Experiencing authentication failures with 1.41.1

[NishanthSanjeevi]

Storage Explorer Version

1.41.1

Regression From

1.40.2

Architecture

x64

Storage Explorer Build Number

No response

Platform

All

OS Version

No response

Bug Description

My account was authenticated and everything was working fine.
Then I accepted the update to 1.41.1 and it broke the authentication.

Irrespective of how many times I tried to authenticate, the app kept reporting an error.

I uninstalled, deleted all the Appdata and re-installed 1.41.1 again.
I was able to authenticate this time, but when I restarted the app, it would break again.

So, I had to go back to 1.40.2 since that works fine for me.

Resource Types

Blobs

Authentication Method

None

Connection Type

None

Steps to Reproduce

Upgrade from 1.40.2 to 1.41.1

Actual Experience

You will be stuck in a broken authentication flow

Expected Experience

No response

Additional Context

No response

[craxal]

@NishanthSanjeevi Do you have the specific error message that you were seeing? What authentication method were you using? Can you provide your authentication logs?

[HarshSharma12]

I'm seeing the same issue. I tried to authenticate using the Sign in with Azure option. It opens up the webpage, lets me select the correct account, redirects to the localhost page but then shows the following error

{
  "message": "\"Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.\""
}

[HarshSharma12]

Detailed log from the log file

[2026-03-03T18:12:13.524Z] (main:3387002) <ERRO> Failed to reauthAccount, authFlowType: systemBrowser, authResult: {"Account":null,"UserCancelled":false,"UserName":"<REDACTED>","Errors":[{"Message":"Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.","ExceptionType":"Microsoft.Identity.Client.MsalClientException","HResult":-2146233088,"ExceptionString":"MSAL.NetCore.4.82.1.0.MsalClientException:\r\n\tErrorCode: authentication_failed\r\nMicrosoft.Identity.Client.MsalClientException: Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.\n   at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.GetAuthorizationResponseAsync(HttpListenerContext context)\n   at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, String path, Func`2 responseProducer, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.InterceptAuthorizationUriAsync(Uri authorizationUri, Uri redirectUri, Boolean isBrokerConfigured, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.AcquireAuthorizationAsync(Uri authorizationUri, Uri redirectUri, RequestContext requestContext, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceInternalAsync(IWebUI webUi, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceVerifierAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.GetTokenResponseAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.ExecuteAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()\n--- End of stack trace from previous location ---\n   at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenInteractiveParameters interactiveParameters, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.PerformSystemWebBrowserFlowAsync(MsalGetTokenInteractiveContext context, String qp, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.DoSystemBrowserFlowAsync(MsalGetTokenInteractiveContext context, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.ExecuteInteractiveFlowAsync(IGetTokenInteractiveContext getTokenContext, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.ExecuteInteractiveFlowAsync(IGetTokenInteractiveContext getTokenContext, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.AadAccountProviderNetworkServicesBase.AcquireTokenWithPromptInternalAsync(ResourceOrScopes resourceOrScopes, String tenant, UserIdentifier userId, String queryParameters, AuthenticationFlowType authenticationFlowType, Dictionary`2 additionalAuthProperties, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.AadAccountProviderService.GetHomeTenantAuthenticationInfoAsync(Account account, String queryParameters, AuthenticationFlowType authenticationFlowType, Dictionary`2 additionalAuthProperties, StringBuilder diagnosticFlowMessages, TenantInformation homeTenantInfo, Boolean isGitHubAccount, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.AadAccountProviderService.AuthenticateAccountWithUIAsyncInternalAsync(Account account, String queryParameters, AuthenticationFlowType authenticationFlowType, IEnumerable`1 errorsToFix, Dictionary`2 additionalAuthProperties, ImmutableArray`1 scopes, CancellationToken cancellationToken)","ErrorData":{"HelpLinkBaseUrl":" https://aka.ms/ReportAProblemUrl","BrokerTag":"","ErrorCode":"Error","BrokerErrorCode":"","BrokerErrorContext":"","ErrorMessage":"Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.","HelpLink":" https://aka.ms/ReportAProblemUrl","BrokerErrorStatus":"","ErrorTypeMetadataKey":"Microsoft.Identity.Client.MsalClientException","FaultEventSessionId":"b7994549-a2ee-448f-bec6-fb1fd52686c7","FaultEventCorrelationId":"{\"id\":\"b13a649a-4331-4b11-9c4a-3179402c2e24\",\"eventType\":\"Fault\"}"}}]}

[craxal]

@HarshSharma12 Thank you for sharing your error message from your logs. It looks like you're using the default browser auth method. We recommend switching to Authentication Broker in your settings and trying again.

