[Feature Request] Audit all /token parameters

[bgavrilMS]

MSAL client type

Confidential, Managed identity

Problem statement

Extensiblity APIs can lead to bad token caching, where ppl don't realize that tokens aren't actually cached by all params. We need to limit this by enhancing caching, by making extensiblity APIs not for production (they should be already):

• if WithExtraQueryParameters, cache tokens by those params
• introduce WithBodyParamters, cache tokens by those params (maybe have an allow-list of params that do not impact caching)
• audit ID.Web's and other SDKs usage of OnBeforeTokenRequest and how caching is impacted.

Proposed solution

No response

Alternatives

No response

[github-actions]

This issue is related to security. Please pay attention.

Powered by issue-sentinel

[bgavrilMS]

Ideas:

• make OnBeforeTokenRequest experimental
• make WithExtraQueryParameters experimental
• audit ID.Web's and other SDKs usage of OnBeforeTokenRequest and how caching is impacted.
• discuss with eSTS to find out what extra qp apps are using in the wild. Get a list of params and their meaning. Use that to decide if we are to partition the cache or not. Important to differentiate between S2S and C2S.