-
Notifications
You must be signed in to change notification settings - Fork 371
Adal.js issues on multiple tabs on a browser #639
Comments
@pratap284 Thank you for pointing out this issue. This is known limitation of the library in multiple tabs when you use localStorage. You should not face these issues if you set cacheLocation to 'sessionStorage' as session storage is not shared between multiple tabs. Can you confirm if this is the case. We are working on making this work in localStorage. |
@pratap284 I have fixed this issue in the dev branch. Can you please check to see if this resolves your issue. We will add this fix to our next release. |
Hi Rohit,
I will pass onto my team and see if they are able to resolve using this code. I will keep you posted with the updates. Thanks for your help.
Thanks
Pratap Penmetsa
Release Engineer
m +1 (480) 878 8413
From: Rohit Narula [mailto:[email protected]]
Sent: Tuesday, November 07, 2017 4:18 PM
To: AzureAD/azure-activedirectory-library-for-js <[email protected]>
Cc: Pratap Penmetsa <[email protected]>; Mention <[email protected]>
Subject: Re: [AzureAD/azure-activedirectory-library-for-js] Adal.js issues on multiple tabs on a browser (#639)
@pratap284<https://github.com/pratap284> I have made a fix for this issue in my branch https://github.com/AzureAD/azure-activedirectory-library-for-js/tree/rn/Issue_639. Can you please check to see if this resolves your issue. We will add this fix to our next release.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub<#639 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AeDxEYOoOqI3jZfnSxvg49OFB90rqgFOks5s0OU3gaJpZM4PzJir>.
|
@pratap284 : Did this solve your issue? |
If you look at the login function in adal.js, you see the following:
When this function is called, the expectedState is set to a new GUID and then stored in localStorage before navigating to the Microsoft login page.
When the Microsoft login pages finish what they are doing, navigation returns to our login page where we detect that it is a callback using AuthenticationContext.isCallback(hash) and then get the request info from the hash by calling AuthenticationContext.getRequestInfo(hash).
In that function, it gets the original state value from the hash and compares it to the value that is stored in localStorage. If it is a match, then it proceeds to give the rest of the information needed.
The problem occurs when we have two or mode tabs opened to our application. Our application tries to auto-refresh the token before it expires. If it is unable to do so silently, it navigates to the login page interactively which usually automatically logs them back in and returns to the target page with no user interaction required. If both tabs do this at the same time, however, the first tab initiates the adal login which creates the state GUID and stored it in local storage. Then, before it has a chance to return with the callback hash, the second tab also calls adal login which creates a new Guid and stores it in local storage. Then the first tab comes back with the response, compares the state from the hash to the state in storage, sees that they don’t match and fails to complete the login (and in our code initiates a new login attempt, created yet another state GUID). Then the second tab returns and checks it’s state against localStorage and finds a mismatch and therefore fails to complete the login and initiates a new login attempt. Then the first tab comes back, fails to complete the login, etc. etc. Both tabs are sent into endless login loops because each of them are messing up each other’s login attempts.
The text was updated successfully, but these errors were encountered: