title: Azure AD B2C OAuth2 how to refresh access token silently
body: <p>We are using <strong>Azure AD B2C</strong> to authenticate our users in an ASP.NET MVC application with <strong>OWIN</strong> (Microsoft.Owin.Security).</p>
  
  <p>We are trying to find a way to refresh silently the access token (access_token), to avoid the multiple AJAX calls we are doing to fail. Most of them are fired automatically by the components we use (DevExpress) through callbacks, so we have very little control over them.
  One solution we found is the one described by Vittorio Bertocci on his blog : <a href="http://www.cloudidentity.com/blog/2016/07/25/controlling-a-web-apps-session-duration-2/" rel="nofollow noreferrer">http://www.cloudidentity.com/blog/2016/07/25/controlling-a-web-apps-session-duration-2/</a></p>
  
  <p><strong>AccountController.cs</strong></p>
  
  <pre><code>public void ForcedSignIn()
  {
      HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties {RedirectUri = "/Account/AfterForcedSignIn"}, "OUR_B2C_SIGNIN_POLICY_ID");
  }
  </code></pre>
  
  <p><strong>_Layout.cshtml</strong></p>
  
  <pre><code>&lt;script&gt;
  setInterval(function() {
            @if (Request.IsAuthenticated)
            {
              &lt;text&gt;
                var renewUrl = "/Account/ForcedSignIn";
                var element = document.getElementById("renewSession");
                console.log("sending request to: " + renewUrl);
                element.src = renewUrl;
              &lt;/text&gt;
            }
          },
          1000 * 20
        );
  &lt;/script&gt;
  
  &lt;body&gt;
  &lt;iframe id="renewSession" style="height: 600px; width: 600px;"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p><strong>AfterForcedSignIn.cshtml</strong></p>
  
  <pre><code>@{
    Layout = null;
  }
  </code></pre>
  
  <p>However, the call to <a href="https://login.microsoftonline.com" rel="nofollow noreferrer">https://login.microsoftonline.com</a> is failing because it can’t be embedded in an iFrame (even if we specify “prompt” parameter to “none”).
  <a href="https://i.stack.imgur.com/K6oyP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/K6oyP.png" alt="call fail"></a></p>
  
  <p>See the message we get in Edge for example :
  <a href="https://i.stack.imgur.com/AMKuK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AMKuK.png" alt="edge iframe error"></a></p>
  
  <p>Is there a way to avoid this issue (are we missing a parameter when calling the login page, or something else) ? Or is it another solution that exists ?</p>
  
  <p>Thanks,
  Léo </p>