Microsoft-identity-web: [Bug] Incorrect Client Secret being used by IConfidentialClientApplication in TokenAcquisition constructor

[CalamityLorenzo]

Which version of Microsoft Identity Web are you using?
Note that to get help, you need to run the latest version.

Where is the issue?

• Web app
  
  
  
  • [ ] Sign-in users
  
  
  • [ x ] Sign-in users and call web APIs
  
  
• Web API
  
  
  
  • [ ] Protected web APIs (validating tokens)
  
  
  • [ ] Protected web APIs (validating scopes)
  
  
  • [ x ] Protected web APIs call downstream web APIs
  
  
• Token cache serialization
  
  
  
  • [x] In-memory caches
  
  
  • [ ] Session caches
  
  
  • [ ] Distributed caches
  
  
• Other (please describe)

Is this a new or an existing app?
This is a new app

Repro

Startup
 services.AddMicrosoftWebApiAuthentication(Configuration)
                    .AddMicrosoftWebApiCallsWebApi(Configuration)
                    .AddInMemoryTokenCaches();
Controller
ITokenAcquisition.GetAccessTokenForUserAsync(scopes);

Expected behavior
The app to use the ClientSecret inside the AzureAd section of the appsettings.devlopment.json
Actual behavior
A clear and concise description of what happens, e.g. an exception is thrown, UI freezes.
When you make a request, and the following error is returned :
MSAL.NetCore.4.17.0.0.MsalServiceException:
ErrorCode: invalid_client
Microsoft.Identity.Client.MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details.You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS7000215: Invalid client secret is provided.

Possible solution

Additional context / logs / screenshots
The ConfidentialClientApplicationOptions with the erroenous ClientSecret. [Nb this string does not appear anwhere in my code]

[jmprieur]

@CalamityLorenzo would you by any chance use the "Manage User Secrets" feature in Visual Studio (or .NET Core) (when you right click on your project)
If you don't have this client secret in your appsettings.json, it could be that it's in your secrets, and is picked up. This happens to me all the time :)

[CalamityLorenzo]

It couldn't be that simple....Could it
Welllllll.....balls.
This ones going on the wall of shame.
Thanks for the assist.

[jennyf19]

@CalamityLorenzo nice name of your client app. 😆 🏴‍☠️