@azure/msal-browser 3.20.0 → 3.21.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.20.0",
+  "version": "3.21.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -104,6 +104,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.14.0"
+    "@azure/msal-common": "14.14.1"
   }
 }

package/src/cache/BrowserCacheManager.ts

@@ -1552,6 +1552,9 @@ export class BrowserCacheManager extends CacheManager {
         this.removeTemporaryItem(
             this.generateCacheKey(TemporaryCacheKeys.NATIVE_REQUEST)
         );
+        this.removeTemporaryItem(
+            this.generateCacheKey(TemporaryCacheKeys.REDIRECT_REQUEST)
+        );
         this.setInteractionInProgress(false);
     }
 
@@ -1613,6 +1616,98 @@ export class BrowserCacheManager extends CacheManager {
         this.setInteractionInProgress(false);
     }
 
+    /**
+     * Create request retry key to cache retry status
+     */
+    generateRequestRetriedKey(): string {
+        return `${Constants.CACHE_PREFIX}.${TemporaryCacheKeys.REQUEST_RETRY}.${this.clientId}`;
+    }
+
+    /**
+     * Gets the request retry value from the cache
+     */
+    getRequestRetried(): number | null {
+        const requestRetriedKey = this.generateRequestRetriedKey();
+        const cachedRetryNumber = this.getTemporaryCache(requestRetriedKey);
+        if (!cachedRetryNumber) {
+            return null;
+        }
+        return parseInt(cachedRetryNumber);
+    }
+
+    /**
+     * Sets the request retry value to "retried" in the cache
+     */
+    setRequestRetried(): void {
+        this.logger.trace("BrowserCacheManager.setRequestRetried called");
+        const requestRetriedKey = this.generateRequestRetriedKey();
+        this.setTemporaryCache(requestRetriedKey, "1", false);
+    }
+
+    /**
+     * Removes all request retry values in the cache
+     */
+    removeRequestRetried(): void {
+        const requestRetriedKey = this.generateRequestRetriedKey();
+        this.removeTemporaryItem(requestRetriedKey);
+    }
+
+    /**
+     * Caches the redirectRequest in the cache
+     * @param redirectRequest
+     */
+    cacheRedirectRequest(redirectRequest: RedirectRequest): void {
+        this.logger.trace("BrowserCacheManager.cacheRedirectRequest called");
+        const { ...restParams } = redirectRequest;
+        delete restParams.onRedirectNavigate;
+        const encodedValue = JSON.stringify(restParams);
+
+        this.setTemporaryCache(
+            TemporaryCacheKeys.REDIRECT_REQUEST,
+            encodedValue,
+            true
+        );
+    }
+
+    /**
+     * Gets redirect request from the cache. Logs an error and returns undefined if nothing is found.
+     */
+    getCachedRedirectRequest(): RedirectRequest | undefined {
+        this.logger.trace(
+            "BrowserCacheManager.getCachedRedirectRequest called"
+        );
+        const cachedRedirectRequest = this.getTemporaryCache(
+            TemporaryCacheKeys.REDIRECT_REQUEST,
+            true
+        );
+        if (!cachedRedirectRequest) {
+            this.logger.error(`No cached redirect request found.`);
+        } else {
+            this.removeTemporaryItem(
+                this.generateCacheKey(TemporaryCacheKeys.REDIRECT_REQUEST)
+            );
+            let parsedRequest: RedirectRequest;
+            try {
+                parsedRequest = JSON.parse(
+                    cachedRedirectRequest
+                ) as RedirectRequest;
+            } catch (e) {
+                this.logger.errorPii(
+                    `Attempted to parse: ${cachedRedirectRequest}`
+                );
+                this.logger.error(
+                    `Parsing cached redirect request threw with error: ${e}`
+                );
+                return;
+            }
+
+            if (parsedRequest) {
+                return parsedRequest;
+            }
+        }
+        return;
+    }
+
     cacheCodeRequest(authCodeRequest: CommonAuthorizationCodeRequest): void {
         this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
 

package/src/config/Configuration.ts

@@ -99,11 +99,19 @@ export type BrowserAuthOptions = {
      * @deprecated This flag is deprecated and will be removed in the next major version. createNestablePublicClientApplication should be used instead.
      */
     supportsNestedAppAuth?: boolean;
+    /**
+     * Callback that will be passed the url that MSAL will navigate to in redirect flows. Returning false in the callback will stop navigation.
+     */
+    onRedirectNavigate?: (url: string) => boolean | void;
 };
 
