mardi 1 novembre 2022

Should I try an MSAL getTokenSilent() before any request for a protected resource?

I'm integrated the MSAL JS library with an EmberJS SPA. In the current implementation I have a getTokenSilent() call before a user requests a "protected" resource. This means that after a user Authenticates, they collect a new access token before the resource is requested.

Is this intended? Aside from an extra network request I don't see many drawbacks. It should allow for very short-lived access tokens and allow MSAL to check that a user is still in a "valid" state (ie they haven't had their account disabled) since they logged in.

I'm very new to OAUTH and MSAL so some guidance would be great.




Aucun commentaire:

Enregistrer un commentaire