@azure/msal-browser 3.26.1 → 3.28.0

package/src/cache/BrowserCacheManager.ts

@@ -52,7 +52,8 @@ import {
     InMemoryCacheKeys,
     StaticCacheKeys,
 } from "../utils/BrowserConstants.js";
-import { BrowserStorage } from "./BrowserStorage.js";
+import { LocalStorage } from "./LocalStorage.js";
+import { SessionStorage } from "./SessionStorage.js";
 import { MemoryStorage } from "./MemoryStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
 import { extractBrowserRequestState } from "../utils/BrowserProtocolUtils.js";
@@ -64,6 +65,7 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { base64Decode } from "../encode/Base64Decode.js";
 import { base64Encode } from "../encode/Base64Encode.js";
+import { CookieStorage } from "./CookieStorage.js";
 
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
@@ -79,14 +81,13 @@ export class BrowserCacheManager extends CacheManager {
     protected internalStorage: MemoryStorage<string>;
     // Temporary cache
     protected temporaryCacheStorage: IWindowStorage<string>;
+    // Cookie storage
+    protected cookieStorage: CookieStorage;
     // Logger instance
     protected logger: Logger;
     // Telemetry perf client
     protected performanceClient?: IPerformanceClient;
 
-    // Cookie life calculation (hours * minutes * seconds * ms)
-    protected readonly COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
-
     constructor(
         clientId: string,
         cacheConfig: Required<CacheOptions>,
@@ -102,10 +103,10 @@ export class BrowserCacheManager extends CacheManager {
         this.browserStorage = this.setupBrowserStorage(
             this.cacheConfig.cacheLocation
         );
-        this.temporaryCacheStorage = this.setupTemporaryCacheStorage(
-            this.cacheConfig.temporaryCacheLocation,
-            this.cacheConfig.cacheLocation
+        this.temporaryCacheStorage = this.setupBrowserStorage(
+            this.cacheConfig.temporaryCacheLocation
         );
+        this.cookieStorage = new CookieStorage();
 
         // Migrate cache entries from older versions of MSAL.
         if (cacheConfig.cacheMigrationEnabled) {
@@ -123,51 +124,23 @@ export class BrowserCacheManager extends CacheManager {
     protected setupBrowserStorage(
         cacheLocation: BrowserCacheLocation | string
     ): IWindowStorage<string> {
-        switch (cacheLocation) {
-            case BrowserCacheLocation.LocalStorage:
-            case BrowserCacheLocation.SessionStorage:
-                try {
-                    return new BrowserStorage(cacheLocation);
-                } catch (e) {
-                    this.logger.verbose(e as string);
+        try {
+            switch (cacheLocation) {
+                case BrowserCacheLocation.LocalStorage:
+                    return new LocalStorage();
+                case BrowserCacheLocation.SessionStorage:
+                    return new SessionStorage();
+                case BrowserCacheLocation.MemoryStorage:
+                default:
                     break;
-                }
-            case BrowserCacheLocation.MemoryStorage:
-            default:
-                break;
+            }
+        } catch (e) {
+            this.logger.error(e as string);
         }
         this.cacheConfig.cacheLocation = BrowserCacheLocation.MemoryStorage;
         return new MemoryStorage();
     }
 
-    /**
-     * Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured temporaryCacheLocation.
-     * @param temporaryCacheLocation
-     * @param cacheLocation
-     */
-    protected setupTemporaryCacheStorage(
-        temporaryCacheLocation: BrowserCacheLocation | string,
-        cacheLocation: BrowserCacheLocation | string
-    ): IWindowStorage<string> {
-        switch (cacheLocation) {
-            case BrowserCacheLocation.LocalStorage:
-            case BrowserCacheLocation.SessionStorage:
-                try {
-                    // Temporary cache items will always be stored in session storage to mitigate problems caused by multiple tabs
-                    return new BrowserStorage(
-                        temporaryCacheLocation ||
-                            BrowserCacheLocation.SessionStorage
-                    );
-                } catch (e) {
-                    this.logger.verbose(e as string);
-                    return this.internalStorage;
-                }
-            case BrowserCacheLocation.MemoryStorage:
-            default:
-                return this.internalStorage;
-        }
-    }
-
     /**
      * Migrate all old cache entries to new schema. No rollback supported.
      * @param storeAuthStateInCookie
@@ -1144,7 +1117,7 @@ export class BrowserCacheManager extends CacheManager {
     getTemporaryCache(cacheKey: string, generateKey?: boolean): string | null {
         const key = generateKey ? this.generateCacheKey(cacheKey) : cacheKey;
         if (this.cacheConfig.storeAuthStateInCookie) {
-            const itemCookie = this.getItemCookie(key);
+            const itemCookie = this.cookieStorage.getItem(key);
             if (itemCookie) {
                 this.logger.trace(
                     "BrowserCacheManager.getTemporaryCache: storeAuthStateInCookies set to true, retrieving from cookies"
@@ -1198,7 +1171,12 @@ export class BrowserCacheManager extends CacheManager {
             this.logger.trace(
                 "BrowserCacheManager.setTemporaryCache: storeAuthStateInCookie set to true, setting item cookie"
             );
-            this.setItemCookie(key, value);
+            this.cookieStorage.setItem(
+                key,
+                value,
+                undefined,
+                this.cacheConfig.secureCookies
+            );
         }
     }
 
