Fix repeated silent authentication failures caused by stale refresh tokens

[GaspardRuan (gaspardruan)]

Fixes #335639

Problem

I investigated this after Settings Sync continued to show “Sign in to Sync Settings” following a successful Microsoft sign-in on macOS. Logs showed createSession returning a session, followed by getSessions returning no sessions after AADSTS700082. I can no longer reproduce the original sign-in failure with my real account. Instead, the tests use a simulated account, synthetic tokens, and simulated identity-server responses with the real MSAL library and VS Code authentication code to reproduce the token-cache defect described below. The same regression tests fail on the original code and pass with the proposed fix.

The Microsoft authentication extension's current MSAL dependency can repeatedly reload a rejected refresh token from persisted storage. MSAL removes the token from memory on an invalid_grant / bad_token response, but does not call the persistence callback on that failure path.

When a rejected family refresh token coexists with a fresh application refresh token for the same account, repeated silent requests keep submitting the family token and failing despite the fresh credential being available.

Reproduction

See #335639 for the reproduction steps, expected results before and after the fix, and an auxiliary standalone MSAL reproduction.

Fix

Persist MSAL's removal of the rejected token before retrying silent authentication once, within the existing PCA sequencer. Apply this to ordinary silent acquisition and ID-token refresh. Broker authentication and unrelated errors keep their existing behavior.

If the persisted cache changed while the request was in flight, reload it instead of writing the failed request's snapshot. This check is not atomic with the subsequent write, so a concurrent update between them can still be overwritten. A concurrent cache change can also exhaust the retry, requiring a subsequent session request.

[vs-code-engineering]

📬 CODENOTIFY

The following users are being notified based on files changed in this PR:

TylerLeonhardt

Matched files:

• extensions/microsoft-authentication/src/common/cachePlugin.ts
• extensions/microsoft-authentication/src/node/cachedPublicClientApplication.ts
• extensions/microsoft-authentication/src/node/test/tokenCache.test.ts
• extensions/microsoft-authentication/src/node/tokenCache.ts

[GaspardRuan (gaspardruan)]

@microsoft-github-policy-service agree

[Copilot]

🟢 Approval recommended

The focused implementation matches the described failure mode and has comprehensive regression coverage.

Pull request overview

Fixes repeated Microsoft authentication failures by persisting MSAL’s rejected refresh-token removal before a bounded retry.

Changes:

• Adds cache-aware silent token acquisition with one retry.
• Preserves concurrent SecretStorage updates.
• Adds regression and concurrency coverage.

File summaries

File	Description
common/cachePlugin.ts	Handles cache persistence after authentication failures.
node/tokenCache.ts	Implements invalidation and bounded retry logic.
node/cachedPublicClientApplication.ts	Integrates recovery into non-broker silent authentication.
node/test/tokenCache.test.ts	Tests recovery, persistence, errors, and concurrent updates.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.