User is required to re-login after browser restart despite using LocalStorage cache

[prrami]

Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

^5.1.0

Wrapper Library

MSAL Angular (@azure/msal-angular)

Wrapper Library Version

^5.0.0

Public or Confidential Client?

Public

Description

I am using the MSAL Angular standalone sample application and have configured the cache location to LocalStorage.

However, even after a successful login, when I completely close the browser and relaunch it, the application prompts the user to log in again.

Based on my understanding, using BrowserCacheLocation.LocalStorage should persist the authentication state across browser sessions, and the user should not be required to log in again.

Error Message

Even after a successful login, when I completely close the browser and relaunch it, the application prompts the user to log in again.

MSAL Logs

No response

Network Trace (Preferrably Fiddler)

• Sent
• Pending

MSAL Configuration

auth: {
      clientId: environment.msalConfig.auth.clientId,
      authority: environment.msalConfig.auth.authority,
      redirectUri: 'http://localhost:4200',
      postLogoutRedirectUri: '/',
    },
    cache: {
      cacheLocation: BrowserCacheLocation.LocalStorage,
    },
    system: {
      allowPlatformBroker: false, // Disables WAM Broker
      loggerOptions: {
        loggerCallback,
        logLevel: LogLevel.Info,
        piiLoggingEnabled: false,
      },
    },

Relevant Code Snippets

export function MSALInstanceFactory(): IPublicClientApplication {
  return new PublicClientApplication({
    auth: {
      clientId: environment.msalConfig.auth.clientId,
      authority: environment.msalConfig.auth.authority,
      redirectUri: 'http://localhost:4200',
      postLogoutRedirectUri: '/',
    },
    cache: {
      cacheLocation: BrowserCacheLocation.LocalStorage,
    },
    system: {
      allowPlatformBroker: false, // Disables WAM Broker
      loggerOptions: {
        loggerCallback,
        logLevel: LogLevel.Info,
        piiLoggingEnabled: false,
      },
    },
  });
}

Reproduction Steps

To reproduce the issue, clone angular standalone sample :
https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-angular-samples/angular-standalone-sample

I am using the same sample without any change. Just tried cacheLocation : BrowserCacheLocation.LocalStorage & BrowserCacheLocation.SessionStorage.

Expected Behavior

If cacheLocation : BrowserCacheLocation.LocalStorage is used in config then app should not ask user to re-login when they completely close the browser and relaunch it

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

Chrome, Firefox, Edge

Regression

No response

[konstantin-msft]

This is expected behavior starting in msal-browser v4. When using localStorage, auth artifacts are now encrypted with a key stored in a session cookie msal.cache.encryption. This cookie is cleared when the browser is fully closed, rendering the encrypted cache unreadable — the user will need to re-authenticate.

The exception is when the user selects "Keep me signed in" during the Microsoft login prompt. In that case, tokens are stored unencrypted and will persist across browser sessions as you'd expect. See here and here for more details

[prrami]

Hi @konstantin-msft , I’m not seeing the “Keep me signed in” selection pop up after logging in. Could you please help me understand what might be wrong?