@azure/msal-browser 3.1.0 → 3.3.0

package/src/interaction_client/SilentCacheClient.ts

@@ -11,7 +11,7 @@ import {
     AccountInfo,
     AzureCloudOptions,
     PerformanceEvents,
-    AuthError,
+    invokeAsync,
 } from "@azure/msal-common";
 import { SilentRequest } from "../request/SilentRequest";
 import { ApiId } from "../utils/BrowserConstants";
@@ -30,7 +30,7 @@ export class SilentCacheClient extends StandardInteractionClient {
     async acquireToken(
         silentRequest: CommonSilentFlowRequest
     ): Promise<AuthenticationResult> {
-        const acquireTokenMeasurement = this.performanceClient.startMeasurement(
+        this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentCacheClientAcquireToken,
             silentRequest.correlationId
         );
@@ -47,15 +47,22 @@ export class SilentCacheClient extends StandardInteractionClient {
         this.logger.verbose("Silent auth client created");
 
         try {
-            const cachedToken = (await silentAuthClient.acquireCachedToken(
-                silentRequest
-            )) as AuthenticationResult;
+            const response = await invokeAsync(
+                silentAuthClient.acquireCachedToken.bind(silentAuthClient),
+                PerformanceEvents.SilentFlowClientAcquireCachedToken,
+                this.logger,
+                this.performanceClient,
+                silentRequest.correlationId
+            )(silentRequest);
+            const authResponse = response[0] as AuthenticationResult;
 
-            acquireTokenMeasurement.end({
-                success: true,
-                fromCache: true,
-            });
-            return cachedToken;
+            this.performanceClient.addFields(
+                {
+                    fromCache: true,
+                },
+                silentRequest.correlationId
+            );
+            return authResponse;
         } catch (error) {
             if (
                 error instanceof BrowserAuthError &&
@@ -65,14 +72,6 @@ export class SilentCacheClient extends StandardInteractionClient {
                     "Signing keypair for bound access token not found. Refreshing bound access token and generating a new crypto keypair."
                 );
             }
-            acquireTokenMeasurement.end({
-                errorCode:
-                    (error instanceof AuthError && error.errorCode) ||
-                    undefined,
-                subErrorCode:
-                    (error instanceof AuthError && error.subError) || undefined,
-                success: false,
-            });
             throw error;
         }
     }
@@ -98,15 +97,13 @@ export class SilentCacheClient extends StandardInteractionClient {
         azureCloudOptions?: AzureCloudOptions
     ): Promise<SilentFlowClient> {
         // Create auth module.
-        this.performanceClient.setPreQueueTime(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        const clientConfig = await this.getClientConfiguration(
-            serverTelemetryManager,
-            authorityUrl,
-            azureCloudOptions
-        );
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
         return new SilentFlowClient(clientConfig, this.performanceClient);
     }
 
@@ -119,13 +116,16 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.correlationId
         );
 
-        this.performanceClient.setPreQueueTime(
+        const baseRequest = await invokeAsync(
+            this.initializeBaseRequest.bind(this),
             PerformanceEvents.InitializeBaseRequest,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
+        )(request, account);
         return {
             ...request,
-            ...(await this.initializeBaseRequest(request, account)),
+            ...baseRequest,
             account: account,
             forceRefresh: request.forceRefresh || false,
         };

package/src/interaction_client/SilentIframeClient.ts

@@ -29,11 +29,16 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { InteractionType, ApiId } from "../utils/BrowserConstants";
-import { SilentHandler } from "../interaction_handler/SilentHandler";
+import {
+    initiateAuthRequest,
+    monitorIframeForHash,
+} from "../interaction_handler/SilentHandler";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
 import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import { InteractionHandler } from "../interaction_handler/InteractionHandler";
+import * as BrowserUtils from "../utils/BrowserUtils";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -114,6 +119,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             },
             InteractionType.Silent
         );
+        BrowserUtils.preconnect(silentRequest.authority);
         this.browserStorage.updateCacheEntries(
             silentRequest.state,
             silentRequest.nonce,
@@ -179,9 +185,10 @@ export class SilentIframeClient extends StandardInteractionClient {
         authClient: AuthorizationCodeClient,
         silentRequest: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
+        const correlationId = silentRequest.correlationId;
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentIframeClientTokenHelper,
-            silentRequest.correlationId
+            correlationId
         );
 
         // Create auth code request and generate PKCE params
@@ -191,7 +198,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )(silentRequest);
 
