feat(apps): expose skipCache option on token acquisition methods#494
Open
SidU wants to merge 1 commit intomicrosoft:mainfrom
Open
feat(apps): expose skipCache option on token acquisition methods#494SidU wants to merge 1 commit intomicrosoft:mainfrom
SidU wants to merge 1 commit intomicrosoft:mainfrom
Conversation
Add optional `skipCache` parameter to `getBotToken()`, `getGraphToken()`,
and `getAppGraphToken()` that threads through to MSAL's
`acquireTokenByClientCredential({ skipCache })`.
This allows callers to bypass the MSAL token cache after receiving a 401,
forcing a fresh token acquisition from Azure AD. Without this, retry-on-401
logic is ineffective because MSAL returns the same cached (stale) token.
Covers all three credential paths that use `acquireTokenByClientCredential`:
- Client credentials (clientId + clientSecret)
- Federated identity credentials (managed identity + client assertion)
Fully backward-compatible — `skipCache` defaults to `false`, so all
existing callers are unaffected.
Closes microsoft#493
Collaborator
|
This looks good to me.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
skipCacheparameter togetBotToken(),getGraphToken(), andgetAppGraphToken()that threads through to MSAL'sacquireTokenByClientCredential({ skipCache })acquireTokenByClientCredential: client credentials and federated identity credentialsskipCachedefaults tofalseMotivation
MSAL caches tokens with a ~5 minute expiry buffer. A token can become stale between when it's fetched from cache and when the API call completes — particularly during long-running operations (file uploads, streaming sessions, proactive messaging). When this happens, the caller gets a 401 and wants to retry with a fresh token, but calling
getBotToken()/getGraphToken()again returns the same cached token because MSAL still considers it valid.This change lets callers pass
skipCache: trueon retry to force MSAL to acquire a fresh token from Azure AD.Closes #493
Changes
token-manager.tsskipCache?param togetBotToken,getGraphToken,getToken,getTokenWithClientCredentials,getTokenWithFederatedCredentials; pass through toacquireTokenByClientCredential({ scopes, skipCache })app.tsskipCache?param togetBotToken,getAppGraphToken; pass through to TokenManagertoken-manager.spec.tsskipCachebehavior + 4 existing assertions updated forskipCache: falseTest plan
skipCache: trueis forwarded to MSAL for both bot and graph tokensskipCache: false(default) behavior is unchangedtscbuild passes clean