Getting 'monitor_window_timeout' and 'X-Frame-Options set to deny' error when login with facebook account

Core Library

MSAL.js v2 (@azure/msal-browser)

Core Library Version

2.22.0

Wrapper Library

MSAL React (@azure/msal-react)

Wrapper Library Version

1.3.0

Description

We’re getting an error sometimes when login with facebook. It’s hard to say how this error is triggered, it looks like when we change between our applications or environments the error occurs but I don’t know the real trigger. Apparently this error is prompted only with facebook accounts and if I clear all the application cache storage and refresh the page then I am able to login correctly with facebook account.

Error Message

Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

Uncaught (in promise) Error: BrowserAuthError: monitor_window_timeout: Token acquisition in iframe failed due to timeout. For more visit: aka.ms/msaljs/browser-errors.

Msal Logs

MSAL Configuration

{
  auth: {
    clientId: process.env.REACT_APP_AZURE_B2C_CLIENT_ID,
    authority: b2cPolicies.authorities.signUpSignIn.authority,
    knownAuthorities: [
      b2cPolicies.authorityDomain,
      b2cPolicies.authorities.signUpSignIn.authority,
      b2cPolicies.authorities.changePassword.authority,
      b2cPolicies.authorities.editProfile.authority,
    ],
    redirectUri: process.env.REACT_APP_AZURE_B2C_REDIRECT_URI,
    postLogoutRedirectUri: process.env.REACT_APP_AZURE_B2C_POST_LOGOUT_URI,
  },
  cache: {
    cacheLocation: 'localStorage',
  },
  system: {
    loggerOptions: {
      loggerCallback: (level, message, containsPii) => {
        if (containsPii) {
          return;
        }
        switch (level) {
          case LogLevel.Error:
            console.error(message);
            return;
          case LogLevel.Info:
            console.info(message);
            return;
          case LogLevel.Verbose:
            console.debug(message);
            return;
          case LogLevel.Warning:
            console.warn(message);
        }
      },
    },
  },
}

Relevant Code Snippets

Here is how we get the token silently


instance
          .acquireTokenSilent({
            authority: b2cPolicies.authorities.signUpSignIn.authority,
            scopes: ['openid', process.env.REACT_APP_AZURE_B2C_SCOPES],
            account,
            forceRefresh: true,
          })
          .then(response => {
            if (response) {
              setUser({
                ...account.idTokenClaims,
                token: response.accessToken,
              });
            }
          })
          .catch(err => {
            if (err instanceof InteractionRequiredAuthError) {
              const request = {
                authority: b2cPolicies.authorities.signUpSignIn.authority,
                scopes: loginRequest.scopes,
                prompt: 'login',
              };
              return instance.acquireTokenRedirect(request);
            }
            throw Error(err);
          });

Reproduction Steps

1. Go to the application url and get redirected to SSO login page
2. Login with facebook account
3. SSO redirects back to the application with the error prompted in console

Expected Behavior

1. Go to the application url and get redirected to SSO login page
2. Login with facebook account
3. SSO redirects back to the application and retrieve the token correctly

Identity Provider

Azure B2C Custom Policy

Browsers Affected (Select all that apply)

Chrome, Firefox

Regression

No response

Source

External (Customer)

[msftbot[bot]]

This issue requires attention from the MSAL.js team and has not seen activity in 5 days. @pkanher617 please follow up.

[msftbot[bot]]

@ranzolinrafa This issue has been automatically marked as stale because it is marked as requiring author feedback but has not had any activity for 5 days. If your issue has been resolved please let us know by closing the issue. If your issue has not been resolved please leave a comment to keep this open. It will be closed automatically in 7 days if it remains stale.