         // Create authorize request url
@@ -200,7 +207,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             PerformanceEvents.GetAuthCodeUrl,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
+            correlationId
         )({
             ...silentRequest,
             nativeBroker: NativeMessageHandler.isNativeAvailable(
@@ -212,37 +219,64 @@ export class SilentIframeClient extends StandardInteractionClient {
         });
 
         // Create silent handler
-        const silentHandler = new SilentHandler(
+        const interactionHandler = new InteractionHandler(
             authClient,
             this.browserStorage,
             authCodeRequest,
             this.logger,
-            this.config.system,
             this.performanceClient
         );
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(
-            silentHandler.initiateAuthRequest.bind(silentHandler),
+            initiateAuthRequest,
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(navigateUrl);
+            correlationId
+        )(
+            navigateUrl,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            this.config.system.navigateFrameWait
+        );
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const hash = await invokeAsync(
-            silentHandler.monitorIframeForHash.bind(silentHandler),
-            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            monitorIframeForHash,
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(msalFrame, this.config.system.iframeHashTimeout);
+            correlationId
+        )(
+            msalFrame,
+            this.config.system.iframeHashTimeout,
+            this.config.system.pollIntervalMilliseconds,
+            this.performanceClient,
+            this.logger,
+            correlationId
+        );
+        if (!hash) {
+            // No hash is present
+            this.logger.error(
+                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
+            );
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        } else if (!UrlString.hashContainsKnownProperties(hash)) {
+            this.logger.error(
+                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
+            );
+            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+            );
+        }
         // Deserialize hash fragment response parameters.
         const serverParams: ServerAuthorizationCodeResponse =
             UrlString.getDeserializedHash(hash);
         const state = this.validateAndExtractStateFromHash(
             serverParams,
             InteractionType.Silent,
-            authCodeRequest.correlationId
+            correlationId
         );
 
         if (serverParams.accountId) {
@@ -266,7 +300,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.nativeMessageHandler,
                 serverParams.accountId,
                 this.browserStorage,
-                this.correlationId
+                correlationId
             );
             const { userRequestState } = ProtocolUtils.parseRequestState(
                 this.browserCrypto,
@@ -279,7 +313,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.NativeInteractionClientAcquireToken,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )({
                 ...silentRequest,
                 state: userRequestState,
@@ -291,11 +325,13 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         // Handle response from hash string
         return invokeAsync(
-            silentHandler.handleCodeResponseFromHash.bind(silentHandler),
+            interactionHandler.handleCodeResponseFromHash.bind(
+                interactionHandler
+            ),
             PerformanceEvents.HandleCodeResponseFromHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
+            correlationId
         )(hash, state, authClient.authority, this.networkClient);
     }
 }

package/src/interaction_client/SilentRefreshClient.ts

@@ -11,6 +11,7 @@ import {
     AuthError,
     AzureCloudOptions,
     PerformanceEvents,
+    invokeAsync,
 } from "@azure/msal-common";
 import { ApiId } from "../utils/BrowserConstants";
 import {
@@ -32,18 +33,17 @@ export class SilentRefreshClient extends StandardInteractionClient {
             request.correlationId
         );
 
-        this.performanceClient.setPreQueueTime(
+        const baseRequest = await invokeAsync(
+            this.initializeBaseRequest.bind(this),
             PerformanceEvents.InitializeBaseRequest,
+            this.logger,
+            this.performanceClient,
             request.correlationId
-        );
+        )(request, request.account);
         const silentRequest: CommonSilentFlowRequest = {
             ...request,
-            ...(await this.initializeBaseRequest(request, request.account)),
+            ...baseRequest,
         };
-        const acquireTokenMeasurement = this.performanceClient.startMeasurement(
-            PerformanceEvents.SilentRefreshClientAcquireToken,
-            silentRequest.correlationId
-        );
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.acquireTokenSilent_silentFlow
         );
@@ -55,30 +55,30 @@ export class SilentRefreshClient extends StandardInteractionClient {
         );
         this.logger.verbose("Refresh token client created");
         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
-        this.performanceClient.setPreQueueTime(
+        return invokeAsync(
+            refreshTokenClient.acquireTokenByRefreshToken.bind(
+                refreshTokenClient
+            ),
             PerformanceEvents.RefreshTokenClientAcquireTokenByRefreshToken,
+            this.logger,
+            this.performanceClient,
             request.correlationId
-        );
-        return refreshTokenClient
-            .acquireTokenByRefreshToken(silentRequest)
+        )(silentRequest)
             .then((result) => result as AuthenticationResult)
             .then((result: AuthenticationResult) => {
-                acquireTokenMeasurement.end({
-                    success: true,
-                    fromCache: result.fromCache,
-                    requestId: result.requestId,
-                });
+                this.performanceClient.addFields(
+                    {
+                        fromCache: result.fromCache,
+                        requestId: result.requestId,
+                    },
+                    request.correlationId
+                );
 