 /** @internal */
-export type InternalAuthOptions = Required<BrowserAuthOptions> & {
+export type InternalAuthOptions = Omit<
+    Required<BrowserAuthOptions>,
+    "onRedirectNavigate"
+> & {
     OIDCOptions: Required<OIDCOptions>;
+    onRedirectNavigate?: (url: string) => boolean | void;
 };
 
 /**

package/src/controllers/StandardController.ts

@@ -584,19 +584,37 @@ export class StandardController implements IController {
             scenarioId: request.scenarioId,
         });
 
+        // Override on request only if set, as onRedirectNavigate field is deprecated
         const onRedirectNavigateCb = request.onRedirectNavigate;
-        request.onRedirectNavigate = (url: string) => {
-            const navigate =
-                typeof onRedirectNavigateCb === "function"
-                    ? onRedirectNavigateCb(url)
-                    : undefined;
-            if (navigate !== false) {
-                atrMeasurement.end({ success: true });
-            } else {
-                atrMeasurement.discard();
-            }
-            return navigate;
-        };
+        if (onRedirectNavigateCb) {
+            request.onRedirectNavigate = (url: string) => {
+                const navigate =
+                    typeof onRedirectNavigateCb === "function"
+                        ? onRedirectNavigateCb(url)
+                        : undefined;
+                if (navigate !== false) {
+                    atrMeasurement.end({ success: true });
+                } else {
+                    atrMeasurement.discard();
+                }
+                return navigate;
+            };
+        } else {
+            const configOnRedirectNavigateCb =
+                this.config.auth.onRedirectNavigate;
+            this.config.auth.onRedirectNavigate = (url: string) => {
+                const navigate =
+                    typeof configOnRedirectNavigateCb === "function"
+                        ? configOnRedirectNavigateCb(url)
+                        : undefined;
+                if (navigate !== false) {
+                    atrMeasurement.end({ success: true });
+                } else {
+                    atrMeasurement.discard();
+                }
+                return navigate;
+            };
+        }
 
         // If logged in, emit acquire token events
         const isLoggedIn = this.getAllAccounts().length > 0;

package/src/error/BrowserAuthError.ts

@@ -92,6 +92,8 @@ export const BrowserAuthErrorMessages = {
         "Invalid base64 encoded string.",
     [BrowserAuthErrorCodes.invalidPopTokenRequest]:
         "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
+    [BrowserAuthErrorCodes.failedToRetry]:
+        "Unable to retry failed auth code redemption due to usage of the onRedirectNavigate request parameter. Please set onRedirectNavigate on the PublicClientApplication configuration instead or call loginRedirect again.",
 };
 
 /**

package/src/error/BrowserAuthErrorCodes.ts

@@ -56,3 +56,4 @@ export const uninitializedPublicClientApplication =
 export const nativePromptNotSupported = "native_prompt_not_supported";
 export const invalidBase64String = "invalid_base64_string";
 export const invalidPopTokenRequest = "invalid_pop_token_request";
+export const failedToRetry = "failed_to_retry";

package/src/interaction_client/PopupClient.ts

@@ -20,6 +20,7 @@ import {
     ServerResponseType,
     invokeAsync,
     invoke,
+    ServerError,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { EventType } from "../event/EventType";
@@ -47,6 +48,7 @@ import { PopupWindowAttributes } from "../request/PopupWindowAttributes";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import * as ResponseHandler from "../response/ResponseHandler";
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -182,7 +184,7 @@ export class PopupClient extends StandardInteractionClient {
     }
 
     /**
-     * Helper which obtains an access_token for your API via opening a popup window in the user's browser
+     * Helper which initializes authorization clients and requests
      * @param validRequest
      * @param popupName
      * @param popup
@@ -211,19 +213,20 @@ export class PopupClient extends StandardInteractionClient {
 
         BrowserUtils.preconnect(validRequest.authority);
 
+        let authClient: AuthorizationCodeClient | undefined;
+
         try {
             // Create auth code request and generate PKCE params
-            const authCodeRequest: CommonAuthorizationCodeRequest =
-                await invokeAsync(
-                    this.initializeAuthorizationCodeRequest.bind(this),
-                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                    this.logger,
-                    this.performanceClient,
-                    this.correlationId
-                )(validRequest);
+            const authCodeRequest = await invokeAsync(
+                this.initializeAuthorizationCodeRequest.bind(this),
+                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(validRequest);
 
             // Initialize the client
-            const authClient: AuthorizationCodeClient = await invokeAsync(
+            authClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
                 PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
                 this.logger,
@@ -236,136 +239,218 @@ export class PopupClient extends StandardInteractionClient {
                 validRequest.account
             );
 
