Microsoft-authentication-library-for-js: @azure/[email protected] keeps me logged in

[wadeV12]

Library

• [x] [email protected]
• [x] @azure/[email protected]

Framework

Angular 7.2.16

Description

I've updated from @azure/[email protected] which used [email protected] to @azure/[email protected] and it uses [email protected]. On old version when I close a tab and want to visit page again it was required to enter your credentionals again, the same behaviour was with openning app in new tab. But once I've updated it login me back again without redirecting to login page. The sessionStorage and cookies are empty but nevermind it login me.

Regression

• [x] Did this behavior work before?

MSAL Configuration

config: {
      auth: {
        clientId: 'SOME_VALUE',
        authority: 'https://ХХХ.b2clogin.com/tfp/ХХХ.onmicrosoft.com/B2C_1A_SignUp_SignIn',
        validateAuthority: false,
        postLogoutRedirectUri: 'http://localhost:3000',
        redirectUri: 'http://localhost:3000',
        navigateToLoginRequestUrl: false,
      },
      cache: {
        cacheLocation: 'sessionStorage',
      }
    },
    angularConfig: {
      consentScopes: [
        'https://ХХХ.onmicrosoft.com/api/api.Write',
        'https://ХХХ.onmicrosoft.com/api/api.Read',
        'https://ХХХ.onmicrosoft.com/api/user_impersonation',
        'openid',
        'profile'
      ],
      protectedResourceMap: [
        [
          'SOME_URL',
          [
            'https://ХХХ.onmicrosoft.com/api/api.Write',
            'https://ХХХ.onmicrosoft.com/api/api.Read',
            'https://ХХХ.onmicrosoft.com/api/user_impersonation',
            'openid',
            'profile'
          ]
        ],
        ['https://graph.microsoft.com/v1.0/me', ['user.read']]
      ]
    }

Expected behavior

Once I close tab or open new tab I have to enter my credentionals again.

[anth-git]

Check this out https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/1785

[jmckennon]

@wadeV12 yeah, what @anth-git linked from the other day should help out here. You can set prompt to select_account which will force logins. The constant logging in ever across tabs has to do with how credentials are stored in AAD rather than in the browser. Please let us know if you have further questions.