@azure/msal-browser 3.19.1 → 3.21.0

package/src/interaction_client/PopupClient.ts

@@ -20,6 +20,7 @@ import {
     ServerResponseType,
     invokeAsync,
     invoke,
+    ServerError,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { EventType } from "../event/EventType";
@@ -47,6 +48,7 @@ import { PopupWindowAttributes } from "../request/PopupWindowAttributes";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import * as ResponseHandler from "../response/ResponseHandler";
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -182,7 +184,7 @@ export class PopupClient extends StandardInteractionClient {
     }
 
     /**
-     * Helper which obtains an access_token for your API via opening a popup window in the user's browser
+     * Helper which initializes authorization clients and requests
      * @param validRequest
      * @param popupName
      * @param popup
@@ -211,19 +213,20 @@ export class PopupClient extends StandardInteractionClient {
 
         BrowserUtils.preconnect(validRequest.authority);
 
+        let authClient: AuthorizationCodeClient | undefined;
+
         try {
             // Create auth code request and generate PKCE params
-            const authCodeRequest: CommonAuthorizationCodeRequest =
-                await invokeAsync(
-                    this.initializeAuthorizationCodeRequest.bind(this),
-                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                    this.logger,
-                    this.performanceClient,
-                    this.correlationId
-                )(validRequest);
+            const authCodeRequest = await invokeAsync(
+                this.initializeAuthorizationCodeRequest.bind(this),
+                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(validRequest);
 
             // Initialize the client
-            const authClient: AuthorizationCodeClient = await invokeAsync(
+            authClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
                 PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
                 this.logger,
@@ -236,136 +239,218 @@ export class PopupClient extends StandardInteractionClient {
                 validRequest.account
             );
 
-            const isNativeBroker = NativeMessageHandler.isNativeAvailable(
-                this.config,
+            return await invokeAsync(
+                this.acquireTokenPopupAsyncHelper.bind(this),
+                PerformanceEvents.PopupClientTokenHelper,
                 this.logger,
-                this.nativeMessageHandler,
-                request.authenticationScheme
-            );
-            // Start measurement for server calls with native brokering enabled
-            let fetchNativeAccountIdMeasurement;
-            if (isNativeBroker) {
-                fetchNativeAccountIdMeasurement =
-                    this.performanceClient.startMeasurement(
-                        PerformanceEvents.FetchAccountIdWithNativeBroker,
-                        request.correlationId
-                    );
-            }
-
-            // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
-                ...validRequest,
-                nativeBroker: isNativeBroker,
-            });
-
-            // Create popup interaction handler.
-            const interactionHandler = new InteractionHandler(
+                this.performanceClient,
+                this.correlationId
+            )(
                 authClient,
-                this.browserStorage,
                 authCodeRequest,
-                this.logger,
-                this.performanceClient
-            );
-
-            // Show the UI once the url has been created. Get the window handle for the popup.
-            const popupParameters: PopupParams = {
-                popup,
+                validRequest,
+                request,
                 popupName,
                 popupWindowAttributes,
-            };
-            const popupWindow: Window = this.initiateAuthRequest(
-                navigateUrl,
-                popupParameters
+                popup
             );
-            this.eventHandler.emitEvent(
-                EventType.POPUP_OPENED,
-                InteractionType.Popup,
-                { popupWindow },
-                null
+        } catch (e) {
+            if (popup) {
+                // Close the synchronous popup if an error is thrown before the window unload event is registered
+                popup.close();
+            }
+
+            if (e instanceof AuthError) {
+                (e as AuthError).setCorrelationId(this.correlationId);
+                serverTelemetryManager.cacheFailedRequest(e);
+            }
+
+            if (
+                !authClient ||
+                !(e instanceof ServerError) ||
+                e.errorCode !== BrowserConstants.INVALID_GRANT_ERROR
+            ) {
+                throw e;
+            }
+
+            this.performanceClient.addFields(
+                {
+                    retryError: e.errorCode,
+                },
+                this.correlationId
             );
 
-            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await this.monitorPopupForHash(popupWindow);
+            const retryAuthCodeRequest = await invokeAsync(
+                this.initializeAuthorizationCodeRequest.bind(this),
+                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(validRequest);
 
-            const serverParams = invoke(
-                ResponseHandler.deserializeResponse,
-                PerformanceEvents.DeserializeResponse,
+            return await invokeAsync(
+                this.acquireTokenPopupAsyncHelper.bind(this),
+                PerformanceEvents.PopupClientTokenHelper,
                 this.logger,
                 this.performanceClient,
                 this.correlationId
             )(
-                responseString,
-                this.config.auth.OIDCOptions.serverResponseType,
-                this.logger
-            );
-            // Remove throttle if it exists
-            ThrottlingUtils.removeThrottle(
-                this.browserStorage,
-                this.config.auth.clientId,
-                authCodeRequest
+                authClient,
+                retryAuthCodeRequest,
+                validRequest,
+                request,
+                popupName,
+                popupWindowAttributes,
+                popup
             );
+        }
+    }
 
