InteractionRequiredAuthError not caught in AuthCodeMSALBrowserAuthenticationProvider

Open

#1,969 opened on Sep 7, 2025 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 55/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Stale
Tech stack: typescript
Domain: authentication

Research direction

Start with src/authentication/msal-browser/AuthCodeMSALBrowserAuthenticationProvider.ts, especially the getAccessToken path referenced in the issue, and reproduce the request with a newly added scope. Confirm that an InteractionRequiredAuthError caused by missing consent reaches the configured popup or redirect flow and that the Graph request can then succeed.

Written by the indexing model from the issue text.

Description

status:waiting-for-triage type:bug

Describe the bug

I am trying to increment my consent using and new scope using the AuthCodeMSALBrowserAuthenticationProvider but the browser doesn't prompt for interaction via the specified interaction type. (Popup / Redirect)

Expected behavior

If the scope doesn't exist the existing token the user should be prompted to consent.

How to reproduce

Setup the AuthCodeMSALBrowserAuthenticationProvider with a scope not previously consented.

const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(
      instance as PublicClientApplication,
      {
        scopes: ["User.Read", "User.ReadBasic.All"],
        account: instance.getActiveAccount()!,
        interactionType: InteractionType.Redirect,
      }
    );

Attempt to call the GraphClient

const graphClient = Client.initWithMiddleware({
  authProvider,
});

const user: User = await graphClient
    .api("/me")
    .select([
      "displayName",
      "givenName",
      "id",
      "mail",
      "mobilePhone",
      "officeLocation",
      "preferredLanguage",
      "surname",
      "userPrincipalName",
      "jobTitle",
      "companyName",
    ])
    .get();

SDK Version

3.0.7

Latest version known to work for scenario above?

No response

Known Workarounds

Specify the scopes in initial interactive login.

Debug output

Click to expand log

```

Uncaught (in promise) _GraphError: invalid_grant: AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' named 'xxxxxxx'. Send an interactive authorization request for this user and resource. Trace ID: 53d15b9f-5e08-4e70-90fc-1448ddff9000 Correlation ID: 01992380-12dc-70c6-a2a2-33f9f074dd3b Timestamp: 2025-09-07 09:27:00Z

</details>


### Configuration

_No response_

### Other information

It would seem that the error thrown is not being caught as an instance of InteractionRequiredAuthError here.

[AuthCodeMSALBrowserAuthenticationProvider.ts](https://github.com/microsoftgraph/msgraph-sdk-javascript/blame/db1757abe7a4cad310f0cd4d7d2a83b961390cce/src/authentication/msal-browser/AuthCodeMSALBrowserAuthenticationProvider.ts#L65C5-L76C4)

Setting a breakpoint and inspecting the output shows this:-

**error**
: 
Error at new GraphClientError2 (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16797:30) at AuthCodeMSALBrowserAuthenticationProvider2.<anonymous> (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16845:27) at step (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:208:17) at Object.next (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:160:14) at http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:147:67 at new Promise (<anonymous>) at Object.__awaiter (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:129:10) at AuthCodeMSALBrowserAuthenticationProvider2.getAccessToken (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16838:26) at _AuthenticationHandler.<anonymous> (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client.js?v=8e109230:803:52) at Generator.next (<anonymous>)
stack
: 
"Error\n    at new GraphClientError2 (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16797:30)\n    at AuthCodeMSALBrowserAuthenticationProvider2.<anonymous> (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16845:27)\n    at step (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:208:17)\n    at Object.next (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:160:14)\n    at http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:147:67\n    at new Promise (<anonymous>)\n    at Object.__awaiter (http://localhost:5173/node_modules/.vite/deps/chunk-QXXCRS6M.js?v=4882f8fb:129:10)\n    at AuthCodeMSALBrowserAuthenticationProvider2.getAccessToken (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client_authProviders_authCodeMsalBrowser.js?v=3372f56d:16838:26)\n    at _AuthenticationHandler.<anonymous> (http://localhost:5173/node_modules/.vite/deps/@microsoft_microsoft-graph-client.js?v=8e109230:803:52)\n    at Generator.next (<anonymous>)"
[[Prototype]]
: 
Error

**error_1**
: 
InteractionRequiredAuthError: invalid_grant: AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' named 'xxxxx'. Send an interactive authorization request for this user and resource. Trace ID: a78c4369-1ba1-4643-9bc6-a41118743b00 Correlation ID: 01992398-5e93-72f1-97cb-19d935dc8e56 Timestamp: 2025-09-07 09:53:32Z at _ResponseHandler.validateTokenResponse (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:5595:15) at RefreshTokenClient.acquireToken (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:6052:21) at async RefreshTokenClient.acquireTokenWithCachedRefreshToken (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:6109:14)
claims
: 
""
correlationId
: 
"01992398-5eb9-7c07-9a34-c2a893c5371a"
errorCode
: 
"invalid_grant"
errorMessage
: 
"AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' named 'xxxx'. Send an interactive authorization request for this user and resource. Trace ID: a78c4369-1ba1-4643-9bc6-a41118743b00 Correlation ID: 01992398-5e93-72f1-97cb-19d935dc8e56 Timestamp: 2025-09-07 09:53:32Z"
errorNo
: 
65001
name
: 
"InteractionRequiredAuthError"
subError
: 
"consent_required"
timestamp
: 
"2025-09-07 09:53:32Z"
traceId
: 
"a78c4369-1ba1-4643-9bc6-a41118743b00"
message
: 
"invalid_grant: AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' named 'xxxx'. Send an interactive authorization request for this user and resource. Trace ID: a78c4369-1ba1-4643-9bc6-a41118743b00 Correlation ID: 01992398-5e93-72f1-97cb-19d935dc8e56 Timestamp: 2025-09-07 09:53:32Z"
stack
: 
"InteractionRequiredAuthError: invalid_grant: AADSTS65001: The user or administrator has not consented to use the application with ID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' named 'xxxx'. Send an interactive authorization request for this user and resource. Trace ID: a78c4369-1ba1-4643-9bc6-a41118743b00 Correlation ID: 01992398-5e93-72f1-97cb-19d935dc8e56 Timestamp: 2025-09-07 09:53:32Z\n    at _ResponseHandler.validateTokenResponse (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:5595:15)\n    at RefreshTokenClient.acquireToken (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:6052:21)\n    at async RefreshTokenClient.acquireTokenWithCachedRefreshToken (http://localhost:5173/node_modules/.vite/deps/chunk-PJPP7UDJ.js?v=4882f8fb:6109:14)"
[[Prototype]]
: 
_AuthError

Dominant language: TypeScript
Stars: 833
Forks: 240
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Required field with a schema default (ajv useDefaults) can permanently block submission Open

Type/Bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

OpenNSW/nsw-srilanka#497 · Opened Sep 21, 2026
portal pins drifted from wallet main Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

0xMiden/bridge-portal#132 · Opened Sep 21, 2026
[react-doctor] js-length-check-first · src/screens/MapScreen/BoundsEditor.tsx:59 Open

react-doctor severity:warning tech-debt

Difficulty 1/5 Under an hour Newbie friendliness 88/100

digidem/comapeo-cloud-app#403 · Opened Sep 21, 2026
An expired login is reported to Sentry as an error Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ARTPARK-SAHAI-ORG/calibrate-frontend#634 · Opened Sep 21, 2026
Cloudflare scaffold recommends the keyless cloudflare/... model but never declares the AI binding it requires Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

withastro/flue#739 · Opened Sep 21, 2026

More TypeScript issues