Looping clients will be interrupted

Effective date: March 25, 2019 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: All flows Client applications can sometimes misbehave, issuing hundreds of the same login request over a short period of time. These requests may or may not be successful, but they all contribute to poor user experience and heightened workloads for the IDP, increasing latency for all users and reducing availability of the IDP. These applications are operating outside the bounds of normal usage, and should be updated to behave correctly. Clients that issue duplicate requests multiple times will be sent an invalid_grant error: AADSTS50196: The server terminated an operation because it encountered a loop while processing a request. Most clients won't need to change behavior to avoid this error. Only misconfigured clients (those without token caching or those exhibiting prompt loops already) will be impacted by this error. Clients are tracked on a per-instance basis locally (via cookie) on the following factors: User hint, if any Scopes or resource being requested Client ID Redirect URI Response type and mode Apps making multiple requests (15+) in a short period of time (5 minutes) will receive an invalid_grant error explaining that they're looping. The tokens being requested have sufficiently long-lived lifetimes (10 minutes minimum, 60 minutes by default), so repeated requests over this time period are unnecessary. All apps should handle invalid_grant by showing an interactive prompt, rather than silently requesting a token. To avoid this error, clients should ensure they're correctly ca…

Permanent link to this revision