@azure/msal-browser 3.15.0 → 3.17.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.15.0",
+  "version": "3.17.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -103,6 +103,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.10.0"
+    "@azure/msal-common": "14.12.0"
   }
 }

package/src/broker/nativeBroker/NativeRequest.ts

@@ -31,6 +31,7 @@ export type NativeTokenRequest = {
     extendedExpiryToken?: boolean;
     extraParameters?: StringDict;
     storeInCache?: StoreInCache; // Object of booleans indicating whether to store tokens in the cache or not (default is true)
+    signPopToken?: boolean; // Set to true only if token request deos not contain a PoP keyId
 };
 
 /**

package/src/controllers/StandardController.ts

@@ -422,7 +422,7 @@ export class StandardController implements IController {
                   true
               ) || "";
         const rootMeasurement = this.performanceClient.startMeasurement(
-            "acquireTokenRedirect",
+            PerformanceEvents.AcquireTokenRedirect,
             correlationId
         );
         this.eventHandler.emitEvent(
@@ -567,88 +567,114 @@ export class StandardController implements IController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("acquireTokenRedirect called", correlationId);
-        BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
-        this.browserStorage.setInteractionInProgress(true);
+
+        const atrMeasurement = this.performanceClient.startMeasurement(
+            PerformanceEvents.AcquireTokenPreRedirect,
+            correlationId
+        );
+        atrMeasurement.add({
+            accountType: getAccountType(request.account),
+            scenarioId: request.scenarioId,
+        });
+
+        const onRedirectNavigateCb = request.onRedirectNavigate;
+        request.onRedirectNavigate = (url: string) => {
+            const navigate =
+                typeof onRedirectNavigateCb === "function"
+                    ? onRedirectNavigateCb(url)
+                    : undefined;
+            if (navigate !== false) {
+                atrMeasurement.end({ success: true });
+            } else {
+                atrMeasurement.discard();
+            }
+            return navigate;
+        };
 
         // If logged in, emit acquire token events
         const isLoggedIn = this.getAllAccounts().length > 0;
-        if (isLoggedIn) {
-            this.eventHandler.emitEvent(
-                EventType.ACQUIRE_TOKEN_START,
-                InteractionType.Redirect,
-                request
-            );
-        } else {
-            this.eventHandler.emitEvent(
-                EventType.LOGIN_START,
-                InteractionType.Redirect,
-                request
-            );
-        }
+        try {
+            BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
+            this.browserStorage.setInteractionInProgress(true);
 
-        let result: Promise<void>;
+            if (isLoggedIn) {
+                this.eventHandler.emitEvent(
+                    EventType.ACQUIRE_TOKEN_START,
+                    InteractionType.Redirect,
+                    request
+                );
+            } else {
+                this.eventHandler.emitEvent(
+                    EventType.LOGIN_START,
+                    InteractionType.Redirect,
+                    request
+                );
+            }
 
-        if (this.nativeExtensionProvider && this.canUseNative(request)) {
-            const nativeClient = new NativeInteractionClient(
-                this.config,
-                this.browserStorage,
-                this.browserCrypto,
-                this.logger,
-                this.eventHandler,
-                this.navigationClient,
-                ApiId.acquireTokenRedirect,
-                this.performanceClient,
-                this.nativeExtensionProvider,
-                this.getNativeAccountId(request),
-                this.nativeInternalStorage,
-                correlationId
-            );
-            result = nativeClient
-                .acquireTokenRedirect(request)
-                .catch((e: AuthError) => {
-                    if (
-                        e instanceof NativeAuthError &&
-                        isFatalNativeAuthError(e)
-                    ) {
-                        this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient =
-                            this.createRedirectClient(correlationId);
-                        return redirectClient.acquireToken(request);
-                    } else if (e instanceof InteractionRequiredAuthError) {
-                        this.logger.verbose(
-                            "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"
-                        );
-                        const redirectClient =
-                            this.createRedirectClient(correlationId);
-                        return redirectClient.acquireToken(request);
-                    }
-                    this.browserStorage.setInteractionInProgress(false);
-                    throw e;
-                });
-        } else {
-            const redirectClient = this.createRedirectClient(correlationId);
-            result = redirectClient.acquireToken(request);
-        }
+            let result: Promise<void>;
 
