MSAL Auth: Controlling Behaviour

Question

Hello

I am using the MSAL Javascript library in React. And it has me baffled... It is a very difficult system to control without reaching into the cookies//local/session storage (which the library seems to be designed to prevent developers from being required to do). I would like users to be required to identify themselves for each session. I am happy to users to remain signed in to prevent them having to reenter passwords, etc each time.

This I have deduced (through experiments - documentation is pointedly unhelpful regarding how any of this stuff works under the hood. (understandable, it is only authentication...)):

• The basic account details and sign in status as well as some kind of token (I assume refresh token???) is stored in the cookies.
• The active user is also stored in the cookies.
• The cookies are HttpOnly.
• The basic account details and sign in status as well as some kind of token (I assume access token???) is stored in the session/local storage (depending on cache config).
• MSAL will automatically renew the authentication of the active user from the cache (if available).
• The cache can store a number of signed in users (this is inconsistent and it seems to be only possible to choose another user if MFA not set on the active user).

The active user is automatically logged in with the .login methods. This happens from the cookies (if not also from local/session storage). It is only possible to select another user by first logging the active user out. It is not possible to automatically log the active user out (without a prompt) (even by adding active user to the account parameter of the logout options object). I could remove the cookies but I don't want to lose the sessions of the signed in users. Which cookies should I remove? Is there a better way to do this?

Desired behaviour:

• Each session requires login prompt.
• Prompt requires users to select their account.
• Users may remained signed in and not require their password to be reentered (less important).

Many thanks.