@azure/msal-browser 3.2.0 → 3.4.0

package/src/interaction_client/SilentIframeClient.ts

@@ -10,7 +10,6 @@ import {
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     AuthError,
-    Constants,
     UrlString,
     ServerAuthorizationCodeResponse,
     ProtocolUtils,
@@ -29,11 +28,16 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { InteractionType, ApiId } from "../utils/BrowserConstants";
-import { SilentHandler } from "../interaction_handler/SilentHandler";
+import {
+    initiateAuthRequest,
+    monitorIframeForHash,
+} from "../interaction_handler/SilentHandler";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler";
 import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import { InteractionHandler } from "../interaction_handler/InteractionHandler";
+import * as BrowserUtils from "../utils/BrowserUtils";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -114,13 +118,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             },
             InteractionType.Silent
         );
-        this.browserStorage.updateCacheEntries(
-            silentRequest.state,
-            silentRequest.nonce,
-            silentRequest.authority,
-            silentRequest.loginHint || Constants.EMPTY_STRING,
-            silentRequest.account || null
-        );
+        BrowserUtils.preconnect(silentRequest.authority);
 
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             this.apiId
@@ -152,7 +150,6 @@ export class SilentIframeClient extends StandardInteractionClient {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
             }
-            this.browserStorage.cleanRequestByState(silentRequest.state);
             throw e;
         }
     }
@@ -179,9 +176,10 @@ export class SilentIframeClient extends StandardInteractionClient {
         authClient: AuthorizationCodeClient,
         silentRequest: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
+        const correlationId = silentRequest.correlationId;
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentIframeClientTokenHelper,
-            silentRequest.correlationId
+            correlationId
         );
 
         // Create auth code request and generate PKCE params
@@ -191,7 +189,7 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )(silentRequest);
 
         // Create authorize request url
@@ -200,7 +198,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             PerformanceEvents.GetAuthCodeUrl,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
+            correlationId
         )({
             ...silentRequest,
             nativeBroker: NativeMessageHandler.isNativeAvailable(
@@ -212,38 +210,60 @@ export class SilentIframeClient extends StandardInteractionClient {
         });
 
         // Create silent handler
-        const silentHandler = new SilentHandler(
+        const interactionHandler = new InteractionHandler(
             authClient,
             this.browserStorage,
             authCodeRequest,
             this.logger,
-            this.config.system,
             this.performanceClient
         );
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(
-            silentHandler.initiateAuthRequest.bind(silentHandler),
+            initiateAuthRequest,
             PerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(navigateUrl);
+            correlationId
+        )(
+            navigateUrl,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            this.config.system.navigateFrameWait
+        );
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const hash = await invokeAsync(
-            silentHandler.monitorIframeForHash.bind(silentHandler),
+            monitorIframeForHash,
             PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(msalFrame, this.config.system.iframeHashTimeout);
+            correlationId
+        )(
+            msalFrame,
+            this.config.system.iframeHashTimeout,
+            this.config.system.pollIntervalMilliseconds,
+            this.performanceClient,
+            this.logger,
+            correlationId
+        );
+        if (!hash) {
+            // No hash is present
+            this.logger.error(
+                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
+            );
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        } else if (!UrlString.hashContainsKnownProperties(hash)) {
+            this.logger.error(
+                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
+            );
+            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+            );
+        }
         // Deserialize hash fragment response parameters.
         const serverParams: ServerAuthorizationCodeResponse =
             UrlString.getDeserializedHash(hash);
-        const state = this.validateAndExtractStateFromHash(
-            serverParams,
-            InteractionType.Silent,
-            authCodeRequest.correlationId
-        );
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -266,11 +286,11 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.nativeMessageHandler,
                 serverParams.accountId,
                 this.browserStorage,
-                this.correlationId
+                correlationId
             );
             const { userRequestState } = ProtocolUtils.parseRequestState(
                 this.browserCrypto,
-                state
+                silentRequest.state
             );
             return invokeAsync(
                 nativeInteractionClient.acquireToken.bind(
@@ -279,23 +299,23 @@ export class SilentIframeClient extends StandardInteractionClient {
                 PerformanceEvents.NativeInteractionClientAcquireToken,
                 this.logger,
                 this.performanceClient,
-                silentRequest.correlationId
+                correlationId
             )({
                 ...silentRequest,
                 state: userRequestState,
                 prompt: silentRequest.prompt || PromptValue.NONE,
-            }).finally(() => {
-                this.browserStorage.cleanRequestByState(state);
             });
         }
 