-            if (serverParams.accountId) {
-                this.logger.verbose(
-                    "Account id found in hash, calling WAM for token"
-                );
-                // end measurement for server call with native brokering enabled
-                if (fetchNativeAccountIdMeasurement) {
-                    fetchNativeAccountIdMeasurement.end({
-                        success: true,
-                        isNativeBroker: true,
-                    });
-                }
+    /**
+     * Helper which obtains an access_token for your API via opening a popup window in the user's browser
+     * @param authClient
+     * @param authCodeRequest
+     * @param validRequest
+     * @param request
+     * @param popupName
+     * @param popupWindowAttributes
+     * @param popup
+     * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+     */
+    protected async acquireTokenPopupAsyncHelper(
+        authClient: AuthorizationCodeClient,
+        authCodeRequest: CommonAuthorizationCodeRequest,
+        validRequest: AuthorizationUrlRequest,
+        request: PopupRequest,
+        popupName: string,
+        popupWindowAttributes: PopupWindowAttributes,
+        popup?: Window | null
+    ): Promise<AuthenticationResult> {
+        const correlationId = validRequest.correlationId;
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.PopupClientTokenHelper,
+            correlationId
+        );
 
-                if (!this.nativeMessageHandler) {
-                    throw createBrowserAuthError(
-                        BrowserAuthErrorCodes.nativeConnectionNotEstablished
-                    );
-                }
-                const nativeInteractionClient = new NativeInteractionClient(
-                    this.config,
-                    this.browserStorage,
-                    this.browserCrypto,
-                    this.logger,
-                    this.eventHandler,
-                    this.navigationClient,
-                    ApiId.acquireTokenPopup,
-                    this.performanceClient,
-                    this.nativeMessageHandler,
-                    serverParams.accountId,
-                    this.nativeStorage,
-                    validRequest.correlationId
-                );
-                const { userRequestState } = ProtocolUtils.parseRequestState(
-                    this.browserCrypto,
-                    validRequest.state
+        const isNativeBroker = NativeMessageHandler.isNativeAvailable(
+            this.config,
+            this.logger,
+            this.nativeMessageHandler,
+            request.authenticationScheme
+        );
+
+        // Start measurement for server calls with native brokering enabled
+        let fetchNativeAccountIdMeasurement;
+        if (isNativeBroker) {
+            fetchNativeAccountIdMeasurement =
+                this.performanceClient.startMeasurement(
+                    PerformanceEvents.FetchAccountIdWithNativeBroker,
+                    request.correlationId
                 );
-                return await nativeInteractionClient.acquireToken({
-                    ...validRequest,
-                    state: userRequestState,
-                    prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
-                });
-            }
+        }
 
-            // Handle response from hash string.
-            const result = await interactionHandler.handleCodeResponse(
-                serverParams,
-                validRequest
-            );
+        // Create acquire token url.
+        const navigateUrl = await authClient.getAuthCodeUrl({
+            ...validRequest,
+            nativeBroker: isNativeBroker,
+        });
 
-            return result;
-        } catch (e) {
-            if (popup) {
-                // Close the synchronous popup if an error is thrown before the window unload event is registered
-                popup.close();
+        // Create popup interaction handler.
+        const interactionHandler = new InteractionHandler(
+            authClient,
+            this.browserStorage,
+            authCodeRequest,
+            this.logger,
+            this.performanceClient
+        );
+
+        // Show the UI once the url has been created. Get the window handle for the popup.
+        const popupParameters: PopupParams = {
+            popup,
+            popupName,
+            popupWindowAttributes,
+        };
+        const popupWindow: Window = this.initiateAuthRequest(
+            navigateUrl,
+            popupParameters
+        );
+        this.eventHandler.emitEvent(
+            EventType.POPUP_OPENED,
+            InteractionType.Popup,
+            { popupWindow },
+            null
+        );
+
+        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await this.monitorPopupForHash(popupWindow);
+
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            responseString,
+            this.config.auth.OIDCOptions.serverResponseType,
+            this.logger
+        );
+        // Remove throttle if it exists
+        ThrottlingUtils.removeThrottle(
+            this.browserStorage,
+            this.config.auth.clientId,
+            authCodeRequest
+        );
+
+        if (serverParams.accountId) {
+            this.logger.verbose(
+                "Account id found in hash, calling WAM for token"
+            );
+            // end measurement for server call with native brokering enabled
+            if (fetchNativeAccountIdMeasurement) {
+                fetchNativeAccountIdMeasurement.end({
+                    success: true,
+                    isNativeBroker: true,
+                });
             }
 
