Closed crottypeter closed 3 years ago
Exception is not thrown with this change https://github.com/Azure-Samples/ms-identity-java-webapp/pull/73
But (unfortunately) I discard all query params should I have been more selective?
Thanks Peter. Looks good to me. I don't think the query params should be necessary after that point.
Query parameters are not cleared after successful login. Therefore if the page is subsequently refreshed (F5) we take the wrong path here, find ourselves with a new HttpSession with an empty "states" attribute and throw an Exception here.