@azure/msal-browser 3.16.0 → 3.18.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.16.0",
+  "version": "3.18.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -23,6 +23,7 @@
   ],
   "type": "module",
   "sideEffects": false,
+  "main": "./lib/msal-browser.cjs",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -103,6 +104,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.11.0"
+    "@azure/msal-common": "14.13.0"
   }
 }

package/src/broker/nativeBroker/NativeRequest.ts

@@ -31,6 +31,7 @@ export type NativeTokenRequest = {
     extendedExpiryToken?: boolean;
     extraParameters?: StringDict;
     storeInCache?: StoreInCache; // Object of booleans indicating whether to store tokens in the cache or not (default is true)
+    signPopToken?: boolean; // Set to true only if token request deos not contain a PoP keyId
 };
 
 /**

package/src/cache/BrowserCacheManager.ts

@@ -1864,11 +1864,10 @@ export class BrowserCacheManager extends CacheManager {
             claimsHash
         );
 
-        const cacheRecord = new CacheRecord(
-            undefined,
-            idTokenEntity,
-            accessTokenEntity
-        );
+        const cacheRecord = {
+            idToken: idTokenEntity,
+            accessToken: accessTokenEntity,
+        };
         return this.saveCacheRecord(cacheRecord);
     }
 

package/src/cache/TokenCache.ts

@@ -15,7 +15,6 @@ import {
     AccountEntity,
     AuthToken,
     RefreshTokenEntity,
-    Constants,
     CacheRecord,
     TokenClaims,
     CacheHelpers,
@@ -81,149 +80,76 @@ export class TokenCache implements ITokenCache {
         response: ExternalTokenResponse,
         options: LoadTokenOptions
     ): AuthenticationResult {
-        this.logger.info("TokenCache - loadExternalTokens called");
-
-        if (!response.id_token) {
+        if (!this.isBrowserEnvironment) {
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
+                BrowserAuthErrorCodes.nonBrowserEnvironment
             );
         }
 
-        const idTokenClaims = AuthToken.extractTokenClaims(
-            response.id_token,
-            base64Decode
+        const idTokenClaims = response.id_token
+            ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
+            : undefined;
+
+        const authorityOptions: AuthorityOptions = {
+            protocolMode: this.config.auth.protocolMode,
+            knownAuthorities: this.config.auth.knownAuthorities,
+            cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
+            authorityMetadata: this.config.auth.authorityMetadata,
+            skipAuthorityMetadataCache:
+                this.config.auth.skipAuthorityMetadataCache,
+        };
+        const authority = request.authority
+            ? new Authority(
+                  Authority.generateAuthority(
+                      request.authority,
+                      request.azureCloudOptions
+                  ),
+                  this.config.system.networkClient,
+                  this.storage,
+                  authorityOptions,
+                  this.logger,
+                  request.correlationId || BrowserCrypto.createNewGuid()
+              )
+            : undefined;
+
+        const cacheRecordAccount: AccountEntity = this.loadAccount(
+            request,
+            options.clientInfo || response.client_info || "",
+            idTokenClaims,
+            authority
         );
 
-        let cacheRecord: CacheRecord;
-        let authority: Authority | undefined;
-        let cacheRecordAccount: AccountEntity;
+        const idToken = this.loadIdToken(
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment,
+            cacheRecordAccount.realm
+        );
 