         // Handle response from hash string
         return invokeAsync(
-            silentHandler.handleCodeResponseFromHash.bind(silentHandler),
+            interactionHandler.handleCodeResponseFromHash.bind(
+                interactionHandler
+            ),
             PerformanceEvents.HandleCodeResponseFromHash,
             this.logger,
             this.performanceClient,
-            silentRequest.correlationId
-        )(hash, state, authClient.authority, this.networkClient);
+            correlationId
+        )(hash, silentRequest);
     }
 }

package/src/interaction_client/SilentRefreshClient.ts

@@ -53,7 +53,6 @@ export class SilentRefreshClient extends StandardInteractionClient {
             silentRequest.authority,
             silentRequest.azureCloudOptions
         );
-        this.logger.verbose("Refresh token client created");
         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
         return invokeAsync(
             refreshTokenClient.acquireTokenByRefreshToken.bind(
@@ -63,24 +62,11 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(silentRequest)
-            .then((result) => result as AuthenticationResult)
-            .then((result: AuthenticationResult) => {
-                this.performanceClient.addFields(
-                    {
-                        fromCache: result.fromCache,
-                        requestId: result.requestId,
-                    },
-                    request.correlationId
-                );
-
-                return result;
-            })
-            .catch((e: AuthError) => {
-                (e as AuthError).setCorrelationId(this.correlationId);
-                serverTelemetryManager.cacheFailedRequest(e);
-                throw e;
-            });
+        )(silentRequest).catch((e: AuthError) => {
+            (e as AuthError).setCorrelationId(this.correlationId);
+            serverTelemetryManager.cacheFailedRequest(e);
+            throw e;
+        }) as Promise<AuthenticationResult>;
     }
 
     /**

package/src/interaction_client/StandardInteractionClient.ts

@@ -37,7 +37,7 @@ import {
     BrowserStateObject,
 } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
-import { BrowserUtils } from "../utils/BrowserUtils";
+import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
 import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";

package/src/interaction_handler/InteractionHandler.ts

@@ -7,17 +7,13 @@ import {
     AuthorizationCodePayload,
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
-    AuthorityFactory,
-    Authority,
-    INetworkModule,
     CcsCredential,
     Logger,
     ServerError,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
-    createClientAuthError,
-    ClientAuthErrorCodes,
+    CcsCredentialType,
 } from "@azure/msal-common";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -25,10 +21,8 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { TemporaryCacheKeys } from "../utils/BrowserConstants";
 import { AuthenticationResult } from "../response/AuthenticationResult";
-
-export type InteractionParams = {};
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 
 /**
  * Abstract class which defines operations for a browser interaction handling class.
@@ -60,34 +54,22 @@ export class InteractionHandler {
      */
     async handleCodeResponseFromHash(
         locationHash: string,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule
+        request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.HandleCodeResponseFromHash,
-            this.authCodeRequest.correlationId
+            request.correlationId
         );
         // Check that location hash isn't empty.
         if (!locationHash) {
             throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
         }
 
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.stateNotFound,
-                "Cached State"
-            );
-        }
-
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
                 locationHash,
-                requestState
+                request.state
             );
         } catch (e) {
             if (
@@ -108,8 +90,8 @@ export class InteractionHandler {
             PerformanceEvents.HandleCodeResponseFromServer,
             this.logger,
             this.performanceClient,
-            this.authCodeRequest.correlationId
-        )(authCodeResponse, state, authority, networkModule);
+            request.correlationId
+        )(authCodeResponse, request);
     }
 