@@ -1221,7 +1199,7 @@ export class BrowserCacheManager extends CacheManager {
             this.logger.trace(
                 "BrowserCacheManager.removeItem: storeAuthStateInCookie is true, clearing item cookie"
             );
-            this.clearItemCookie(key);
+            this.cookieStorage.removeItem(key);
         }
     }
 
@@ -1301,96 +1279,6 @@ export class BrowserCacheManager extends CacheManager {
         }
     }
 
-    /**
-     * Add value to cookies
-     * @param cookieName
-     * @param cookieValue
-     * @param expires
-     * @deprecated
-     */
-    setItemCookie(
-        cookieName: string,
-        cookieValue: string,
-        expires?: number
-    ): void {
-        let cookieStr = `${encodeURIComponent(cookieName)}=${encodeURIComponent(
-            cookieValue
-        )};path=/;SameSite=Lax;`;
-        if (expires) {
-            const expireTime = this.getCookieExpirationTime(expires);
-            cookieStr += `expires=${expireTime};`;
-        }
-
-        if (this.cacheConfig.secureCookies) {
-            cookieStr += "Secure;";
-        }
-
-        document.cookie = cookieStr;
-    }
-
-    /**
-     * Get one item by key from cookies
-     * @param cookieName
-     * @deprecated
-     */
-    getItemCookie(cookieName: string): string {
-        const name = `${encodeURIComponent(cookieName)}=`;
-        const cookieList = document.cookie.split(";");
-        for (let i: number = 0; i < cookieList.length; i++) {
-            let cookie = cookieList[i];
-            while (cookie.charAt(0) === " ") {
-                cookie = cookie.substring(1);
-            }
-            if (cookie.indexOf(name) === 0) {
-                return decodeURIComponent(
-                    cookie.substring(name.length, cookie.length)
-                );
-            }
-        }
-        return Constants.EMPTY_STRING;
-    }
-
-    /**
-     * Clear all msal-related cookies currently set in the browser. Should only be used to clear temporary cache items.
-     * @deprecated
-     */
-    clearMsalCookies(): void {
-        const cookiePrefix = `${Constants.CACHE_PREFIX}.${this.clientId}`;
-        const cookieList = document.cookie.split(";");
-        cookieList.forEach((cookie: string): void => {
-            while (cookie.charAt(0) === " ") {
-                // eslint-disable-next-line no-param-reassign
-                cookie = cookie.substring(1);
-            }
-            if (cookie.indexOf(cookiePrefix) === 0) {
-                const cookieKey = cookie.split("=")[0];
-                this.clearItemCookie(cookieKey);
-            }
-        });
-    }
-
-    /**
-     * Clear an item in the cookies by key
-     * @param cookieName
-     * @deprecated
-     */
-    clearItemCookie(cookieName: string): void {
-        this.setItemCookie(cookieName, Constants.EMPTY_STRING, -1);
-    }
-
-    /**
-     * Get cookie expiration time
-     * @param cookieLifeDays
-     * @deprecated
-     */
-    getCookieExpirationTime(cookieLifeDays: number): string {
-        const today = new Date();
-        const expr = new Date(
-            today.getTime() + cookieLifeDays * this.COOKIE_LIFE_MULTIPLIER
-        );
-        return expr.toUTCString();
-    }
-
     /**
      * Prepend msal.<client-id> to each key; Skip for any JSON object as Key (defined schemas do not need the key appended: AccessToken Keys or the upcoming schema)
      * @param key
@@ -1570,7 +1458,6 @@ export class BrowserCacheManager extends CacheManager {
             );
             this.resetRequestCache(cachedState || Constants.EMPTY_STRING);
         }
-        this.clearMsalCookies();
     }
 
