You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Today, in confidential client applications, there needs to be one cache per user/account. And the difficulty is that the token cache custom serialization needs to decide where to serialize the cache based on some information which is not available today in the TokenCacheNotificationArgs.
This was solved in Microsoft.Identity.Web by having the application compute a cache key (then used by the customer serializers to get the blob for the account in the case of the user token cache, or for the app token cache)
Unfortunately, we just learnt from the ASP.NET core team that the way we do it, by using the HttpContext is risky because, in particular, HttpContext is not thread safe, and should be avoided.
Describe the solution you'd like
The proposal is to have MSAL.NET propose a hint for a cache key (that the token cache customer serializers would be free to use or not) based on the flow. We would add a new property to TokenCacheNotificationArgs, of type string, and named SuggestedCacheKey computed as follows:
when the flow is ClientCredentials, return the ClientId (or App_{ClientId}
when the flow is OBO, return the hash of the access token passed-in to call the OBO
for the other flows (including AcquireTokenSilent), use the home account ID when it's available.
Describe alternatives you've considered
Another possibility would be to add to AcquireTokensilent builders for confidential client apps the .WithTokenCacheKey method, but this is not my prefered option.
Additional context
See how things are done today in Microsoft.Identity.Web
Is your feature request related to a problem? Please describe.
Today, in confidential client applications, there needs to be one cache per user/account. And the difficulty is that the token cache custom serialization needs to decide where to serialize the cache based on some information which is not available today in the
TokenCacheNotificationArgs
.This was solved in Microsoft.Identity.Web by having the application compute a cache key (then used by the customer serializers to get the blob for the account in the case of the user token cache, or for the app token cache)
Unfortunately, we just learnt from the ASP.NET core team that the way we do it, by using the HttpContext is risky because, in particular, HttpContext is not thread safe, and should be avoided.
Describe the solution you'd like
The proposal is to have MSAL.NET propose a hint for a cache key (that the token cache customer serializers would be free to use or not) based on the flow. We would add a new property to TokenCacheNotificationArgs, of type string, and named SuggestedCacheKey computed as follows:
Describe alternatives you've considered
Another possibility would be to add to AcquireTokensilent builders for confidential client apps the .WithTokenCacheKey method, but this is not my prefered option.
Additional context
See how things are done today in Microsoft.Identity.Web
https://github.com/AzureAD/microsoft-identity-web/blob/b9457a826dc4f6d7fbafc67d37f06b2d6cd2acd3/src/Microsoft.Identity.Web/TokenCacheProviders/MsalAbstractTokenCacheProvider.cs#L60-L75
and what issue this provokes, as described in issue AzureAD/microsoft-identity-web#235
The text was updated successfully, but these errors were encountered: