microsoft-authentication: evict dead accounts from the cache instead of retrying them forever - #333638
Open
Tom Harvey (tombuildsstuff) wants to merge 1 commit into
Conversation
…d of retrying them forever This commit fixes an issue where a credential that is permanently invalid sitting in the cache would be continually retried (which will never succeed), rather than being cleaned-up. Instead this commit changes this so that when a credential is permanently invalid (e.g. revoked/expired/deleted — detected via MSAL's bad_token/refresh_token_expired codes on an InteractionRequiredAuthError) - that the account gets evicted from the account cache instead of retrying it indefinitely. This doesn’t interrupt the regular recoverable flow (when consent is required, conditional access, plain interaction prompts) - but does handle when an account has been removed, a credential deleted etc.
Copilot started reviewing on behalf of
Tom Harvey (tombuildsstuff)
August 31, 2026 20:53
View session
Contributor
📬 CODENOTIFYThe following users are being notified based on files changed in this PR: TylerLeonhardtMatched files:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Evicts permanently invalid Microsoft authentication accounts instead of repeatedly retrying silent authentication.
Changes:
- Detects MSAL
bad_tokenandrefresh_token_expirederrors. - Removes affected cached accounts while retaining recoverable accounts.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if (isPermanentlyInvalidAccountError(e)) { | ||
| this._logger.info(`[getAllSessionsForPca] [${scopeData.scopeStr}] [${account.username}] refresh token is permanently invalid, removing account`); | ||
| try { | ||
| await cachedPca.removeAccount(account); |
| try { | ||
| await cachedPca.removeAccount(account); | ||
| } catch (removeError) { | ||
| this._logger.error(`[getAllSessionsForPca] [${scopeData.scopeStr}] [${account.username}] failed to remove account`, JSON.stringify(removeError)); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit fixes an issue where a credential that is permanently invalid sitting in the cache would be continually retried (which will never succeed), rather than being cleaned-up.
Instead this commit changes this so that when a credential is permanently invalid (e.g. revoked/expired/deleted — detected via MSAL's bad_token/refresh_token_expired codes on an InteractionRequiredAuthError) - that the account gets evicted from the account cache instead of retrying it indefinitely.
This doesn’t interrupt the regular recoverable flow (when consent is required, conditional access, plain interaction prompts) - but does handle when an account has been removed, a credential deleted etc.