-            if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
-                serverTelemetryManager.cacheFailedRequest(e);
+            if (!this.nativeMessageHandler) {
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.nativeConnectionNotEstablished
+                );
             }
-            throw e;
+            const nativeInteractionClient = new NativeInteractionClient(
+                this.config,
+                this.browserStorage,
+                this.browserCrypto,
+                this.logger,
+                this.eventHandler,
+                this.navigationClient,
+                ApiId.acquireTokenPopup,
+                this.performanceClient,
+                this.nativeMessageHandler,
+                serverParams.accountId,
+                this.nativeStorage,
+                validRequest.correlationId
+            );
+            const { userRequestState } = ProtocolUtils.parseRequestState(
+                this.browserCrypto,
+                validRequest.state
+            );
+            return nativeInteractionClient.acquireToken({
+                ...validRequest,
+                state: userRequestState,
+                prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
+            });
         }
+
+        // Handle response from hash string.
+        const result = await interactionHandler.handleCodeResponse(
+            serverParams,
+            validRequest
+        );
+
+        return result;
     }
 
     /**

package/src/interaction_client/RedirectClient.ts

@@ -22,10 +22,12 @@ import {
     ServerResponseType,
     UrlUtils,
     InProgressPerformanceEvent,
+    ServerError,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
     ApiId,
+    BrowserConstants,
     InteractionType,
     TemporaryCacheKeys,
 } from "../utils/BrowserConstants";
@@ -83,6 +85,14 @@ export class RedirectClient extends StandardInteractionClient {
      * @param request
      */
     async acquireToken(request: RedirectRequest): Promise<void> {
+        if (request.onRedirectNavigate) {
+            this.logger.warning(
+                "Unable to cache redirect request, onRedirectNavigate request option has been deprecated. Please set onRedirectNavigate on PublicClientApplication config instead."
+            );
+        } else {
+            this.browserStorage.cacheRedirectRequest(request);
+        }
+
         const validRequest = await invokeAsync(
             this.initializeAuthorizationRequest.bind(this),
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
@@ -174,7 +184,9 @@ export class RedirectClient extends StandardInteractionClient {
                 navigationClient: this.navigationClient,
                 redirectTimeout: this.config.system.redirectNavigationTimeout,
                 redirectStartPage: redirectStartPage,
-                onRedirectNavigate: request.onRedirectNavigate,
+                onRedirectNavigate:
+                    request.onRedirectNavigate ||
+                    this.config.auth.onRedirectNavigate,
             });
         } catch (e) {
             if (e instanceof AuthError) {
@@ -201,6 +213,7 @@ export class RedirectClient extends StandardInteractionClient {
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             ApiId.handleRedirectPromise
         );
+
         try {
             if (!this.browserStorage.isInteractionInProgress(true)) {
                 this.logger.info(
@@ -331,10 +344,57 @@ export class RedirectClient extends StandardInteractionClient {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
             }
+
+            if (
+                e instanceof ServerError &&
+                e.errorCode === BrowserConstants.INVALID_GRANT_ERROR
+            ) {
+                this.performanceClient.addFields(
+                    {
+                        retryError: e.errorCode,
+                    },
+                    this.correlationId
+                );
+
+                const requestRetried = this.browserStorage.getRequestRetried();
+
+                if (requestRetried) {
+                    this.logger.error(
+                        "Retried request already detected. Throwing error."
+                    );
+                    this.browserStorage.removeRequestRetried();
+                    throw e;
+                }
+
+                const redirectRequest =
+                    this.browserStorage.getCachedRedirectRequest();
+                if (!redirectRequest) {
+                    this.logger.error(
+                        "Unable to retry. Please retry with redirect request"
+                    );
+                    this.browserStorage.setRequestRetried();
+                    throw createBrowserAuthError(
+                        BrowserAuthErrorCodes.failedToRetry
+                    );
+                }
+
+                this.browserStorage.setRequestRetried();
+
+                await this.acquireToken(redirectRequest);
+                return null;
+            }
+
+            this.browserStorage.removeTemporaryItem(
+                this.browserStorage.generateCacheKey(
+                    TemporaryCacheKeys.REDIRECT_REQUEST
+                )
+            );
+            this.browserStorage.removeRequestRetried();
+            throw e;
+        } finally {
             this.browserStorage.cleanRequestByInteractionType(
                 InteractionType.Redirect
             );
-            throw e;
         }
     }
 

package/src/interaction_client/SilentIframeClient.ts

@@ -15,6 +15,7 @@ import {
     PerformanceEvents,
     invokeAsync,
     invoke,
+    ServerError,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -26,7 +27,11 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { InteractionType, ApiId } from "../utils/BrowserConstants";
+import {
+    InteractionType,
+    ApiId,
+    BrowserConstants,
+} from "../utils/BrowserConstants";
 import {
     initiateAuthRequest,
     monitorIframeForHash,
@@ -123,9 +128,11 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.apiId
         );
 
