Skip to content

Reload certificates for all client credential based issues - #3430

Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged

Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom
tlupes:RetryOnAllFailures

Conversation

@tlupes

@tlupesTom (tlupes) commented Jul 22, 2025•
edited
Loading

Copy link
Copy Markdown
Collaborator

Reload certificates for all client credential based issues

  • You've read the Contributor Guide and Code of Conduct.
  • You've included unit or integration tests for your change, where applicable.
  • You've included inline docs for your change, where applicable.
  • There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Change retry logic to reload certificates on all credential issues, not just revocation/expiration.

Description

The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:

  • The certificate has been revoked.
  • The certificate has expired.

There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.

As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.

Fixes#3429

@tlupes
Tom (tlupes) requested a review from a team as a code ownerJuly 22, 2025 13:09
@tlupes

Tom (tlupes) commented Jul 22, 2025

Copy link
Copy Markdown
CollaboratorAuthor

I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)

@tlupes

Tom (tlupes) commented Jul 22, 2025

Copy link
Copy Markdown
CollaboratorAuthor

Integration tests all happy locally!

@jmprieur

Jean-Marc Prieur (jmprieur) commented Jul 30, 2025

Copy link
Copy Markdown
Collaborator

discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it

@jmprieur
Jean-Marc Prieur (jmprieur) merged commit d50a268 into AzureAD:masterJul 30, 2025
5 checks passed
This was referenced Aug 15, 2025
Merged
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced May 1, 2026
Closed
Merged
Merged
Closed
Closed
Closed
Open
Closed
Open
Open
Closed
Merged
This was referenced May 11, 2026
Closed
Merged
Merged
@dependabotdependabotBot mentioned this pull request May 26, 2026
Closed
@dependabotdependabotBot mentioned this pull request Jun 3, 2026
Open
This was referenced Jun 19, 2026
Merged
Closed
This was referenced Jul 2, 2026
Closed
Closed
Closed
This was referenced Jul 13, 2026
Closed
Closed
Open
This was referenced Aug 12, 2026
Merged
Open
Open
This was referenced Aug 19, 2026
Closed
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes
+1 more reviewer
@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues

4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Reload certificates for all client credential based issues by tlupes · Pull Request #3430 · AzureAD/microsoft-identity-web · GitHub
Skip to content
Reload certificates for all client credential based issues - #3430
Merged
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Jul 30, 2025
Merged
Reload certificates for all client credential based issues#3430
Jean-Marc Prieur (jmprieur) merged 1 commit into
AzureAD:masterfrom 
tlupes:RetryOnAllFailures
Conversation
@tlupes
@tlupesTom (tlupes)
commented
Jul 22, 2025•

edited

Loading

Copy link


Copy Markdown

Collaborator
Reload certificates for all client credential based issues
  •  You've read the Contributor Guide and Code of Conduct.
  •  You've included unit or integration tests for your change, where applicable.
  •  You've included inline docs for your change, where applicable.
  •  There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.
Change retry logic to reload certificates on all credential issues, not just revocation/expiration.
Description
The current behavior of the library is to reload and retry certificates in the event that the certificate fails for one of the following two issues:
  • The certificate has been revoked.
  • The certificate has expired.
There is a great many other reasons that authentication can fail that fall outside of these two scenarios. If any of those additional scenarios occur the certificate will never be reloaded.
As a result, if a bad certificate is installed on the machine and picked up, and subsequently rotated, a service restart is needed for the new certificate to be used.
Fixes#3429
@tlupes
Tom (tlupes)
requested a review
from a team
as a code ownerJuly 22, 2025 13:09
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
I am not sure how I can run the extended tests locally (I get credential missing issues even without this change). If they aren't run during merge, let me know how I can run them locally :)
@tlupes
Tom (tlupes)
commented
Jul 22, 2025

Copy link


Copy Markdown

CollaboratorAuthor
Integration tests all happy locally!
@jmprieur
Jean-Marc Prieur (jmprieur)
commented
Jul 30, 2025

Copy link


Copy Markdown

Collaborator
discussed risks with Bogdan for other invalid_client (bad GUID). This is only one retry so taking it
@jmprieur
Jean-Marc Prieur (jmprieur)
merged commit d50a268
into
AzureAD:masterJul 30, 2025

5 checks passed


This was referenced Aug 15, 2025
 Merged

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed

 Closed


This was referenced May 1, 2026
 Closed

 Merged

 Merged

 Closed

 Closed

 Closed

 Open

 Closed

 Open

 Open

 Closed

 Merged


This was referenced May 11, 2026
 Closed

 Merged

 Merged

@dependabotdependabotBot
mentioned this pull request
May 26, 2026
 Closed

@dependabotdependabotBot
mentioned this pull request
Jun 3, 2026
 Open


This was referenced Jun 19, 2026
 Merged

 Closed


This was referenced Jul 2, 2026
 Closed

 Closed

 Closed


This was referenced Jul 13, 2026
 Closed

 Closed

 Open


This was referenced Aug 12, 2026
 Merged

 Open

 Open


This was referenced Aug 19, 2026
 Closed

 Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bgavrilMSBogdan Gavril (bgavrilMS)bgavrilMS approved these changes
@jmprieurJean-Marc Prieur (jmprieur)jmprieur approved these changes

+1 more reviewer

@keegan-carusoKeegan (keegan-caruso)keegan-caruso approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

[Feature Request] Reload certificates for all client credential based issues


4 participants

@tlupes@jmprieur@bgavrilMS@keegan-caruso