                 return result;
             })
             .catch((e: AuthError) => {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
-                acquireTokenMeasurement.end({
-                    errorCode: e.errorCode,
-                    subErrorCode: e.subError,
-                    success: false,
-                });
                 throw e;
             });
     }
@@ -106,15 +106,13 @@ export class SilentRefreshClient extends StandardInteractionClient {
         azureCloudOptions?: AzureCloudOptions
     ): Promise<RefreshTokenClient> {
         // Create auth module.
-        this.performanceClient.setPreQueueTime(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        const clientConfig = await this.getClientConfiguration(
-            serverTelemetryManager,
-            authorityUrl,
-            azureCloudOptions
-        );
+        )(serverTelemetryManager, authorityUrl, azureCloudOptions);
         return new RefreshTokenClient(clientConfig, this.performanceClient);
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -21,7 +21,8 @@ import {
     AccountInfo,
     AzureCloudOptions,
     PerformanceEvents,
-    AuthError,
+    invokeAsync,
+    BaseAuthRequest,
 } from "@azure/msal-common";
 import { BaseInteractionClient } from "./BaseInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -36,10 +37,12 @@ import {
     BrowserStateObject,
 } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
-import { BrowserUtils } from "../utils/BrowserUtils";
+import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
 import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
+import { generatePkceCodes } from "../crypto/PkceGenerator";
+import { createNewGuid } from "../crypto/BrowserCrypto";
 
 /**
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
@@ -56,12 +59,13 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
             request.correlationId
         );
-        this.logger.verbose(
-            "initializeAuthorizationRequest called",
-            request.correlationId
-        );
-        const generatedPkceParams =
-            await this.browserCrypto.generatePkceCodes();
+        const generatedPkceParams = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(this.performanceClient, this.logger, this.correlationId);
 
         const authCodeRequest: CommonAuthorizationCodeRequest = {
             ...request,
@@ -89,8 +93,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         );
 
         const validLogoutRequest: CommonEndSessionRequest = {
-            correlationId:
-                this.correlationId || this.browserCrypto.createNewGuid(),
+            correlationId: this.correlationId || createNewGuid(),
             ...logoutRequest,
         };
 
@@ -219,15 +222,13 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.correlationId
         );
         // Create auth module.
-        this.performanceClient.setPreQueueTime(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        const clientConfig = await this.getClientConfiguration(
-            serverTelemetryManager,
-            authorityUrl,
-            requestAzureCloudOptions
-        );
+        )(serverTelemetryManager, authorityUrl, requestAzureCloudOptions);
         return new AuthorizationCodeClient(
             clientConfig,
             this.performanceClient
@@ -249,18 +250,13 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
             this.correlationId
         );
-        this.logger.verbose(
-            "getClientConfiguration called",
-            this.correlationId
-        );
-        this.performanceClient.setPreQueueTime(
+        const discoveredAuthority = await invokeAsync(
+            this.getDiscoveredAuthority.bind(this),
             PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        const discoveredAuthority = await this.getDiscoveredAuthority(
-            requestAuthority,
-            requestAzureCloudOptions
-        );
+        )(requestAuthority, requestAzureCloudOptions);
         const logger = this.config.system.loggerOptions;
 
         return {
@@ -349,15 +345,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
             this.correlationId
         );
-        this.logger.verbose(
-            "getDiscoveredAuthority called",
-            this.correlationId
-        );
-        const getAuthorityMeasurement =
-            this.performanceClient?.startMeasurement(
-                PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
-                this.correlationId
-            );
         const authorityOptions: AuthorityOptions = {
             protocolMode: this.config.auth.protocolMode,
             OIDCOptions: this.config.auth.OIDCOptions,
@@ -378,15 +365,13 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             userAuthority,
             requestAzureCloudOptions || this.config.auth.azureCloudOptions
         );
-        this.logger.verbose(
-            "Creating discovered authority with configured authority",
-            this.correlationId
-        );
-        this.performanceClient.setPreQueueTime(
+        return await invokeAsync(
+            AuthorityFactory.createDiscoveredInstance.bind(AuthorityFactory),
             PerformanceEvents.AuthorityFactoryCreateDiscoveredInstance,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
-        return await AuthorityFactory.createDiscoveredInstance(
+        )(
             builtAuthority,
             this.config.system.networkClient,
             this.browserStorage,
@@ -394,23 +379,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.logger,
             this.performanceClient,
             this.correlationId
-        )
-            .then((result: Authority) => {
-                getAuthorityMeasurement.end({
-                    success: true,
-                });
-
-                return result;
-            })
-            .catch((error: AuthError) => {
-                getAuthorityMeasurement.end({
-                    errorCode: error.errorCode,
-                    subErrorCode: error.subError,
-                    success: false,
-                });
-
-                throw error;
-            });
+        );
     }
 
