I'm getting AADB2C90075 on refresh token? A bug? not sure.

[AhmedBHameed]

Hi there!

We have angular app. We configured the module like this

auth.module.ts

import { CommonModule } from '@angular/common';
import { HTTP_INTERCEPTORS } from '@angular/common/http';
import { NgModule } from '@angular/core';
import {
    MsalBroadcastService,
    MsalGuard,
    MsalGuardConfiguration,
    MsalInterceptor,
    MsalInterceptorConfiguration,
    MsalService,
    MSAL_GUARD_CONFIG,
    MSAL_INSTANCE,
    MSAL_INTERCEPTOR_CONFIG
} from '@azure/msal-angular';
import {
    BrowserCacheLocation,
    InteractionType,
    IPublicClientApplication,
    LogLevel,
    PublicClientApplication
} from '@azure/msal-browser';
import { Ability, PureAbility } from '@casl/ability';
import { environment } from '../../environments/environment';
import { PolicyService } from '../services/policy/policy.service';
import { DevInterceptor } from './dev.interceptor';
import { ErrorInterceptor } from './error.interceptor';
import { LanguageInterceptor } from './local.interceptor';
import { RedirectComponent } from './redirect/redirect.component';

const isIE =
    window.navigator.userAgent.indexOf('MSIE ') > -1 ||
    window.navigator.userAgent.indexOf('Trident/') > -1;

export function getRedirectUrl() {
    return environment.auth.redirectUrl;
}

export function loggerCallback(_: LogLevel, message: string) {
    if (!environment.production) {
        console.log(message);
    }
}

export function MSALInstanceFactory(policyService: PolicyService): IPublicClientApplication {
    const policy =
        policyService.policyBundleSnapshot?.signIn ??
        environment.auth.b2cPolicies.names.signUpSignIn;
    return new PublicClientApplication({
        auth: {
            clientId: environment.auth.clientId,
            authority: `${environment.auth.b2cPolicies.domain}/${policy}`,
            redirectUri: getRedirectUrl(),
            postLogoutRedirectUri: `/${policyService.locale}/logout`,
            knownAuthorities: [environment.auth.b2cPolicies.authorityDomain],
            navigateToLoginRequestUrl: true
        },
        cache: {
            cacheLocation: BrowserCacheLocation.LocalStorage,
            storeAuthStateInCookie: isIE // set to true for IE 11
        },
        system: {
            loggerOptions: {
                loggerCallback,
                logLevel: environment.production ? LogLevel.Error : LogLevel.Info,
                piiLoggingEnabled: false
            }
        }
    });
}

export function MSALInterceptorConfigFactory(): MsalInterceptorConfiguration {
    const protectedResourceMap = new Map<string, Array<string>>();
    const host = environment.api.host,
        originUrl = `${window.location.origin}/auth`,
        clientId = `${environment.auth.clientId}`;

    protectedResourceMap.set('https://graph.microsoft.com/v1.0/me', ['user.read']);
    protectedResourceMap.set(`${host}/auth`, [clientId]);
    protectedResourceMap.set(`${host}/customers`, [clientId]);
    protectedResourceMap.set(`${host}/library`, [clientId]);
    protectedResourceMap.set(`${host}/elearning`, [clientId]);
    protectedResourceMap.set(`${host}/forums`, [clientId]);
    protectedResourceMap.set(`${host}/stats`, [clientId]);
    protectedResourceMap.set(`${host}/event-series`, [clientId]);
    protectedResourceMap.set(`${host}/event-series/me`, [clientId]);
    protectedResourceMap.set(`${host}/assessments`, [clientId]);
    protectedResourceMap.set(`${host}/projects`, [clientId]);

    if (!environment.production) {
        protectedResourceMap.set(`${host}/library`, [clientId]);
        protectedResourceMap.set(`${host}/auth/me`, [clientId]);
    }

    protectedResourceMap.set(environment.api.graphql.server, [clientId]);

    return {
        interactionType: InteractionType.Redirect,
        protectedResourceMap,
        authRequest: {
            state: `redirect_uri_start${originUrl}/redirect_uri_end`,
            extraQueryParameters: { originUrl },
            tokenQueryParameters: { originUrl, grant_type: 'refresh_token' }
        }
    };
}

export function MSALGuardConfigFactory(): MsalGuardConfiguration {
    let extraQueryParameters = { originUrl: window.location.origin };

    const urlParams = new URL(window.location.href).searchParams;

    urlParams.forEach((value, key) => {
        if (key.startsWith('utm_') || key == 'campaign') {
            extraQueryParameters[key] = value;
        }
    });

    return {
        interactionType: InteractionType.Redirect,
        loginFailedRoute: '/',
        authRequest: {
            scopes: [`${environment.auth.clientId}`],
            prompt: 'select_account',
            state: `redirect_uri_start${window.location.origin}/redirect_uri_end`,
            extraQueryParameters,
            tokenQueryParameters: { originUrl: window.location.origin }
        }
    };
}

const devProviders = [
    {
        provide: HTTP_INTERCEPTORS,
        useClass: DevInterceptor,
        multi: true
    }
];

const commonProviders = [
    { provide: HTTP_INTERCEPTORS, useClass: LanguageInterceptor, multi: true },
    { provide: HTTP_INTERCEPTORS, useClass: ErrorInterceptor, multi: true },
    {
        provide: HTTP_INTERCEPTORS,
        useClass: MsalInterceptor,
        multi: true
    },
    {
        provide: MSAL_INSTANCE,
        useFactory: MSALInstanceFactory,
        deps: [PolicyService]
    },
    {
        provide: MSAL_GUARD_CONFIG,
        useFactory: MSALGuardConfigFactory
    },
    {
        provide: MSAL_INTERCEPTOR_CONFIG,
        useFactory: MSALInterceptorConfigFactory
    },
    { provide: Ability, useValue: new Ability() },
    { provide: PureAbility, useExisting: Ability },
    MsalGuard,
    MsalService,
    MsalBroadcastService
];

@NgModule({
    declarations: [RedirectComponent],
    imports: [CommonModule],
    providers: [...commonProviders, !environment.production ? devProviders : []],
    exports: [RedirectComponent]
})
export class AuthModule {}

The app is working however, after idle time, the app refreshes the token but this error is triggered. This error is not reproducable in local machine. We have it on production only and happened randamly. I mean by randamly, I couldn't reproduce this issue with my account MS account in both local and production environment.

Error body:

Console error

Request header

From the images, we can see a grant_type in the body which does not make sense why then we have this error?
I searched a lot about this issue and even the docs are unclear:

Error code	description
AADB2C90075	The claims exchange '{0}' specified in step '{1}' returned HTTP error response with Code '{2}' and Reason '{3}'.

Source

Package.json

        "@azure/msal-angular": "^2.4.5",
        "@azure/msal-browser": "^2.30.0",
        "@angular/core": "^14.2.7",
        "msal": "^1.4.16",

What should I understand here?
Any idea?

[codertapsu]

Is there any solution, guy?

[RayGHeld]

Most likely, your refresh token expired. Refresh tokens for a SPA application type is only good for 24 hours. You will need to catch the error and perform an interactive auth to get a new refresh token: https://learn.microsoft.com/en-us/azure/active-directory/develop/configurable-token-lifetimes#refresh-and-session-token-lifetime-policy-properties