I’m trying to implement an ordinary client-secret-based web auth flow using MSAL.js 2.0. No SPA, just plain html pages and redirects.

I’m missing something in how this library is meant to be used for this flow.
What I had imagined:
1. try to visit protected page, get redirected to /login
2. /login script calls loginRedirect, navigating user to the entra oauth url
3. once user has logged in, entra oauth url redirects user to /redirect with code in query params
4. my backend takes the auth code, validates user, returns a redirect to the original protected page (carried through oauth in a state param) while also setting a session cookie allowing access to protected pages

Which worked great – once. Now, when the page at /login calls loginRedirect, it throws this interaction_in_progress error: https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/errors.md#interaction_in_progress

I don’t understand what this can mean in a non-spa flow. The error seems like it wants me to call handleRedirectPromise, but the oauth flow never redirects back to /login, and there is no js script on the /redirect route, so there is no sensible place to call handleRedirectPromise, and I’m not sure what it would be for: my backend is already reading the auth code from the /redirect query.

I’m also unclear on msalInstance.getAllAccounts() is meaningful in this non-spa flow. My understanding is that if getAllAccounts returns an account, it is a likely candidate for acquireTokenSilent. I suspect this isn’t useful in a non-SPA as the frontend never expects to handle tokens themselves, but confirmation would be appreciated.