-        if (request.account) {
-            cacheRecordAccount = AccountEntity.createFromAccountInfo(
-                request.account
-            );
-            cacheRecord = new CacheRecord(
-                cacheRecordAccount,
-                this.loadIdToken(
-                    response.id_token,
-                    cacheRecordAccount.homeAccountId,
-                    request.account.environment,
-                    request.account.tenantId
-                ),
-                this.loadAccessToken(
-                    request,
-                    response,
-                    cacheRecordAccount.homeAccountId,
-                    request.account.environment,
-                    request.account.tenantId,
-                    options
-                ),
-                this.loadRefreshToken(
-                    request,
-                    response,
-                    cacheRecordAccount.homeAccountId,
-                    request.account.environment
-                )
-            );
-        } else if (request.authority) {
-            const authorityUrl = Authority.generateAuthority(
-                request.authority,
-                request.azureCloudOptions
-            );
-            const authorityOptions: AuthorityOptions = {
-                protocolMode: this.config.auth.protocolMode,
-                knownAuthorities: this.config.auth.knownAuthorities,
-                cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                authorityMetadata: this.config.auth.authorityMetadata,
-                skipAuthorityMetadataCache:
-                    this.config.auth.skipAuthorityMetadataCache,
-            };
-            authority = new Authority(
-                authorityUrl,
-                this.config.system.networkClient,
-                this.storage,
-                authorityOptions,
-                this.logger,
-                request.correlationId || BrowserCrypto.createNewGuid()
-            );
+        const accessToken = this.loadAccessToken(
+            request,
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment,
+            cacheRecordAccount.realm,
+            options
+        );
 
-            // "clientInfo" from options takes precedence over "clientInfo" in response
-            if (options.clientInfo) {
-                this.logger.trace("TokenCache - homeAccountId from options");
-                cacheRecordAccount = this.loadAccount(
-                    idTokenClaims,
-                    authority,
-                    options.clientInfo
-                );
-                cacheRecord = new CacheRecord(
-                    cacheRecordAccount,
-                    this.loadIdToken(
-                        response.id_token,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort,
-                        authority.tenant
-                    ),
-                    this.loadAccessToken(
-                        request,
-                        response,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort,
-                        authority.tenant,
-                        options
-                    ),
-                    this.loadRefreshToken(
-                        request,
-                        response,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort
-                    )
-                );
-            } else if (response.client_info) {
-                this.logger.trace("TokenCache - homeAccountId from response");
-                cacheRecordAccount = this.loadAccount(
-                    idTokenClaims,
-                    authority,
-                    response.client_info
-                );
-                cacheRecord = new CacheRecord(
-                    cacheRecordAccount,
-                    this.loadIdToken(
-                        response.id_token,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort,
-                        authority.tenant
-                    ),
-                    this.loadAccessToken(
-                        request,
-                        response,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort,
-                        authority.tenant,
-                        options
-                    ),
-                    this.loadRefreshToken(
-                        request,
-                        response,
-                        cacheRecordAccount.homeAccountId,
-                        authority.hostnameAndPort
-                    )
-                );
-            } else {
-                throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.unableToLoadToken
-                );
-            }
-        } else {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
+        const refreshToken = this.loadRefreshToken(
+            response,
+            cacheRecordAccount.homeAccountId,
+            cacheRecordAccount.environment
+        );
 
         return this.generateAuthenticationResult(
             request,
+            {
+                account: cacheRecordAccount,
+                idToken,
+                accessToken,
+                refreshToken,
+            },
             idTokenClaims,
-            cacheRecord,
-            cacheRecordAccount,
             authority
         );
     }
@@ -238,54 +164,54 @@ export class TokenCache implements ITokenCache {
      * @returns `AccountEntity`
      */
     private loadAccount(
-        idTokenClaims: TokenClaims,
-        authority: Authority,
-        clientInfo?: string,
-        requestHomeAccountId?: string
+        request: SilentRequest,
+        clientInfo: string,
+        idTokenClaims?: TokenClaims,
+        authority?: Authority
     ): AccountEntity {
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading account");
-            let homeAccountId;
-            if (requestHomeAccountId) {
-                homeAccountId = requestHomeAccountId;
-            } else if (authority.authorityType !== undefined && clientInfo) {
-                homeAccountId = AccountEntity.generateHomeAccountId(
-                    clientInfo,
-                    authority.authorityType,
-                    this.logger,
-                    this.cryptoObj,
-                    idTokenClaims
-                );
-            }
-
-            if (!homeAccountId) {
-                throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.unableToLoadToken
-                );
-            }
-            const claimsTenantId = idTokenClaims.tid;
-
-            const cachedAccount = buildAccountToCache(
-                this.storage,
-                authority,
-                homeAccountId,
-                idTokenClaims,
-                base64Decode,
-                clientInfo,
-                authority.hostnameAndPort,
-                claimsTenantId,
-                undefined, // authCodePayload
-                undefined, // nativeAccountId
-                this.logger
-            );
+        this.logger.verbose("TokenCache - loading account");
 