     /**
@@ -122,65 +104,46 @@ export class InteractionHandler {
      */
     async handleCodeResponseFromServer(
         authCodeResponse: AuthorizationCodePayload,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule,
+        request: AuthorizationUrlRequest,
         validateNonce: boolean = true
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.HandleCodeResponseFromServer,
-            this.authCodeRequest.correlationId
+            request.correlationId
         );
         this.logger.trace(
             "InteractionHandler.handleCodeResponseFromServer called"
         );
 
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.stateNotFound,
-                "Cached State"
-            );
-        }
-
-        // Get cached items
-        const nonceKey = this.browserStorage.generateNonceKey(requestState);
-        const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
-
         // Assign code to request
         this.authCodeRequest.code = authCodeResponse.code;
 
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
             await invokeAsync(
-                this.updateTokenEndpointAuthority.bind(this),
+                this.authModule.updateAuthority.bind(this.authModule),
                 PerformanceEvents.UpdateTokenEndpointAuthority,
                 this.logger,
                 this.performanceClient,
-                this.authCodeRequest.correlationId
-            )(
-                authCodeResponse.cloud_instance_host_name,
-                authority,
-                networkModule
-            );
+                request.correlationId
+            )(authCodeResponse.cloud_instance_host_name, request.correlationId);
         }
 
         // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
         if (validateNonce) {
-            authCodeResponse.nonce = cachedNonce || undefined;
+            // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
+            authCodeResponse.nonce = request.nonce || undefined;
         }
 
-        authCodeResponse.state = requestState;
+        authCodeResponse.state = request.state;
 
         // Add CCS parameters if available
         if (authCodeResponse.client_info) {
             this.authCodeRequest.clientInfo = authCodeResponse.client_info;
         } else {
-            const cachedCcsCred = this.checkCcsCredentials();
-            if (cachedCcsCred) {
-                this.authCodeRequest.ccsCredential = cachedCcsCred;
+            const ccsCred = this.createCcsCredentials(request);
+            if (ccsCred) {
+                this.authCodeRequest.ccsCredential = ccsCred;
             }
         }
 
@@ -190,62 +153,29 @@ export class InteractionHandler {
             PerformanceEvents.AuthClientAcquireToken,
             this.logger,
             this.performanceClient,
-            this.authCodeRequest.correlationId
+            request.correlationId
         )(this.authCodeRequest, authCodeResponse)) as AuthenticationResult;
-        this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
 
     /**
-     * Updates authority based on cloudInstanceHostname
-     * @param cloudInstanceHostname
-     * @param authority
-     * @param networkModule
+     * Build ccs creds if available
      */
-    protected async updateTokenEndpointAuthority(
-        cloudInstanceHostname: string,
-        authority: Authority,
-        networkModule: INetworkModule
-    ): Promise<void> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.UpdateTokenEndpointAuthority,
-            this.authCodeRequest.correlationId
-        );
-        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${authority.tenant}/`;
-        const cloudInstanceAuthority =
-            await AuthorityFactory.createDiscoveredInstance(
-                cloudInstanceAuthorityUri,
-                networkModule,
-                this.browserStorage,
-                authority.options,
-                this.logger,
-                this.performanceClient,
-                this.authCodeRequest.correlationId
-            );
-        this.authModule.updateAuthority(cloudInstanceAuthority);
-    }
-
-    /**
-     * Looks up ccs creds in the cache
-     */
-    protected checkCcsCredentials(): CcsCredential | null {
-        // Look up ccs credential in temp cache
-        const cachedCcsCred = this.browserStorage.getTemporaryCache(
-            TemporaryCacheKeys.CCS_CREDENTIAL,
-            true
-        );
-        if (cachedCcsCred) {
-            try {
-                return JSON.parse(cachedCcsCred) as CcsCredential;
-            } catch (e) {
-                this.authModule.logger.error(
-                    "Cache credential could not be parsed"
-                );
-                this.authModule.logger.errorPii(
-                    `Cache credential could not be parsed: ${cachedCcsCred}`
-                );
-            }
+    protected createCcsCredentials(
+        request: AuthorizationUrlRequest
+    ): CcsCredential | null {
+        if (request.account) {
+            return {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            };
+        } else if (request.loginHint) {
+            return {
+                credential: request.loginHint,
+                type: CcsCredentialType.UPN,
+            };
         }
+
         return null;
     }
 }