-        return result.catch((e) => {
-            // If logged in, emit acquire token events
+            if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                const nativeClient = new NativeInteractionClient(
+                    this.config,
+                    this.browserStorage,
+                    this.browserCrypto,
+                    this.logger,
+                    this.eventHandler,
+                    this.navigationClient,
+                    ApiId.acquireTokenRedirect,
+                    this.performanceClient,
+                    this.nativeExtensionProvider,
+                    this.getNativeAccountId(request),
+                    this.nativeInternalStorage,
+                    correlationId
+                );
+                result = nativeClient
+                    .acquireTokenRedirect(request, atrMeasurement)
+                    .catch((e: AuthError) => {
+                        if (
+                            e instanceof NativeAuthError &&
+                            isFatalNativeAuthError(e)
+                        ) {
+                            this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            const redirectClient =
+                                this.createRedirectClient(correlationId);
+                            return redirectClient.acquireToken(request);
+                        } else if (e instanceof InteractionRequiredAuthError) {
+                            this.logger.verbose(
+                                "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"
+                            );
+                            const redirectClient =
+                                this.createRedirectClient(correlationId);
+                            return redirectClient.acquireToken(request);
+                        }
+                        this.browserStorage.setInteractionInProgress(false);
+                        throw e;
+                    });
+            } else {
+                const redirectClient = this.createRedirectClient(correlationId);
+                result = redirectClient.acquireToken(request);
+            }
+
+            return await result;
+        } catch (e) {
+            atrMeasurement.end({ success: false }, e);
             if (isLoggedIn) {
                 this.eventHandler.emitEvent(
                     EventType.ACQUIRE_TOKEN_FAILURE,
                     InteractionType.Redirect,
                     null,
-                    e
+                    e as EventError
                 );
             } else {
                 this.eventHandler.emitEvent(
                     EventType.LOGIN_FAILURE,
                     InteractionType.Redirect,
                     null,
-                    e
+                    e as EventError
                 );
             }
             throw e;
-        });
+        }
     }
 
     // #endregion

package/src/crypto/CryptoOps.ts

@@ -78,6 +78,23 @@ export class CryptoOps implements ICrypto {
         return base64Decode(input);
     }
 
+    /**
+     * Encodes input string to base64 URL safe string.
+     * @param input
+     */
+    base64UrlEncode(input: string): string {
+        return urlEncode(input);
+    }
+
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string {
+        return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+    }
+
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request

package/src/error/BrowserAuthError.ts

@@ -90,6 +90,8 @@ export const BrowserAuthErrorMessages = {
         "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [BrowserAuthErrorCodes.invalidBase64String]:
         "Invalid base64 encoded string.",
+    [BrowserAuthErrorCodes.invalidPopTokenRequest]:
+        "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
 };
 
 /**
@@ -333,6 +335,12 @@ export const BrowserAuthErrorMessage = {
             BrowserAuthErrorCodes.invalidBase64String
         ],
     },
+    invalidPopTokenRequest: {
+        code: BrowserAuthErrorCodes.invalidPopTokenRequest,
+        desc: BrowserAuthErrorMessages[
+            BrowserAuthErrorCodes.invalidPopTokenRequest
+        ],
+    },
 };
 
 /**

package/src/error/BrowserAuthErrorCodes.ts

@@ -55,3 +55,4 @@ export const uninitializedPublicClientApplication =
     "uninitialized_public_client_application";
 export const nativePromptNotSupported = "native_prompt_not_supported";
 export const invalidBase64String = "invalid_base64_string";
+export const invalidPopTokenRequest = "invalid_pop_token_request";

package/src/interaction_client/NativeInteractionClient.ts

@@ -36,6 +36,7 @@ import {
     updateAccountTenantProfileData,
     CacheHelpers,
     buildAccountToCache,
+    InProgressPerformanceEvent,
 } from "@azure/msal-common";
 import { BaseInteractionClient } from "./BaseInteractionClient";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -169,10 +170,12 @@ export class NativeInteractionClient extends BaseInteractionClient {
             );
         }
 