-            const isNativeBroker = NativeMessageHandler.isNativeAvailable(
-                this.config,
+            return await invokeAsync(
+                this.acquireTokenPopupAsyncHelper.bind(this),
+                PerformanceEvents.PopupClientTokenHelper,
                 this.logger,
-                this.nativeMessageHandler,
-                request.authenticationScheme
-            );
-            // Start measurement for server calls with native brokering enabled
-            let fetchNativeAccountIdMeasurement;
-            if (isNativeBroker) {
-                fetchNativeAccountIdMeasurement =
-                    this.performanceClient.startMeasurement(
-                        PerformanceEvents.FetchAccountIdWithNativeBroker,
-                        request.correlationId
-                    );
-            }
-
-            // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
-                ...validRequest,
-                nativeBroker: isNativeBroker,
-            });
-
-            // Create popup interaction handler.
-            const interactionHandler = new InteractionHandler(
+                this.performanceClient,
+                this.correlationId
+            )(
                 authClient,
-                this.browserStorage,
                 authCodeRequest,
-                this.logger,
-                this.performanceClient
-            );
-
-            // Show the UI once the url has been created. Get the window handle for the popup.
-            const popupParameters: PopupParams = {
-                popup,
+                validRequest,
+                request,
                 popupName,
                 popupWindowAttributes,
-            };
-            const popupWindow: Window = this.initiateAuthRequest(
-                navigateUrl,
-                popupParameters
+                popup
             );
-            this.eventHandler.emitEvent(
-                EventType.POPUP_OPENED,
-                InteractionType.Popup,
-                { popupWindow },
-                null
+        } catch (e) {
+            if (popup) {
+                // Close the synchronous popup if an error is thrown before the window unload event is registered
+                popup.close();
+            }
+
+            if (e instanceof AuthError) {
+                (e as AuthError).setCorrelationId(this.correlationId);
+                serverTelemetryManager.cacheFailedRequest(e);
+            }
+
+            if (
+                !authClient ||
+                !(e instanceof ServerError) ||
+                e.errorCode !== BrowserConstants.INVALID_GRANT_ERROR
+            ) {
+                throw e;
+            }
+
+            this.performanceClient.addFields(
+                {
+                    retryError: e.errorCode,
+                },
+                this.correlationId
             );
 
-            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await this.monitorPopupForHash(popupWindow);
+            const retryAuthCodeRequest = await invokeAsync(
+                this.initializeAuthorizationCodeRequest.bind(this),
+                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(validRequest);
 
-            const serverParams = invoke(
-                ResponseHandler.deserializeResponse,
-                PerformanceEvents.DeserializeResponse,
+            return await invokeAsync(
+                this.acquireTokenPopupAsyncHelper.bind(this),
+                PerformanceEvents.PopupClientTokenHelper,
                 this.logger,
                 this.performanceClient,
                 this.correlationId
             )(
-                responseString,
-                this.config.auth.OIDCOptions.serverResponseType,
-                this.logger
-            );
-            // Remove throttle if it exists
-            ThrottlingUtils.removeThrottle(
-                this.browserStorage,
-                this.config.auth.clientId,
-                authCodeRequest
+                authClient,
+                retryAuthCodeRequest,
+                validRequest,
+                request,
+                popupName,
+                popupWindowAttributes,
+                popup
             );
+        }
+    }
 
-            if (serverParams.accountId) {
-                this.logger.verbose(
-                    "Account id found in hash, calling WAM for token"
-                );
-                // end measurement for server call with native brokering enabled
-                if (fetchNativeAccountIdMeasurement) {
-                    fetchNativeAccountIdMeasurement.end({
-                        success: true,
-                        isNativeBroker: true,
-                    });
-                }
+    /**
+     * Helper which obtains an access_token for your API via opening a popup window in the user's browser
+     * @param authClient
+     * @param authCodeRequest
+     * @param validRequest
+     * @param request
+     * @param popupName
+     * @param popupWindowAttributes
+     * @param popup
+     * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+     */
+    protected async acquireTokenPopupAsyncHelper(
+        authClient: AuthorizationCodeClient,
+        authCodeRequest: CommonAuthorizationCodeRequest,
+        validRequest: AuthorizationUrlRequest,
+        request: PopupRequest,
+        popupName: string,
+        popupWindowAttributes: PopupWindowAttributes,
+        popup?: Window | null
+    ): Promise<AuthenticationResult> {
+        const correlationId = validRequest.correlationId;
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.PopupClientTokenHelper,
+            correlationId
+        );
 
