Login fails when opening multiple tabs at once

[alexgagnon]

Please provide us with the following information:

This issue is for a: (mark with an x)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Set your browser to open multiple tabs to localhost:3000/users/id on startup

Any log messages given by the failure

One tab will login, but the others will all show something like

invalid_grant: 501481 - [2023-12-15 16:48:51Z]: AADSTS501481: The Code_Verifier does not match the code_challenge supplied in the authorization request. Trace ID: *** Correlation ID: *** Timestamp: 2023-12-15 16:48:51Z - Correlation ID: *** - Trace ID: ***

Expected/desired behavior

All tabs should log in.

OS and Version?

Windows 10

Versions

@azure/msal-node": "^1.17.3

Mention any other details that might be useful

This seems to be due to how each request will start to initiate a login process, but since there is no session to share amongst the tabs the first tab to respond with the Set-Cookie header will force the others to then use the login codes associated to that tab instead of the ones they had used to initiate the call to login with MS.

---

Thanks! We'll be in touch soon.

[alexgagnon]

I seem to be able to "solve" this by putting in a delay before routing to /signin. This causes all the tabs to resolve to a single session cookie before making the request to the login endpoint. Would this be considered a reasonable approach?

async function isAuthenticated(req, res, next) {
    if (!req.session.isAuthenticated) {
        await new Promise(resolve => setTimeout(resolve, 2000))
        return res.redirect(`/auth/signin`);
    }

    next();
};

NOTE: this doesn't work if in express-session you use resave: true

[alexgagnon]

After investigating further, my solution above does not work at scale as when under load it causes a buildup of connections and degrades the server performance. So, is there a recommended strategy to resolve this?

[alexgagnon]

Any suggestions on this?