In the meantime, I've been speaking with the authentication library authors to see if this issue has cropped up before. If you'd like, you can help provide more information for their investigation. Switch on verbose authentication logs (from the settings) and try signing in again. Assuming the error occurs again, share your authentication logs.

[HarshSharma12]

Switching from "Default Web Browser" to "Integrated Sign In" worked.

But, since the settings state that "It is recommended to use your default web browser", I recommend keeping the bug open.
Here are the logs with the default browser and verbose logging

[2026-03-04T17:53:28.676Z] (main:3872977) <NONE> Log level: info
[2026-03-04T17:53:28.677Z] (main:3872977) <INFO> Startup app state:
   {
    lastWindowState: {
      rect: { x: 52, y: 170, width: 1025, height: 650 },
      maximized: true
    },
    disableGpu: false,
    dialogAutoResponse: {}
  }
[2026-03-04T17:53:30.580Z] (main:3872977) <INFO> No proxy environment variables exist on startup
[2026-03-04T17:53:30.595Z] (main:3872977) <INFO> Applying proxy configuration
[2026-03-04T17:53:30.595Z] (main:3872977) <INFO> Proxy configuration source set to: none
[2026-03-04T17:53:30.596Z] (main:3872977) <INFO> Proxy configuration set to: undefined
[2026-03-04T17:53:30.700Z] (main:3872977) <INFO> Setting SERVICEHUBTRACELEVEL to ALL
[2026-03-04T17:53:30.700Z] (main:3872977) <INFO> Initializing user accounts manager account store...
[2026-03-04T17:53:30.733Z] (main:3872977) <INFO> Initialized ConfidentialStorageManager.
[2026-03-04T17:53:30.933Z] (main:3872977) <ERRO> Unable to execute operation 'PersistentStorage.Local.getItem'. No implementation has been registered.
[2026-03-04T17:53:32.485Z] (main:3872977) <WARN> An implementation of 'Environment.Theming.onThemeChanged' has already been registered by another provider, this most recent implementation will be ignored unless 'Environment.Theming.onThemeChanged is used as an event'.
[2026-03-04T17:53:32.485Z] (main:3872977) <WARN> An implementation of 'Environment.Zoom.onZoomChanged' has already been registered by another provider, this most recent implementation will be ignored unless 'Environment.Zoom.onZoomChanged is used as an event'.
[2026-03-04T17:53:32.489Z] (main:3872977) <INFO> Initializing extension manager...
[2026-03-04T17:53:32.490Z] (main:3872977) <INFO> Done initializing installed extensions configuration definitions
[2026-03-04T17:53:32.687Z] (main:3872977) <INFO> Loading 18 extensions
[2026-03-04T17:53:32.871Z] (main:3872977) <INFO> Registered icon 'AppConfigColor' (not themed) located at '/snap/storage-explorer/76/resources/app/node_modules/@storage-explorer/azure-app-configuration-se-extension/dist/Images/AppConfig.svg'
[2026-03-04T17:53:32.872Z] (main:3872977) <INFO> Registered icon 'AppConfigStoreColor' (not themed) located at '/snap/storage-explorer/76/resources/app/node_modules/@storage-explorer/azure-app-configuration-se-extension/dist/Images/AppConfigStore.svg'
[2026-03-04T17:53:32.872Z] (main:3872977) <INFO> Registered icon 'FeatureFlagColor' (not themed) located at '/snap/storage-explorer/76/resources/app/node_modules/@storage-explorer/azure-app-configuration-se-extension/dist/Images/FeatureFlag.svg'
[2026-03-04T17:53:32.898Z] (main:3872977) <INFO> Extensions loaded
[2026-03-04T17:53:33.630Z] (main:3872977) <INFO> SubscriptionCache found V2 cache, using it.
[2026-03-04T17:53:34.323Z] (main:3872977) <INFO> AzureSubscriptionsManager checking for new accounts...
[2026-03-04T17:53:39.792Z] (main:3872977) <INFO> Initializing user accounts manager error store...
[2026-03-04T17:53:39.912Z] (main:3872977) <INFO> Initializing user accounts manager AAD providers...