     /**
@@ -1609,7 +1496,6 @@ export class BrowserCacheManager extends CacheManager {
                 this.resetRequestCache(stateValue);
             }
         });
-        this.clearMsalCookies();
         this.setInteractionInProgress(false);
     }
 

package/src/cache/BrowserStorage.ts

@@ -9,21 +9,21 @@ import {
 } from "../error/BrowserConfigurationAuthError.js";
 import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import { IWindowStorage } from "./IWindowStorage.js";
+import { LocalStorage } from "./LocalStorage.js";
+import { SessionStorage } from "./SessionStorage.js";
 
+/**
+ * @deprecated This class will be removed in a future major version
+ */
 export class BrowserStorage implements IWindowStorage<string> {
-    private windowStorage: Storage;
+    private windowStorage: IWindowStorage<string>;
 
     constructor(cacheLocation: string) {
-        this.validateWindowStorage(cacheLocation);
-        this.windowStorage = window[cacheLocation];
-    }
-
-    private validateWindowStorage(cacheLocation: string): void {
-        if (
-            (cacheLocation !== BrowserCacheLocation.LocalStorage &&
-                cacheLocation !== BrowserCacheLocation.SessionStorage) ||
-            !window[cacheLocation]
-        ) {
+        if (cacheLocation === BrowserCacheLocation.LocalStorage) {
+            this.windowStorage = new LocalStorage();
+        } else if (cacheLocation === BrowserCacheLocation.SessionStorage) {
+            this.windowStorage = new SessionStorage();
+        } else {
             throw createBrowserConfigurationAuthError(
                 BrowserConfigurationAuthErrorCodes.storageNotSupported
             );

package/src/cache/CookieStorage.ts

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { IWindowStorage } from "./IWindowStorage.js";
+
+// Cookie life calculation (hours * minutes * seconds * ms)
+const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
+
+export class CookieStorage implements IWindowStorage<string> {
+    getItem(key: string): string | null {
+        const name = `${encodeURIComponent(key)}`;
+        const cookieList = document.cookie.split(";");
+        for (let i = 0; i < cookieList.length; i++) {
+            const cookie = cookieList[i];
+            const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
+            const value = rest.join("=");
+
+            if (key === name) {
+                return value;
+            }
+        }
+        return "";
+    }
+
+    setItem(
+        key: string,
+        value: string,
+        cookieLifeDays?: number,
+        secure: boolean = true
+    ): void {
+        let cookieStr = `${encodeURIComponent(key)}=${encodeURIComponent(
+            value
+        )};path=/;SameSite=Lax;`;
+
+        if (cookieLifeDays) {
+            const expireTime = getCookieExpirationTime(cookieLifeDays);
+            cookieStr += `expires=${expireTime};`;
+        }
+
+        if (secure) {
+            cookieStr += "Secure;";
+        }
+
+        document.cookie = cookieStr;
+    }
+
+    removeItem(key: string): void {
+        // Setting expiration to -1 removes it
+        this.setItem(key, "", -1);
+    }
+
+    getKeys(): string[] {
+        const cookieList = document.cookie.split(";");
+        const keys: Array<string> = [];
+        cookieList.forEach((cookie) => {
+            const cookieParts = decodeURIComponent(cookie).trim().split("=");
+            keys.push(cookieParts[0]);
+        });
+
+        return keys;
+    }
+
+    containsKey(key: string): boolean {
+        return this.getKeys().includes(key);
+    }
+}
+
+/**
+ * Get cookie expiration time
+ * @param cookieLifeDays
+ */
+export function getCookieExpirationTime(cookieLifeDays: number): string {
+    const today = new Date();
+    const expr = new Date(
+        today.getTime() + cookieLifeDays * COOKIE_LIFE_MULTIPLIER
+    );
+    return expr.toUTCString();
+}

package/src/cache/LocalStorage.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    BrowserConfigurationAuthErrorCodes,
+    createBrowserConfigurationAuthError,
+} from "../error/BrowserConfigurationAuthError.js";
+import { IWindowStorage } from "./IWindowStorage.js";
+
+export class LocalStorage implements IWindowStorage<string> {
+    constructor() {
+        if (!window.localStorage) {
+            throw createBrowserConfigurationAuthError(
+                BrowserConfigurationAuthErrorCodes.storageNotSupported
+            );
+        }
+    }
+
+    getItem(key: string): string | null {
+        return window.localStorage.getItem(key);
+    }
+
+    setItem(key: string, value: string): void {
+        window.localStorage.setItem(key, value);
+    }
+
+    removeItem(key: string): void {
+        window.localStorage.removeItem(key);
+    }
+
+    getKeys(): string[] {
+        return Object.keys(window.localStorage);
+    }
+
+    containsKey(key: string): boolean {
+        return window.localStorage.hasOwnProperty(key);
+    }
+}

