-
Notifications
You must be signed in to change notification settings - Fork 211
Closed
Labels
Description
Describe the bug
Loss-of-signout could happen.
To Reproduce
We did not see this in the wild. But these are steps to possibly hit the issue.
Steps to reproduce the behavior:
- app A and app B share same token cache (i.e. they belong to same family of apps)
- app B calls
acquire_token_silent()and is in the middle of waiting network I/O to complete - end user John Doe signs out in app A via
remove_account()(and intend to lend the device to user Jane Doe) - app B finishes network I/O, and adds the same account into cache, thus ends up still keeping John Doe's account for both app A and app B.
Expected behavior
App B should honor the sign out operation from app A.
What you see instead
We did not see this bug in the wild. But these are steps to possibly hit the issue.
The MSAL Python version you are using
All.
Additional context
A solution: to enforce that "save token" operation is always "UPDATE" operation in context of "Silent call". And not "ADD" operation.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Type
Projects
Status
Done