...
Service: Components/Authentication/AuthenticationService/GraphUserService.cs Configuration: Program.cs:104-142 Usage: Admin pages, NavBar, Profile page
...
Security Mechanisms
PKCE (Proof Key for Code Exchange)
What: Random secret generated by MSAL.js before login Why: Prevents authorization code theft How: Code can only be exchanged by app that started the flow
Token Signature Validation
What: Cryptographic signature on every JWT token Why: Proves token issued by Microsoft, not forged How: ApiService downloads Microsoft's public keys, validates signature
Token Expiration
What: Every token has expiration timestamp Why: Limits damage if token stolen How: ApiService rejects expired tokens automatically
sessionStorage (Not localStorage)
What: Browser storage that clears when tab closes Why: Reduces risk if user leaves computer unlocked How: MSAL.js configured to use sessionStorage