-            this.storage.setAccount(cachedAccount);
-            return cachedAccount;
-        } else {
+        if (request.account) {
+            const accountEntity = AccountEntity.createFromAccountInfo(
+                request.account
+            );
+            this.storage.setAccount(accountEntity);
+            return accountEntity;
+        } else if (!authority || (!clientInfo && !idTokenClaims)) {
+            this.logger.error(
+                "TokenCache - if an account is not provided on the request, authority and either clientInfo or idToken must be provided instead."
+            );
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.unableToLoadToken
             );
         }
+
+        const homeAccountId = AccountEntity.generateHomeAccountId(
+            clientInfo,
+            authority.authorityType,
+            this.logger,
+            this.cryptoObj,
+            idTokenClaims
+        );
+
+        const claimsTenantId = idTokenClaims?.tid;
+
+        const cachedAccount = buildAccountToCache(
+            this.storage,
+            authority,
+            homeAccountId,
+            base64Decode,
+            idTokenClaims,
+            clientInfo,
+            authority.hostnameAndPort,
+            claimsTenantId,
+            undefined, // authCodePayload
+            undefined, // nativeAccountId
+            this.logger
+        );
+
+        this.storage.setAccount(cachedAccount);
+        return cachedAccount;
     }
 
     /**
@@ -297,28 +223,27 @@ export class TokenCache implements ITokenCache {
      * @returns `IdTokenEntity`
      */
     private loadIdToken(
-        idToken: string,
+        response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
         tenantId: string
-    ): IdTokenEntity {
+    ): IdTokenEntity | null {
+        if (!response.id_token) {
+            this.logger.verbose("TokenCache - no id token found in response");
+            return null;
+        }
+
+        this.logger.verbose("TokenCache - loading id token");
         const idTokenEntity = CacheHelpers.createIdTokenEntity(
             homeAccountId,
             environment,
-            idToken,
+            response.id_token,
             this.config.auth.clientId,
             tenantId
         );
 
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading id token");
-            this.storage.setIdTokenCredential(idTokenEntity);
-            return idTokenEntity;
-        } else {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
+        this.storage.setIdTokenCredential(idTokenEntity);
+        return idTokenEntity;
     }
 
     /**
@@ -340,28 +265,37 @@ export class TokenCache implements ITokenCache {
     ): AccessTokenEntity | null {
         if (!response.access_token) {
             this.logger.verbose(
-                "TokenCache - No access token provided for caching"
+                "TokenCache - no access token found in response"
             );
             return null;
-        }
-
-        if (!response.expires_in) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
+        } else if (!response.expires_in) {
+            this.logger.error(
+                "TokenCache - no expiration set on the access token. Cannot add it to the cache."
             );
-        }
-
-        if (!options.extendedExpiresOn) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
+            return null;
+        } else if (
+            !response.scope &&
+            (!request.scopes || !request.scopes.length)
+        ) {
+            this.logger.error(
+                "TokenCache - scopes not specified in the request or response. Cannot add token to the cache."
             );
+            return null;
         }
 