package/src/cache/SessionStorage.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    BrowserConfigurationAuthErrorCodes,
+    createBrowserConfigurationAuthError,
+} from "../error/BrowserConfigurationAuthError.js";
+import { IWindowStorage } from "./IWindowStorage.js";
+
+export class SessionStorage implements IWindowStorage<string> {
+    constructor() {
+        if (!window.sessionStorage) {
+            throw createBrowserConfigurationAuthError(
+                BrowserConfigurationAuthErrorCodes.storageNotSupported
+            );
+        }
+    }
+
+    getItem(key: string): string | null {
+        return window.sessionStorage.getItem(key);
+    }
+
+    setItem(key: string, value: string): void {
+        window.sessionStorage.setItem(key, value);
+    }
+
+    removeItem(key: string): void {
+        window.sessionStorage.removeItem(key);
+    }
+
+    getKeys(): string[] {
+        return Object.keys(window.sessionStorage);
+    }
+
+    containsKey(key: string): boolean {
+        return window.sessionStorage.hasOwnProperty(key);
+    }
+}

package/src/config/Configuration.ts

@@ -30,6 +30,7 @@ import {
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { NavigationClient } from "../navigation/NavigationClient.js";
 import { FetchClient } from "../network/FetchClient.js";
+import * as BrowserUtils from "../utils/BrowserUtils.js";
 
 // Default timeout for popup windows and iframes in milliseconds
 export const DEFAULT_POPUP_TIMEOUT_MS = 60000;
@@ -273,7 +274,8 @@ export function buildConfiguration(
         knownAuthorities: [],
         cloudDiscoveryMetadata: Constants.EMPTY_STRING,
         authorityMetadata: Constants.EMPTY_STRING,
-        redirectUri: Constants.EMPTY_STRING,
+        redirectUri:
+            typeof window !== "undefined" ? BrowserUtils.getCurrentUri() : "",
         postLogoutRedirectUri: Constants.EMPTY_STRING,
         navigateToLoginRequestUrl: true,
         clientCapabilities: [],

package/src/controllers/StandardController.ts

@@ -781,7 +781,6 @@ export class StandardController implements IController {
                     atPopupMeasurement.end({
                         success: true,
                         isNativeBroker: true,
-                        requestId: response.requestId,
                         accountType: getAccountType(response.account),
                     });
                     return response;
@@ -834,7 +833,6 @@ export class StandardController implements IController {
 
                 atPopupMeasurement.end({
                     success: true,
-                    requestId: result.requestId,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
                     accountType: getAccountType(result.account),
@@ -971,7 +969,6 @@ export class StandardController implements IController {
                 this.ssoSilentMeasurement?.end({
                     success: true,
                     isNativeBroker: response.fromNativeBroker,
-                    requestId: response.requestId,
                     accessTokenSize: response.accessToken.length,
                     idTokenSize: response.idToken.length,
                     accountType: getAccountType(response.account),
@@ -1056,7 +1053,6 @@ export class StandardController implements IController {
                             atbcMeasurement.end({
                                 success: true,
                                 isNativeBroker: result.fromNativeBroker,
-                                requestId: result.requestId,
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
                                 accountType: getAccountType(result.account),
@@ -1173,7 +1169,6 @@ export class StandardController implements IController {
                     success: true,
                     fromCache: response.fromCache,
                     isNativeBroker: response.fromNativeBroker,
-                    requestId: response.requestId,
                 });
                 return response;
             })
@@ -2035,7 +2030,6 @@ export class StandardController implements IController {
                         fromCache: result.fromCache,
                         isNativeBroker: result.fromNativeBroker,
                         cacheLookupPolicy: request.cacheLookupPolicy,
-                        requestId: result.requestId,
                         accessTokenSize: result.accessToken.length,
                         idTokenSize: result.idToken.length,
                     });
@@ -2223,7 +2217,6 @@ export class StandardController implements IController {
                         {
                             fromCache: response.fromCache,
                             isNativeBroker: response.fromNativeBroker,
-                            requestId: response.requestId,
                         },
                         request.correlationId
                     );

package/src/crypto/BrowserCrypto.ts

@@ -9,7 +9,6 @@ import {
 } from "../error/BrowserAuthError.js";
 import {
     IPerformanceClient,
-    Logger,
     PerformanceEvents,
 } from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
@@ -36,6 +35,8 @@ const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
 
