details of data stored in local storage required

[tickoosunny]

Hi team,

I am using this library in one of my react apps and have found that there is lot of data being captured in local storage as listed in below screenshot

Now in order to frame my cookie policy and privacy policy, I want to know few things for these fields as below:

1. Apart from ID Token and authentication related fields can I get the documentation of remaining fields ?

2. Is any of these fields being used as part of any user tracing activity or by any mean should I be concerned for GDPR for any of these fields?

3. What are the fields like below used for :

            - msal.XXXXXXXXXXXXXXXXXXXX.error.description
            - msal.acquireTokenAccount|XXXXXXXXXXXXXXXXXXXX
                          -Trace ID: What is this used for 
                          - Correlation ID: What is this used for
            - msal.client.info
   

Thanks & regards,
Susheel Tickoo

[jasonnutter]

Apart from ID Token and authentication related fields can I get the documentation of remaining fields ?

We don't have documentation detailing all of the data put into browser storage by MSAL.js. Generally speaking, data stored by MSAL.js falls into one of these categories:

• Persistent auth artifacts (access tokens, id tokens, refresh tokens, accounts)
• Temporary auth artifacts (request metadata, e.g. state, nonce, authority, errors, interaction status, etc)
• Telemetry (e.g. previous failed request, perf data, etc)

Is any of these fields being used as part of any user tracing activity or by any mean should I be concerned for GDPR for any of these fields?

Please see Microsoft's guidance on GDPR here: https://docs.microsoft.com/compliance/regulatory/gdpr

@hpsin Any further guidance?

What are the fields like below used for :

• msal.XXXXXXXXXXXXXXXXXXXX.error.description: latest error received by the library
• msal.acquireTokenAccount|XXXXXXXXXXXXXXXXXXXX: Cached account
• Trace ID / Correlation ID: per request identifiers used by AAD. Not PII.
• msal.client.info: Base64 encoded metadata for the user.

[derisen]

@jasonnutter should this be documented?

[tickoosunny]

Thanks for these valuable insights @jasonnutter ,

I will really apricate to have a view of what are these fields used for in terms of business process ?
Like are these only used for technical implementations or is there any other use of these fields ?

What do we do with cached account data ?
What do we do with Trace ID / Correlation ID in AAD ?
What do we do with the metadata ?

Thanks & regards,
Susheel Tickoo

[jasonnutter]

MSAL.js exists to help facilitate authentication and authorization for your applications. The outcome of those operations are tokens, which an application decides how to use. The data in browser storage is either those artifacts or metadata that used generated and/or used while acquiring those artifacts.

What do we do with cached account data ?

Accounts are used to store authentication state, and to instruct MSAL which user to acquire tokens for.

What do we do with Trace ID / Correlation ID in AAD ?

These pieces of data are used for debugging purposes (i.e. for the MSAL team to check internal AAD logs).

What do we do with the metadata ?

See above.