-        const scopes = new ScopeSet(request.scopes).printScopes();
+        this.logger.verbose("TokenCache - loading access token");
+
+        const scopes = response.scope
+            ? ScopeSet.fromString(response.scope)
+            : new ScopeSet(request.scopes);
         const expiresOn =
             options.expiresOn ||
             response.expires_in + new Date().getTime() / 1000;
-        const extendedExpiresOn = options.extendedExpiresOn;
+
+        const extendedExpiresOn =
+            options.extendedExpiresOn ||
+            (response.ext_expires_in || response.expires_in) +
+                new Date().getTime() / 1000;
 
         const accessTokenEntity = CacheHelpers.createAccessTokenEntity(
             homeAccountId,
@@ -369,21 +303,14 @@ export class TokenCache implements ITokenCache {
             response.access_token,
             this.config.auth.clientId,
             tenantId,
-            scopes,
+            scopes.printScopes(),
             expiresOn,
             extendedExpiresOn,
             base64Decode
         );
 
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading access token");
-            this.storage.setAccessTokenCredential(accessTokenEntity);
-            return accessTokenEntity;
-        } else {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
+        this.storage.setAccessTokenCredential(accessTokenEntity);
+        return accessTokenEntity;
     }
 
     /**
@@ -395,34 +322,30 @@ export class TokenCache implements ITokenCache {
      * @returns `RefreshTokenEntity`
      */
     private loadRefreshToken(
-        request: SilentRequest,
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string
     ): RefreshTokenEntity | null {
         if (!response.refresh_token) {
             this.logger.verbose(
-                "TokenCache - No refresh token provided for caching"
+                "TokenCache - no refresh token found in response"
             );
             return null;
         }
 
+        this.logger.verbose("TokenCache - loading refresh token");
         const refreshTokenEntity = CacheHelpers.createRefreshTokenEntity(
             homeAccountId,
             environment,
             response.refresh_token,
-            this.config.auth.clientId
+            this.config.auth.clientId,
+            response.foci,
+            undefined, // userAssertionHash
+            response.refresh_token_expires_in
         );
 
-        if (this.isBrowserEnvironment) {
-            this.logger.verbose("TokenCache - loading refresh token");
-            this.storage.setRefreshTokenCredential(refreshTokenEntity);
-            return refreshTokenEntity;
-        } else {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToLoadToken
-            );
-        }
+        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        return refreshTokenEntity;
     }
 
     /**
@@ -435,12 +358,11 @@ export class TokenCache implements ITokenCache {
      */
     private generateAuthenticationResult(
         request: SilentRequest,
-        idTokenClaims: TokenClaims,
-        cacheRecord: CacheRecord,
-        accountEntity: AccountEntity,
+        cacheRecord: CacheRecord & { account: AccountEntity },
+        idTokenClaims?: TokenClaims,
         authority?: Authority
     ): AuthenticationResult {
-        let accessToken: string = Constants.EMPTY_STRING;
+        let accessToken: string = "";
         let responseScopes: Array<string> = [];
         let expiresOn: Date | null = null;
         let extExpiresOn: Date | undefined;
@@ -458,16 +380,12 @@ export class TokenCache implements ITokenCache {
             );
         }
 
-        const uid =
-            idTokenClaims.oid || idTokenClaims.sub || Constants.EMPTY_STRING;
-        const tid = idTokenClaims.tid || Constants.EMPTY_STRING;
+        const accountEntity = cacheRecord.account;
 
