Search code examples
jwttokensingle-sign-onazure-ad-msalmsal.js

How to decode oulook personal account access_token using MSAL.js


I have acquired access_token on behalf of user for personal outlook account

Below is the token, but I could not able to decode it using https://jwt.io/ OR npm package jwt-decode

EwB4A8l6BAAUkj1NuJYtTVha+Mogk+HEiPbQo04AAdeLOPRDOvk3CXwZdADj4K+j59GQEZKtCm+NmNeSc0LRHqtnyWiXtTnhoH9MOwIIJVTL+TbkKYHN55nLK4F8jwU1ygo7mQSE0GSgXeP+691cSVzbtgNGJacVqbRu6WPfDedT4Hu/K3cpu2dVxI6HN3mwAlPocE6u6VJgDpHE2EJi6YM+ChdYGCieBCxGukp0fBqr9K/pFDK3t4KpobZTaeixs52cskQFCcqPR331fu5ZajZoFZrrGrsHoqJvZNodYmSZFQNPEsZZHWzlyukvYLTReH71sr2HdrEzwx/08UhIY+2hdX70kOptJ0FwAViNjRySEUnUF5ByntVeUIfJT3IDZgAACLII3pS/hlNpSAJKvzbMAIw3VbmNQeaV2Vx9eunhGul9qAIGb0BPsopyO3iwL1Gz2Tv+8kt+h62nFuU83g9bYw3QepxY9zTGGUmpWSk9mq6PpyNqQ1HcNfxs3HxIdsRQ2JtrTL7dpknLKnCwav44zDFuPkkWGPLas0ywvfLn7e4aDF6fEnEFDWpVeFFVkULkp0C/QHkkUMXf1q3VJurjxZfz1FS8v1QDPCvfA7rZmPXfmoQ7Jjm0VyI+C2DV0xkq44lithrMG5OdfGSVAznkD6TQ1phQSw/gd747TX2NyBSQA4ZDXzn7GhYYh5U7W02cOhiwbEmrDg0HbPeTZ23QVQ3mR2gQy0xCgUX2VkaLVjOd1I71zxKs7JDVwEwkBEONJQ9CKnFX2h8ZviCUnWYCxWsop/uFxBv2QMz0YS27HwLEfWPSbntAkR2OZF7iVnJdScNDq92F33YCrExXWPtQvAUcI86yt2ofyzH0vCddRricsrdrCFouECDmqBLm4rFOgEZ8m0pqZEb6KTP1+WrEzWNdqnJ7GXZff5sQwTCbp9/QzKbNXcmaLTGai9bhuOwc9IL8n+/boaEtjspctxring3WiYDpBV9v9r585RJ4u3MqKrTdOfOYjyRs7LOZIqLbllFbvsrkwVjprRqs2L4PPCkGf+eHKnXHAZpjV8ZD0Mrj6LE1UicguFWB/3BOTon2abrOUxame3fY5H7GaRVrd2vPEAwx9mhF0PNeuj0af3KWnv6ZMCI9mrmfY7DNOc3qSFbitX9b0cvH31HGVyofHIcfwJEC

Please help if you have any idea


Solution

  • You cannot decode the access token from the Personal account as they aren't validated as JWT. Instead they are encrypting it.

    Don't attempt to validate or read tokens for any API you don't own, including the tokens in this example, in your code. Tokens for Microsoft services can use a special format that will not validate as a JWT, and may also be encrypted for consumer (Microsoft account) users. While reading tokens is a useful debugging and learning tool, do not take dependencies on this in your code or assume specifics about tokens that aren't for an API you control.

    ref: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code#:~:text=Don%27t%20attempt%20to,API%20you%20control.