Token generated by AadHttpClient for API expires if user leaves their browser idle during the day and tab is put to sleep

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

Describe the bug / error

Our company started getting a lot of "unauthorized" errors from our employees using our SharePoint sites when connecting to our own APIs using AadHttpClient. We weren't sure how that was possible since our APIs can't be called unless someone is already authorized and logged into SharePoint.

I did some testing and was able to replicate the issue if I left my browser/tab open and idle for 60+ minutes. I believe this is caused by the new "sleep" feature browsers are adding to save resources. The tab goes to sleep and, when you go back to it, it refreshes the page automatically when "waking" it up. When this refresh happens, the token is invalid and nothing loads on the page because I believe the token is expired at that point and a new one isn't generated by AadHttpClient.

Is there a way to generate a new token every time so I can determine if this is truly the root cause? I added code to retry the API call 3 times if it was unauthorized and that didn't help.

Steps to reproduce

1. Write code that uses AadHttpClient to call an API
2. Open up multiple SharePoint sites in your browser and leave them idle for 60+ minutes
3. Go back to a tab after a tab as been put to "sleep"
4. The tab and page will automatically refresh and call the API
5. The API will validate the token and determine it's invalid.

Expected behavior

A new token is created whenever AadHttpClient is used.