Sporadic AADSTS900144 error with Microsoft provider

[troccoli-sgr]

Hello everyone,

From time to time the Socialite::driver('microsoft')->user() call returns 400 Bad Request.

I have an invokable controller to sign a user in

class ClientCallbackController extends Controller
{
    public function __invoke(AuthenticationService $authenticationService): RedirectResponse
    {
        $microsoftUser = Socialite::driver('microsoft')->user();

        $authenticationService->signInWithMicrosoftUser($microsoftUser);

        return redirect()->intended(route('home'));
    }
}

I have logged the response body

{"error":"invalid_request","error_description":"AADSTS900144: The request body must contain the following parameter: 'code'. Trace ID: eb866c5c-eab4-4233-bd67-e4aa74291200 Correlation ID: 016045cb-b527-44b0-a464-b7583ed38bc6 Timestamp: 2025-10-01 10:47:27Z","error_codes":[900144],"timestamp":"2025-10-01 10:47:27Z","trace_id":"eb866c5c-eab4-4233-bd67-e4aa74291200","correlation_id":"016045cb-b527-44b0-a464-b7583ed38bc6","error_uri":"https://login.microsoftonline.com/error?code=900144"}

and the request parameters are: grant_type, client_id, client_secret, redirect_url, and scope. So, the code parameter is indeed missing.

Upon some investigation it looks like the provider calls to user(), which is in fact in SocialiteProviders\Manager\OAuth2\AbstractProvider, makes a call to get the code, line 52, which goes into Laravel\Socialite\Two\AbstractProvider, line 387, which expects an input parameter called code.

What is this code that is missing? Why isn't the provider adding it? Can I add it manually? Any help is much appreciated.