending

MSAL Configuration

auth: {
      clientId: config.entraAppClientId,
      authority: 'https://login.microsoftonline.com/common',
    },
    cache: {
      cacheLocation: 'localStorage',
    },
    ...(debugEnabled && {
      system: {
        loggerOptions: {
          logLevel: LogLevel.Verbose,
          loggerCallback: (level: LogLevel, message: string) => {
            switch (level) {
              case LogLevel.Error:
                console.error(message);

                return;
              case LogLevel.Info:
                console.info(message);

                return;
              case LogLevel.Verbose:
                console.debug(message);

                return;
              case LogLevel.Warning:
                console.warn(message);

                return;
            }
          },
          piiLoggingEnabled: false,
        },
      },
    })

Relevant Code Snippets

const pca = await createNestablePublicClientApplication({
  auth: {
    authority: 'https://login.microsoftonline.com/common',
    clientId: <clientId>
  },
  cache: {
    cacheLocation: 'localStorage'
  }
})

const forceRefreshResult = await pca.acquireTokenSilent({
    scopes,
    forceRefresh: true,
});

// see tokens are always the same, not being refreshed as should
console.log(forceRefreshResult)

Reproduction Steps

1. Set up NAA flow to acquire tokens (e.g office-js repo's official example here)
2. Set forceRefresh to true when calling acquireTokenSilent
3. Use the example add-in and inspect the tokens returned
4. See that same tokens are returned over and over again, not being refreshed.

Expected Behavior

When setting forceRefresh to true, refreshed tokens should be returned (expiry extended).

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

Chrome, Firefox, Edge

Regression

No response

[github-actions[bot]]

Invalid Issue Template: Please update the original issue and make sure to fill out the entire issue template so we can better assist you.

[MrDaleQ]

Just to note, we are also seeing this issue and have log files raised on https://github.com/OfficeDev/office-js/issues/5444

@tomaskukk I'm not sure if the js team will look at this whilst its marked as more-information-needed

[tnorling]

Our guidance is to use access tokens for authorization. It is not recommended to validate idTokens at all on the client, you may inspect the claims for information about the user but the expiration is meaningless as it's trivial to change. If you find yourself in a situation where the expiration matters to you, you should be using an access token instead.