         return {
-            authority: authority
-                ? authority.canonicalAuthority
-                : Constants.EMPTY_STRING,
-            uniqueId: uid,
-            tenantId: tid,
+            authority: authority ? authority.canonicalAuthority : "",
+            uniqueId: cacheRecord.account.localAccountId,
+            tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
             account: accountEntity.getAccountInfo(),
             idToken: cacheRecord.idToken?.secret || "",
@@ -475,17 +393,14 @@ export class TokenCache implements ITokenCache {
             accessToken: accessToken,
             fromCache: true,
             expiresOn: expiresOn,
-            correlationId: request.correlationId || Constants.EMPTY_STRING,
-            requestId: Constants.EMPTY_STRING,
+            correlationId: request.correlationId || "",
+            requestId: "",
             extExpiresOn: extExpiresOn,
-            familyId: Constants.EMPTY_STRING,
-            tokenType:
-                cacheRecord?.accessToken?.tokenType || Constants.EMPTY_STRING,
-            state: Constants.EMPTY_STRING,
-            cloudGraphHostName:
-                accountEntity.cloudGraphHostName || Constants.EMPTY_STRING,
-            msGraphHost: accountEntity.msGraphHost || Constants.EMPTY_STRING,
-            code: undefined,
+            familyId: cacheRecord.refreshToken?.familyId || "",
+            tokenType: cacheRecord?.accessToken?.tokenType || "",
+            state: request.state || "",
+            cloudGraphHostName: accountEntity.cloudGraphHostName || "",
+            msGraphHost: accountEntity.msGraphHost || "",
             fromNativeBroker: false,
         };
     }

package/src/controllers/StandardController.ts

@@ -1963,6 +1963,8 @@ export class StandardController implements IController {
         request: SilentRequest & { correlationId: string },
         account: AccountInfo
     ): Promise<AuthenticationResult> {
+        const trackPageVisibility = () =>
+            this.trackPageVisibility(request.correlationId);
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.AcquireTokenSilentAsync,
             request.correlationId
@@ -1981,9 +1983,7 @@ export class StandardController implements IController {
             );
         }
 
-        document.addEventListener("visibilitychange", () =>
-            this.trackPageVisibility(request.correlationId)
-        );
+        document.addEventListener("visibilitychange", trackPageVisibility);
 
         const silentRequest = await invokeAsync(
             initializeSilentRequest,
@@ -2124,8 +2124,9 @@ export class StandardController implements IController {
                 throw tokenRenewalError;
             })
             .finally(() => {
-                document.removeEventListener("visibilitychange", () =>
-                    this.trackPageVisibility(request.correlationId)
+                document.removeEventListener(
+                    "visibilitychange",
+                    trackPageVisibility
                 );
             });
     }

package/src/crypto/CryptoOps.ts

@@ -78,6 +78,23 @@ export class CryptoOps implements ICrypto {
         return base64Decode(input);
     }
 
+    /**
+     * Encodes input string to base64 URL safe string.
+     * @param input
+     */
+    base64UrlEncode(input: string): string {
+        return urlEncode(input);
+    }
+
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string {
+        return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+    }
+
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request

package/src/error/BrowserAuthError.ts

@@ -90,6 +90,8 @@ export const BrowserAuthErrorMessages = {
         "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [BrowserAuthErrorCodes.invalidBase64String]:
         "Invalid base64 encoded string.",
+    [BrowserAuthErrorCodes.invalidPopTokenRequest]:
+        "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
 };
 
 /**
@@ -333,6 +335,12 @@ export const BrowserAuthErrorMessage = {
             BrowserAuthErrorCodes.invalidBase64String
         ],
     },
+    invalidPopTokenRequest: {
+        code: BrowserAuthErrorCodes.invalidPopTokenRequest,
+        desc: BrowserAuthErrorMessages[
+            BrowserAuthErrorCodes.invalidPopTokenRequest
+        ],
+    },
 };
 
 /**

package/src/error/BrowserAuthErrorCodes.ts

@@ -55,3 +55,4 @@ export const uninitializedPublicClientApplication =
     "uninitialized_public_client_application";
 export const nativePromptNotSupported = "native_prompt_not_supported";
 export const invalidBase64String = "invalid_base64_string";
+export const invalidPopTokenRequest = "invalid_pop_token_request";

package/src/error/NestedAppAuthError.ts

@@ -11,7 +11,7 @@ import { AuthError } from "@azure/msal-common";
 export const NestedAppAuthErrorMessage = {
     unsupportedMethod: {
         code: "unsupported_method",
-        desc: "The PKCE code challenge and verifier could not be generated.",
+        desc: "This method is not supported in nested app environment.",
     },
 };