Incorrect Scopes doesn't lead to error when acquiring token

[72gm]

Core Library

MSAL.js v2 (@azure/msal-browser)

Core Library Version

2.28.1

Wrapper Library

MSAL React (@azure/msal-react)

Wrapper Library Version

1.4.5

Public or Confidential Client?

Public

Description

When I call B2C to get an Access Token using incorrect scopes I would expect to get an error.

Currently it returns a response with an empty access token?

Error Message

No error - this is the issue

Msal Logs

simple issue, not required

MSAL Configuration

simple issue, not required

Relevant Code Snippets

simple issue, not required

Reproduction Steps

In your config add a 1 to the names of your scopes
"scopes": [
"https://xxxxxxx.onmicrosoft.com/web-portal/documents1.read",
"https://xxxxx.onmicrosoft.com/web-portal/appeals1.read"
]

Use the aquire token method
aquireAccessToken(instance, accounts[0], theScopes)
.then((res) => {
console.log('RES: ', res);
setTheToken(res.accessToken);
})
.catch((error) => {
console.log('Error: ', error);
if (
error instanceof InteractionRequiredAuthError ||
error instanceof BrowserAuthError
) {
instance.logoutRedirect();
}
});

Check the RES result printed out

Expected Behavior

An error should be thrown when trying to acquire an access token with invalid scopes as the method is called "aquireAccessToken" and this has failed

Identity Provider

Azure B2C Custom Policy

Browsers Affected (Select all that apply)

Chrome

Regression

No response

Source

External (Customer)

[tnorling]

@72gm This is not something the MSAL SDK controls but rather the B2C service. Please open an issue with the B2C service. Instructions on how to do that can be found here