package/src/interaction_handler/RedirectHandler.ts

@@ -6,14 +6,14 @@
 import {
     AuthorizationCodeClient,
     CommonAuthorizationCodeRequest,
-    ICrypto,
-    Authority,
-    INetworkModule,
     Logger,
     ServerError,
     IPerformanceClient,
     createClientAuthError,
     ClientAuthErrorCodes,
+    CcsCredential,
+    invokeAsync,
+    PerformanceEvents,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -21,37 +21,36 @@ import {
 } from "../error/BrowserAuthError";
 import { ApiId, TemporaryCacheKeys } from "../utils/BrowserConstants";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
-import { InteractionHandler, InteractionParams } from "./InteractionHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { NavigationOptions } from "../navigation/NavigationOptions";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 
-export type RedirectParams = InteractionParams & {
+export type RedirectParams = {
     navigationClient: INavigationClient;
     redirectTimeout: number;
     redirectStartPage: string;
     onRedirectNavigate?: (url: string) => void | boolean;
 };
 
-export class RedirectHandler extends InteractionHandler {
-    private browserCrypto: ICrypto;
+export class RedirectHandler {
+    authModule: AuthorizationCodeClient;
+    browserStorage: BrowserCacheManager;
+    authCodeRequest: CommonAuthorizationCodeRequest;
+    logger: Logger;
+    performanceClient: IPerformanceClient;
 
     constructor(
         authCodeModule: AuthorizationCodeClient,
         storageImpl: BrowserCacheManager,
         authCodeRequest: CommonAuthorizationCodeRequest,
         logger: Logger,
-        browserCrypto: ICrypto,
         performanceClient: IPerformanceClient
     ) {
-        super(
-            authCodeModule,
-            storageImpl,
-            authCodeRequest,
-            logger,
-            performanceClient
-        );
-        this.browserCrypto = browserCrypto;
+        this.authModule = authCodeModule;
+        this.browserStorage = storageImpl;
+        this.authCodeRequest = authCodeRequest;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
     }
 
     /**
@@ -144,9 +143,7 @@ export class RedirectHandler extends InteractionHandler {
      */
     async handleCodeResponseFromHash(
         locationHash: string,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule
+        state: string
     ): Promise<AuthenticationResult> {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
 
@@ -197,10 +194,15 @@ export class RedirectHandler extends InteractionHandler {
 
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
-            await this.updateTokenEndpointAuthority(
+            await invokeAsync(
+                this.authModule.updateAuthority.bind(this.authModule),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                this.authCodeRequest.correlationId
+            )(
                 authCodeResponse.cloud_instance_host_name,
-                authority,
-                networkModule
+                this.authCodeRequest.correlationId
             );
         }
 
@@ -226,4 +228,28 @@ export class RedirectHandler extends InteractionHandler {
         this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
+
+    /**
+     * Looks up ccs creds in the cache
+     */
+    protected checkCcsCredentials(): CcsCredential | null {
+        // Look up ccs credential in temp cache
+        const cachedCcsCred = this.browserStorage.getTemporaryCache(
+            TemporaryCacheKeys.CCS_CREDENTIAL,
+            true
+        );
+        if (cachedCcsCred) {
+            try {
+                return JSON.parse(cachedCcsCred) as CcsCredential;
+            } catch (e) {
+                this.authModule.logger.error(
+                    "Cache credential could not be parsed"
+                );
+                this.authModule.logger.errorPii(
+                    `Cache credential could not be parsed: ${cachedCcsCred}`
+                );
+            }
+        }
+        return null;
+    }
 }