     /**
@@ -426,10 +395,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
             this.correlationId
         );
-        this.logger.verbose(
-            "initializeAuthorizationRequest called",
-            this.correlationId
-        );
+
         const redirectUri = this.getRedirectUri(request.redirectUri);
         const browserState: BrowserStateObject = {
             interactionType: interactionType,
@@ -440,16 +406,19 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             browserState
         );
 
-        this.performanceClient.setPreQueueTime(
+        const baseRequest: BaseAuthRequest = await invokeAsync(
+            this.initializeBaseRequest.bind(this),
             PerformanceEvents.InitializeBaseRequest,
+            this.logger,
+            this.performanceClient,
             this.correlationId
-        );
+        )(request);
 
         const validatedRequest: AuthorizationUrlRequest = {
-            ...(await this.initializeBaseRequest(request)),
+            ...baseRequest,
             redirectUri: redirectUri,
             state: state,
-            nonce: request.nonce || this.browserCrypto.createNewGuid(),
+            nonce: request.nonce || createNewGuid(),
             responseMode: this.config.auth.OIDCOptions
                 .serverResponseType as ResponseMode,
         };

package/src/interaction_handler/InteractionHandler.ts

@@ -10,13 +10,14 @@ import {
     AuthorityFactory,
     Authority,
     INetworkModule,
-    ClientAuthError,
     CcsCredential,
     Logger,
     ServerError,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
+    createClientAuthError,
+    ClientAuthErrorCodes,
 } from "@azure/msal-common";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -67,7 +68,6 @@ export class InteractionHandler {
             PerformanceEvents.HandleCodeResponseFromHash,
             this.authCodeRequest.correlationId
         );
-        this.logger.verbose("InteractionHandler.handleCodeResponse called");
         // Check that location hash isn't empty.
         if (!locationHash) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
@@ -77,7 +77,10 @@ export class InteractionHandler {
         const stateKey = this.browserStorage.generateStateKey(state);
         const requestState = this.browserStorage.getTemporaryCache(stateKey);
         if (!requestState) {
-            throw ClientAuthError.createStateNotFoundError("Cached State");
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
         }
 
         let authCodeResponse;
@@ -100,16 +103,13 @@ export class InteractionHandler {
             }
         }
 
-        this.performanceClient.setPreQueueTime(
+        return invokeAsync(
+            this.handleCodeResponseFromServer.bind(this),
             PerformanceEvents.HandleCodeResponseFromServer,
+            this.logger,
+            this.performanceClient,
             this.authCodeRequest.correlationId
-        );
-        return this.handleCodeResponseFromServer(
-            authCodeResponse,
-            state,
-            authority,
-            networkModule
-        );
+        )(authCodeResponse, state, authority, networkModule);
     }
 
     /**
@@ -139,7 +139,10 @@ export class InteractionHandler {
         const stateKey = this.browserStorage.generateStateKey(state);
         const requestState = this.browserStorage.getTemporaryCache(stateKey);
         if (!requestState) {
-            throw ClientAuthError.createStateNotFoundError("Cached State");
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
         }
 
         // Get cached items
@@ -151,11 +154,13 @@ export class InteractionHandler {
 
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
-            this.performanceClient.setPreQueueTime(
+            await invokeAsync(
+                this.updateTokenEndpointAuthority.bind(this),
                 PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
                 this.authCodeRequest.correlationId
-            );
-            await this.updateTokenEndpointAuthority(
+            )(
                 authCodeResponse.cloud_instance_host_name,
                 authority,
                 networkModule

package/src/interaction_handler/RedirectHandler.ts

@@ -9,10 +9,11 @@ import {
     ICrypto,
     Authority,
     INetworkModule,
-    ClientAuthError,
     Logger,
     ServerError,
     IPerformanceClient,
+    createClientAuthError,
+    ClientAuthErrorCodes,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -161,7 +162,10 @@ export class RedirectHandler extends InteractionHandler {
         const stateKey = this.browserStorage.generateStateKey(state);
         const requestState = this.browserStorage.getTemporaryCache(stateKey);
         if (!requestState) {
-            throw ClientAuthError.createStateNotFoundError("Cached State");
+            throw createClientAuthError(
+                ClientAuthErrorCodes.stateNotFound,
+                "Cached State"
+            );
         }
 
         let authCodeResponse;