+        const { ...nativeTokenRequest } = nativeRequest;
+
         // fall back to native calls
         const messageBody: NativeExtensionRequestBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
 
         const response: object = await this.nativeMessageHandler.sendMessage(
@@ -276,17 +279,23 @@ export class NativeInteractionClient extends BaseInteractionClient {
 
     /**
      * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
-     * @param request
+     * @param {RedirectRequest} request
+     * @param {InProgressPerformanceEvent} rootMeasurement
      */
-    async acquireTokenRedirect(request: RedirectRequest): Promise<void> {
+    async acquireTokenRedirect(
+        request: RedirectRequest,
+        rootMeasurement: InProgressPerformanceEvent
+    ): Promise<void> {
         this.logger.trace(
             "NativeInteractionClient - acquireTokenRedirect called."
         );
         const nativeRequest = await this.initializeNativeRequest(request);
 
+        const { ...nativeTokenRequest } = nativeRequest;
+
         const messageBody: NativeExtensionRequestBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
 
         try {
@@ -313,6 +322,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
         const redirectUri = this.config.auth.navigateToLoginRequestUrl
             ? window.location.href
             : this.getRedirectUri(request.redirectUri);
+        rootMeasurement.end({ success: true });
         await this.navigationClient.navigateExternal(
             redirectUri,
             navigationOptions
@@ -475,7 +485,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
             request,
             homeAccountIdentifier,
             idTokenClaims,
-            result.accessToken,
+            response.access_token,
             result.tenantId,
             reqTimestamp
         );
@@ -529,7 +539,10 @@ export class NativeInteractionClient extends BaseInteractionClient {
         response: NativeResponse,
         request: NativeTokenRequest
     ): Promise<string> {
-        if (request.tokenType === AuthenticationScheme.POP) {
+        if (
+            request.tokenType === AuthenticationScheme.POP &&
+            request.signPopToken
+        ) {
             /**
              * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
              * is still received, SHR is calculated locally
@@ -719,7 +732,11 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 responseScopes.printScopes(),
                 tokenExpirationSeconds,
                 0,
-                base64Decode
+                base64Decode,
+                undefined,
+                request.tokenType as AuthenticationScheme,
+                undefined,
+                request.keyId
             );
 
         const nativeCacheRecord = new CacheRecord(
@@ -911,8 +928,16 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 ...request.tokenQueryParameters,
             },
             extendedExpiryToken: false, // Make this configurable?
+            keyId: request.popKid,
         };
 
+        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+        if (validatedRequest.signPopToken && !!request.popKid) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.invalidPopTokenRequest
+            );
+        }
+
         this.handleExtraBrokerParams(validatedRequest);
         validatedRequest.extraParameters =
             validatedRequest.extraParameters || {};
@@ -929,17 +954,29 @@ export class NativeInteractionClient extends BaseInteractionClient {
             };
 
             const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )(shrParameters, this.logger);
-
-            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-            validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-            validatedRequest.keyId = reqCnfData.kid;
+
+            // generate reqCnf if not provided in the request
+            let reqCnfData;
+            if (!validatedRequest.keyId) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(shrParameters, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+                validatedRequest.keyId = generatedReqCnfData.kid;
+                validatedRequest.signPopToken = true;
+            } else {
+                reqCnfData = this.browserCrypto.base64UrlEncode(
+                    JSON.stringify({ kid: validatedRequest.keyId })
+                );
+                validatedRequest.signPopToken = false;
+            }
+
+            // SPAs require whole string to be passed to broker
+            validatedRequest.reqCnf = reqCnfData;
         }
 
         return validatedRequest;

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.15.0";
+export const version = "3.17.0";