[2026-03-04T17:53:48.681Z] (main:3872977) <ERRO> Failed to addAccount, authFlowType: systemBrowser, authResult: {"Account":null,"UserCancelled":false,"UserName":null,"Errors":[{"Message":"Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.","ExceptionType":"Microsoft.Identity.Client.MsalClientException","HResult":-2146233088,"ExceptionString":"MSAL.NetCore.4.82.1.0.MsalClientException:\r\n\tErrorCode: authentication_failed\r\nMicrosoft.Identity.Client.MsalClientException: Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.\n   at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.GetAuthorizationResponseAsync(HttpListenerContext context)\n   at Microsoft.Identity.Client.Platforms.Shared.DefaultOSBrowser.HttpListenerInterceptor.ListenToSingleRequestAndRespondAsync(Int32 port, String path, Func`2 responseProducer, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.InterceptAuthorizationUriAsync(Uri authorizationUri, Uri redirectUri, Boolean isBrokerConfigured, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Platforms.Shared.Desktop.OsBrowser.DefaultOsBrowserWebUi.AcquireAuthorizationAsync(Uri authorizationUri, Uri redirectUri, RequestContext requestContext, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceInternalAsync(IWebUI webUi, CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.FetchAuthCodeAndPkceVerifierAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.GetTokenResponseAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.ExecuteAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()\n--- End of stack trace from previous location ---\n   at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)\n   at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenInteractiveParameters interactiveParameters, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.PerformSystemWebBrowserFlowAsync(MsalGetTokenInteractiveContext context, String qp, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.DoSystemBrowserFlowAsync(MsalGetTokenInteractiveContext context, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.ExecuteInteractiveFlowAsync(IGetTokenInteractiveContext getTokenContext, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.MsalNetworkServicesImpl.ExecuteInteractiveFlowAsync(IGetTokenInteractiveContext getTokenContext, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.AadAccountProviderNetworkServicesBase.AcquireTokenWithPromptInternalAsync(ResourceOrScopes resourceOrScopes, String tenant, UserIdentifier userId, String queryParameters, AuthenticationFlowType authenticationFlowType, Dictionary`2 additionalAuthProperties, CancellationToken cancellationToken)\n   at Microsoft.Developer.IdentityService.AccountProvider.AadAccountProviderService.CreateAccountInnerAsync(String userName, String queryParameters, AuthenticationFlowType authenticationFlowType, Dictionary`2 additionalAuthProperties, Boolean homeTenantOnly, CancellationToken cancellationToken)","ErrorData":{"BrokerErrorCode":"","FaultEventCorrelationId":"{\"id\":\"7c3abc91-43f3-410d-ae35-7f6ebe44652a\",\"eventType\":\"Fault\"}","ErrorMessage":"Expected POST request for form_post response mode, but received GET. This is a security issue as the authorization code is exposed in the URL query parameters and browser history.","BrokerErrorStatus":"","HelpLink":" https://aka.ms/ReportAProblemUrl","ErrorTypeMetadataKey":"Microsoft.Identity.Client.MsalClientException","ErrorCode":"Error","HelpLinkBaseUrl":" https://aka.ms/ReportAProblemUrl","FaultEventSessionId":"5d6941a7-a1a7-4d2d-9b57-ec39ac270e17","BrokerTag":"","BrokerErrorContext":""}}]}

Also, if it helps, I'm on linux and using the snap version 1.41.1

[craxal]

@HarshSharma12 Appologies, but the statement "It is recommended to use your default web browser" is out-of-date, and we should fix that. We are currently working on enabling authentication broker for non-Windows platforms, which will be the recommended sign in method.

Thank you for clarifying that you are on Linux. The logs you have provided come from the app logs, which are different than the authentication logs. Refer to the troubleshooting guide to get the location of the authentication logs.