+        let authClient: AuthorizationCodeClient | undefined;
+
         try {
             // Initialize the client
-            const authClient: AuthorizationCodeClient = await invokeAsync(
+            authClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
                 PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
                 this.logger,
@@ -150,7 +157,38 @@ export class SilentIframeClient extends StandardInteractionClient {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
             }
-            throw e;
+
+            if (
+                !authClient ||
+                !(e instanceof ServerError) ||
+                e.errorCode !== BrowserConstants.INVALID_GRANT_ERROR
+            ) {
+                throw e;
+            }
+
+            this.performanceClient.addFields(
+                {
+                    retryError: e.errorCode,
+                },
+                this.correlationId
+            );
+
+            const retrySilentRequest: AuthorizationUrlRequest =
+                await invokeAsync(
+                    this.initializeAuthorizationRequest.bind(this),
+                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(inputRequest, InteractionType.Silent);
+
+            return await invokeAsync(
+                this.silentTokenHelper.bind(this),
+                PerformanceEvents.SilentIframeClientTokenHelper,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(authClient, retrySilentRequest);
         }
     }
 

package/src/interaction_handler/RedirectHandler.ts

@@ -222,6 +222,7 @@ export class RedirectHandler {
         )) as AuthenticationResult;
 
         this.browserStorage.cleanRequestByState(state);
+        this.browserStorage.removeRequestRetried();
         return tokenResponse;
     }
 

package/src/naa/BridgeProxy.ts

@@ -16,6 +16,7 @@ import { IBridgeProxy } from "./IBridgeProxy";
 import { InitContext } from "./InitContext";
 import { TokenRequest } from "./TokenRequest";
 import * as BrowserCrypto from "../crypto/BrowserCrypto";
+import { supportsBrowserPerformanceNow } from "../telemetry/BrowserPerformanceClient";
 
 declare global {
     interface Window {
@@ -81,7 +82,9 @@ export class BridgeProxy implements IBridgeProxy {
                         messageType: "NestedAppAuthRequest",
                         method: "GetInitContext",
                         requestId: BrowserCrypto.createNewGuid(),
-                        sendTime: Date.now(),
+                        sendTime: supportsBrowserPerformanceNow()
+                            ? window.performance.now()
+                            : Date.now(),
                     };
                     const request: BridgeRequest = {
                         requestId: message.requestId,
@@ -157,7 +160,9 @@ export class BridgeProxy implements IBridgeProxy {
             messageType: "NestedAppAuthRequest",
             method: method,
             requestId: BrowserCrypto.createNewGuid(),
-            sendTime: Date.now(),
+            sendTime: supportsBrowserPerformanceNow()
+                ? window.performance.now()
+                : Date.now(),
             ...requestParams,
         };
 

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.19.1";
+export const version = "3.21.0";

package/src/request/RedirectRequest.ts

@@ -46,6 +46,11 @@ export type RedirectRequest = Partial<
 > & {
     scopes: Array<string>;
     redirectStartPage?: string;
+    /**
+     * @deprecated
+     * onRedirectNavigate is deprecated and will be removed in the next major version.
+     * Set onRedirectNavigate in Configuration instead.
+     */
     onRedirectNavigate?: (url: string) => boolean | void;
     tokenBodyParameters?: StringDict;
 };

package/src/telemetry/BrowserPerformanceClient.ts

@@ -42,7 +42,7 @@ function getPerfMeasurementModule() {
 /**
  * Returns boolean, indicating whether browser supports window.performance.now() function.
  */
-function supportsBrowserPerformanceNow(): boolean {
+export function supportsBrowserPerformanceNow(): boolean {
     return (
         typeof window !== "undefined" &&
         typeof window.performance !== "undefined" &&

package/src/utils/BrowserConstants.ts

@@ -93,6 +93,8 @@ export const TemporaryCacheKeys = {
     CORRELATION_ID: "request.correlationId",
     NATIVE_REQUEST: "request.native",
     REDIRECT_CONTEXT: "request.redirect.context",
+    REDIRECT_REQUEST: "request.redirect",
+    REQUEST_RETRY: "request.retry",
 } as const;
 export type TemporaryCacheKeys =
     (typeof TemporaryCacheKeys)[keyof typeof TemporaryCacheKeys];