+const SUBTLE_SUBERROR = "crypto_subtle_undefined";
+
 const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
     name: PKCS1_V15_KEYGEN_ALG,
     hash: S256_HASH_ALG,
@@ -46,13 +47,21 @@ const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
 /**
  * Check whether browser crypto is available.
  */
-export function validateCryptoAvailable(logger: Logger): void {
-    if ("crypto" in window) {
-        logger.verbose("BrowserCrypto: modern crypto interface available");
-    } else {
-        logger.error("BrowserCrypto: crypto interface is unavailable");
+export function validateCryptoAvailable(): void {
+    if (!window) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.nonBrowserEnvironment
+        );
+    }
+    if (!window.crypto) {
         throw createBrowserAuthError(BrowserAuthErrorCodes.cryptoNonExistent);
     }
+    if (!window.crypto.subtle) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.cryptoNonExistent,
+            SUBTLE_SUBERROR
+        );
+    }
 }
 
 /**

package/src/crypto/CryptoOps.ts

@@ -53,7 +53,7 @@ export class CryptoOps implements ICrypto {
     constructor(logger: Logger, performanceClient?: IPerformanceClient) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
-        BrowserCrypto.validateCryptoAvailable(logger);
+        BrowserCrypto.validateCryptoAvailable();
         this.cache = new AsyncMemoryStorage<CachedKeyPair>(this.logger);
         this.performanceClient = performanceClient;
     }

package/src/error/BrowserAuthError.ts

@@ -92,6 +92,10 @@ export const BrowserAuthErrorMessages = {
         "Invalid base64 encoded string.",
     [BrowserAuthErrorCodes.invalidPopTokenRequest]:
         "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
+    [BrowserAuthErrorCodes.failedToBuildHeaders]:
+        "Failed to build request headers object.",
+    [BrowserAuthErrorCodes.failedToParseHeaders]:
+        "Failed to parse response headers",
 };
 
 /**
@@ -347,14 +351,17 @@ export const BrowserAuthErrorMessage = {
  * Browser library error class thrown by the MSAL.js library for SPAs
  */
 export class BrowserAuthError extends AuthError {
-    constructor(errorCode: string) {
-        super(errorCode, BrowserAuthErrorMessages[errorCode]);
+    constructor(errorCode: string, subError?: string) {
+        super(errorCode, BrowserAuthErrorMessages[errorCode], subError);
 
         Object.setPrototypeOf(this, BrowserAuthError.prototype);
         this.name = "BrowserAuthError";
     }
 }
 
-export function createBrowserAuthError(errorCode: string): BrowserAuthError {
-    return new BrowserAuthError(errorCode);
+export function createBrowserAuthError(
+    errorCode: string,
+    subError?: string
+): BrowserAuthError {
+    return new BrowserAuthError(errorCode, subError);
 }

package/src/error/BrowserAuthErrorCodes.ts

@@ -56,3 +56,5 @@ export const uninitializedPublicClientApplication =
 export const nativePromptNotSupported = "native_prompt_not_supported";
 export const invalidBase64String = "invalid_base64_string";
 export const invalidPopTokenRequest = "invalid_pop_token_request";
+export const failedToBuildHeaders = "failed_to_build_headers";
+export const failedToParseHeaders = "failed_to_parse_headers";

package/src/index.ts

@@ -75,6 +75,9 @@ export { ITokenCache } from "./cache/ITokenCache.js";
 // Storage
 export { MemoryStorage } from "./cache/MemoryStorage.js";
 export { BrowserStorage } from "./cache/BrowserStorage.js";
+export { LocalStorage } from "./cache/LocalStorage.js";
+export { SessionStorage } from "./cache/SessionStorage.js";
+export { IWindowStorage } from "./cache/IWindowStorage.js";
 
 // Events
 export {

package/src/interaction_client/BaseInteractionClient.ts

@@ -140,10 +140,7 @@ export abstract class BaseInteractionClient {
      */
     getRedirectUri(requestRedirectUri?: string): string {
         this.logger.verbose("getRedirectUri called");
-        const redirectUri =
-            requestRedirectUri ||
-            this.config.auth.redirectUri ||
-            BrowserUtils.getCurrentUri();
+        const redirectUri = requestRedirectUri || this.config.auth.redirectUri;
         return UrlString.getAbsoluteUrl(
             redirectUri,
             BrowserUtils.getCurrentUri()