-                if (!this.nativeMessageHandler) {
-                    throw createBrowserAuthError(
-                        BrowserAuthErrorCodes.nativeConnectionNotEstablished
-                    );
-                }
-                const nativeInteractionClient = new NativeInteractionClient(
-                    this.config,
-                    this.browserStorage,
-                    this.browserCrypto,
-                    this.logger,
-                    this.eventHandler,
-                    this.navigationClient,
-                    ApiId.acquireTokenPopup,
-                    this.performanceClient,
-                    this.nativeMessageHandler,
-                    serverParams.accountId,
-                    this.nativeStorage,
-                    validRequest.correlationId
-                );
-                const { userRequestState } = ProtocolUtils.parseRequestState(
-                    this.browserCrypto,
-                    validRequest.state
+        const isNativeBroker = NativeMessageHandler.isNativeAvailable(
+            this.config,
+            this.logger,
+            this.nativeMessageHandler,
+            request.authenticationScheme
+        );
+
+        // Start measurement for server calls with native brokering enabled
+        let fetchNativeAccountIdMeasurement;
+        if (isNativeBroker) {
+            fetchNativeAccountIdMeasurement =
+                this.performanceClient.startMeasurement(
+                    PerformanceEvents.FetchAccountIdWithNativeBroker,
+                    request.correlationId
                 );
-                return await nativeInteractionClient.acquireToken({
-                    ...validRequest,
-                    state: userRequestState,
-                    prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
-                });
-            }
+        }
 
-            // Handle response from hash string.
-            const result = await interactionHandler.handleCodeResponse(
-                serverParams,
-                validRequest
-            );
+        // Create acquire token url.
+        const navigateUrl = await authClient.getAuthCodeUrl({
+            ...validRequest,
+            nativeBroker: isNativeBroker,
+        });
 
-            return result;
-        } catch (e) {
-            if (popup) {
-                // Close the synchronous popup if an error is thrown before the window unload event is registered
-                popup.close();
+        // Create popup interaction handler.
+        const interactionHandler = new InteractionHandler(
+            authClient,
+            this.browserStorage,
+            authCodeRequest,
+            this.logger,
+            this.performanceClient
+        );
+
+        // Show the UI once the url has been created. Get the window handle for the popup.
+        const popupParameters: PopupParams = {
+            popup,
+            popupName,
+            popupWindowAttributes,
+        };
+        const popupWindow: Window = this.initiateAuthRequest(
+            navigateUrl,
+            popupParameters
+        );
+        this.eventHandler.emitEvent(
+            EventType.POPUP_OPENED,
+            InteractionType.Popup,
+            { popupWindow },
+            null
+        );
+
+        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await this.monitorPopupForHash(popupWindow);
+
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            responseString,
+            this.config.auth.OIDCOptions.serverResponseType,
+            this.logger
+        );
+        // Remove throttle if it exists
+        ThrottlingUtils.removeThrottle(
+            this.browserStorage,
+            this.config.auth.clientId,
+            authCodeRequest
+        );
+
+        if (serverParams.accountId) {
+            this.logger.verbose(
+                "Account id found in hash, calling WAM for token"
+            );
+            // end measurement for server call with native brokering enabled
+            if (fetchNativeAccountIdMeasurement) {
+                fetchNativeAccountIdMeasurement.end({
+                    success: true,
+                    isNativeBroker: true,
+                });
             }
 
-            if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
-                serverTelemetryManager.cacheFailedRequest(e);
+            if (!this.nativeMessageHandler) {
+                throw createBrowserAuthError(
+                    BrowserAuthErrorCodes.nativeConnectionNotEstablished
+                );
             }
-            throw e;
+            const nativeInteractionClient = new NativeInteractionClient(
+                this.config,
+                this.browserStorage,
+                this.browserCrypto,
+                this.logger,
+                this.eventHandler,
+                this.navigationClient,
+                ApiId.acquireTokenPopup,
+                this.performanceClient,
+                this.nativeMessageHandler,
+                serverParams.accountId,
+                this.nativeStorage,
+                validRequest.correlationId
+            );
+            const { userRequestState } = ProtocolUtils.parseRequestState(
+                this.browserCrypto,
+                validRequest.state
+            );
+            return nativeInteractionClient.acquireToken({
+                ...validRequest,
+                state: userRequestState,
+                prompt: undefined, // Server should handle the prompt, ideally native broker can do this part silently
+            });
         }
+
+        // Handle response from hash string.
+        const result = await interactionHandler.handleCodeResponse(
+            serverParams,
+            validRequest
+        );
+
+        return result;
     }
 
     /**