question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Fetching multiple access tokens silently only succeeds for one token

See original GitHub issue

I’m submitting a…


[x] Regression (a behavior that used to work and stopped working in a new release)
[x] Bug report  
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request
[ ] Other... Please describe:

Browser:

  • Chrome version XX
  • Firefox version XX
  • IE version XX
  • Edge version XX
  • Safari version XX

Library version


Library version: 1.0.0

Current behavior

When trying to fetch two access tokens silently at the same time after a login, only one of the responses actually includes the access token. When refreshing, one token gets fetched from the cache which makes the other token response succeed.

Expected behavior

Both token responses should succeed in getting the token.

Minimal reproduction of the problem with instructions

const msal = new Msal.UserAgentApplication(config);

// after a user has logged in
msal.acquireTokenSilent({ scopes: ['user.read'] })
.then(response => {
  // do something with access token
})

msal.acquireTokenSilent({ scopes: ['api://myapiguid/Read'] })
.then(response => {
  // do something with access token
})

When doing the above, either of the responses will not contain an access token, as they are being run at the same time. This used to work in the previous version of msal, 0.2.4 if I recall correctly.

When doing the following workaround, the tokens are being acquired correctly:

msal.acquireTokenSilent({ scopes: ['user.read'] })
.then(response => {
  // do something with access token

  return msal.acquireTokenSilent({ scopes: ['api://myapiguid/Read'] });
})
.then(response => {
  // do something with access token
})

Which suggests that the tokens are not being successfully acquired when attempting to do so at the same time.

Edit: After some more testing, it correctly delays one request until the other one is done. I’m not really sure why, but before the issue happened as explained above. I’m not sure if something changed that affected this, so I’m leaving the issue open in case it happens again.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Reactions:1
  • Comments:7 (4 by maintainers)

github_iconTop GitHub Comments

1reaction
pkanher617commented, Jun 18, 2019

@raikoss @ThomasJacob Re-opening because I was able to repro. I have added a fix for this in PR #768. Can you please check if this fixes your issue? I will push a patch as soon as I have confirmed that it sufficiently fixes the issue.

0reactions
raikosscommented, Jun 19, 2019

The changes in the pull request seems to fix the issue.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Single-page application: Acquire a token to call an API
The pattern for acquiring tokens for APIs with MSAL.js is to first attempt a silent token request by using the acquireTokenSilent method.
Read more >
Configure Silent Authentication - Auth0
You can make a silent authentication request to get new tokens as long as the user still has a valid session at Auth0....
Read more >
Clarification on the Implicit Grant Flow and ID/Access Token ...
It implicitly fetches a token through the client for a registered resource. You can check the method's source code for reference.
Read more >
The Ultimate Guide to handling JWTs on frontend clients ...
JWTs are a popular way of handling auth. Learn what a JWT is, its pros/cons & the best practices in implementing JWT on...
Read more >
OpenID Connect explained | Connect2id
Its formula for success: simple JSON-based identity tokens (JWT), ... Based on the OAuth 2.0 protocol: The ID token is obtained via a...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found