[React Native] MSAL throws JsonSyntaxException: Expected BEGIN_OBJECT but was STRING from Android layer

[phamngocthachlt6c]

Description

We encountered an exception coming from MSAL Android:
java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 1 path $

This seems to happen when MSAL tries to read token cache from SharedPreferences.

Environment

• MSAL Android version: 2.2.+
• MSAL React Native: 4.0.4
• Platform: React Native (bridge to MSAL Android)
• Android version: multiple
• Device: multiple
• Network condition: may happen when device loses connection or the app is killed

Steps to Reproduce

(We cannot consistently reproduce, but possible scenarios:)

1. App killed while MSAL is saving tokens
2. Internet disconnected during token refresh
3. Concurrent access to MSAL cache

Stack Trace

Error: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 1 path $
at promiseMethodWrapper (address at index.android.bundle:1:195468)
at ?anon_0_ (address at index.android.bundle:1:2661568)
at next (native)
at asyncGeneratorStep (address at index.android.bundle:1:614795)
at next (address at index.android.bundle:1:615053)
at anonymous (address at index.android.bundle:1:615005)
at tryCallTwo (address at InternalBytecode.js:1:1222)
at doResolve (address at InternalBytecode.js:1:2541)
at Promise (address at InternalBytecode.js:1:1318)
at anonymous (address at index.android.bundle:1:614926)
at apply (native)
at acquireTokenSilent (address at index.android.bundle:1:2661511)
at ?anon_0 (address at index.android.bundle:1:2658787)
at next (native)
at asyncGeneratorStep (address at index.android.bundle:1:614795)
at _next (address at index.android.bundle:1:615053)
at tryCallOne (address at InternalBytecode.js:1:1180)
at anonymous (address at InternalBytecode.js:1:1874)
at apply (native)
at anonymous (address at index.android.bundle:1:319608)
at _callTimer (address at index.android.bundle:1:318556)
at _callReactNativeMicrotasksPass (address at index.android.bundle:1:318701)
at callReactNativeMicrotasks (address at index.android.bundle:1:320701)
at __callReactNativeMicrotasks (address at index.android.bundle:1:181351)
at anonymous (address at index.android.bundle:1:180433)
at __guard (address at index.android.bundle:1:181189)
at flushedQueue (address at index.android.bundle:1:180344)
at invokeCallbackAndReturnFlushedQueue (address at index.android.bundle:1:180287)

Expected Behavior

MSAL should handle corrupted or empty cache gracefully and return a recoverable error instead of crashing.

Additional context

We are logging this through Application Insights from the React Native layer.

[github-actions]

Thank you for opening this issue!

Labels Applied:
User-Error: This error is caused by corrupted cache content due to scenarios like app termination, network connectivity issues, or concurrent writes to the token cache. These situations can corrupt the SharedPreferences file used by MSAL..
needs-more-info: The issue description states the use of MSAL Android version 2.2.+, which is an outdated version (according to the version list, it was released in August 2021), and lacks clarity on whether the issue is reproducible with the latest MSAL version..

🤖 AI Analysis

The issue likely originates from unsafe access to MSAL's SharedPreferences token cache, leading to corruption during edge cases like app termination or network connectivity issues. MSAL version 2.2.+ is outdated and does not include the latest fixes to prevent such issues.

Solutions:

1. Upgrade to the Latest Version

   • Update MSAL Android to the latest stable version (at least v8.2.1 as available now) to leverage improvements in cache handling, thread safety, and error resilience.

   implementation 'com.microsoft.identity.client:msal:8.+`

   Ensure you follow the migration guide if upgrading from such an old version, as several APIs may have changed.

2. Handle Corrupted Cache:

   • Wrap your initialization and token operations with error handling for corrupted cache scenarios. If a cache corruption is detected (JsonSyntaxException from SharedPreferences), clear the cache and retry:

     try {
         PublicClientApplication pca = PublicClientApplication.createSingleAccountPublicClientApplication(
             context,
             R.raw.auth_config
         );
     } catch (JsonSyntaxException | IllegalStateException ex) {
         // Cache corruption detected; clear cache and reinitialize PCA
         context.getSharedPreferences("com.microsoft.identity.client.account_track", Context.MODE_PRIVATE).edit().clear().commit();
         PublicClientApplication pca = PublicClientApplication.createSingleAccountPublicClientApplication(
             context,
             R.raw.auth_config
         );
     }

3. Concurrency Handling:

   • Ensure you are making token cache requests (like acquireTokenSilentAsync) in an isolated and single-threaded manner since concurrent access to token cache could lead to corruption.
   • Avoid using acquireTokenSilentAsync in parallel operations without proper thread management.

4. Fallback Mechanism for Silent Token Failure:

   • Implement a fallback to interactive token acquisition for scenarios where cache issues or network issues occur.

     if (exception instanceof MsalUiRequiredException) {
         mPCA.acquireToken(new AcquireTokenParameters.Builder()
             .startAuthorizationFromActivity(activity)
             .withScopes(scopes)
             .withCallback(authCallback)
             .build()
         );
     }

5. Prevent Writing Cache During App Termination:

   • Avoid performing token refresh operations during app termination or on an unstable network. Use foreseen events (like app shutdown) to trigger app state saves earlier.

6. Add Diagnostic Logging:

   • Enable verbose MSAL logging to gather more details and detect cache handling issues:

     Logger.getInstance().setLogLevel(Logger.LogLevel.VERBOSE);
     Logger.getInstance().setEnableLogcatLog(true);
     Logger.getInstance().setEnablePII(true); // Debug only, never in production

Related Issues: #1539, #1568, #1663, #1765, #2097

---

📦 MSAL Version Update Available

You are using MSAL version 2.2.+. The latest version is 8.2.1.

We recommend updating to the latest version to benefit from bug fixes, security improvements, and new features.

implementation "com.microsoft.identity.client:msal:8.+"

Using 8.+ automatically gets patch updates within the 8.x series.

---

To help us assist you, please provide:

• Android version and device
• Complete error message/stack trace
• Steps to reproduce

---

Need help? Comment with:

PING-COPILOT: <your question>

Privacy: Do not include credentials, tokens, or PII in PING-COPILOT requests.