Multiple concurrent RT renewals result in State mismatch error

Please follow the issue template below. Failure to do so will result in a delay in answering your question.

Library

• msal@1.x.x or @azure/msal@1.x.x
• @azure/msal-browser@2.0.1
• @azure/msal-angular@0.x.x
• @azure/msal-angular@1.x.x
• @azure/msal-angularjs@1.x.x

Important: Please fill in your exact version number above, e.g. msal@1.1.3.

Framework

React

Description

Users get an exception “State mismatch error. Please check your network. Continued requests may cause cache overflow.”

Error Message

“State mismatch error. Please check your network. Continued requests may cause cache overflow.”

Security

• Is this issue security related?

Regression

• Did this behavior work before? Version:

MSAL Configuration

    const publicClientApp = new PublicClientApplication({
      auth: {
        clientId: this.clientId,
        authority: this.authority,
        redirectUri: this.loginRedirectUri,
        postLogoutRedirectUri: this.postLogoutRedirectUri
      },
      cache: {
        cacheLocation: "localStorage",
        storeAuthStateInCookie: isIEOrOldEdge // https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/1188#issuecomment-634281307
      },
      system: {
        loadFrameTimeout: 30000,
        tokenRenewalOffsetSeconds: 60,
        loggerOptions: {
          loggerCallback: MsalAuthContext.msalLoggerCallback,
          piiLoggingEnabled: false,
          logLevel: LogLevel.Verbose
        }
      }
    });
    const handleRedirectPromise = publicClientApp
      .handleRedirectPromise()
      .then(response => {
        this.account = response ? response.account : this.getAccount();
        if (!this.account) {
          this.publicClientApp.loginRedirect({
            scopes: this.scopes,
            authority: this.authority
          });
        }
      })
      .catch(error => {
        if (error) {
          this.trackError(error);
        }
      });

Reproduction steps

1. Make multiple acquireTokenSilent calls in parallel with different sets of scopes.
2. When a new RT is needed, two requests to /authorize will be made.
3. One of the requests will fail, as the temporary cache value will be overwritten.

Expected behavior

Browsers/Environment

these are the browsers we have observed so far with this error, may not be just these browsers

• Chrome
• Firefox
• Edge
• Safari
• IE
• Other (Please add browser name here)

[jasonnutter]

@jasonnutter, @jmckennon, is there a timeline on 2.1.1 release? We had to revert back to using 1.x in our app due to this issue: proposed workaround (make token fetches serial) causes perf regression so we can’t take it.

We’ll work to have this fixed soon (by next week, hopefully).

[jasonnutter]

Worked with @thoo1 to determine that this happens when multiple silent RT renewals happen in parallel, as the cached state value gets overwritten for one of the requests. Mitigation is make these requests in serial.