@azure/msal-browser 3.28.0 → 4.0.0-alpha.0

package/src/cache/CacheHelpers.ts

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { TokenKeys } from "@azure/msal-common/browser";
+import { StaticCacheKeys } from "../utils/BrowserConstants.js";
+import { IWindowStorage } from "./IWindowStorage.js";
+
+/**
+ * Returns a list of cache keys for all known accounts
+ * @param storage
+ * @returns
+ */
+export function getAccountKeys(storage: IWindowStorage<string>): Array<string> {
+    const accountKeys = storage.getItem(StaticCacheKeys.ACCOUNT_KEYS);
+    if (accountKeys) {
+        return JSON.parse(accountKeys);
+    }
+
+    return [];
+}
+
+/**
+ * Returns a list of cache keys for all known tokens
+ * @param clientId
+ * @param storage
+ * @returns
+ */
+export function getTokenKeys(
+    clientId: string,
+    storage: IWindowStorage<string>
+): TokenKeys {
+    const item = storage.getItem(`${StaticCacheKeys.TOKEN_KEYS}.${clientId}`);
+    if (item) {
+        const tokenKeys = JSON.parse(item);
+        if (
+            tokenKeys &&
+            tokenKeys.hasOwnProperty("idToken") &&
+            tokenKeys.hasOwnProperty("accessToken") &&
+            tokenKeys.hasOwnProperty("refreshToken")
+        ) {
+            return tokenKeys as TokenKeys;
+        }
+    }
+
+    return {
+        idToken: [],
+        accessToken: [],
+        refreshToken: [],
+    };
+}

package/src/cache/CookieStorage.ts

@@ -3,12 +3,20 @@
  * Licensed under the MIT License.
  */
 
+import {
+    ClientAuthErrorCodes,
+    createClientAuthError,
+} from "@azure/msal-common/browser";
 import { IWindowStorage } from "./IWindowStorage.js";
 
 // Cookie life calculation (hours * minutes * seconds * ms)
 const COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
 
 export class CookieStorage implements IWindowStorage<string> {
+    initialize(): Promise<void> {
+        return Promise.resolve();
+    }
+
     getItem(key: string): string | null {
         const name = `${encodeURIComponent(key)}`;
         const cookieList = document.cookie.split(";");
@@ -24,6 +32,10 @@ export class CookieStorage implements IWindowStorage<string> {
         return "";
     }
 
+    getUserData(): string | null {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    }
+
     setItem(
         key: string,
         value: string,
@@ -46,6 +58,12 @@ export class CookieStorage implements IWindowStorage<string> {
         document.cookie = cookieStr;
     }
 
+    async setUserData(): Promise<void> {
+        return Promise.reject(
+            createClientAuthError(ClientAuthErrorCodes.methodNotImplemented)
+        );
+    }
+
     removeItem(key: string): void {
         // Setting expiration to -1 removes it
         this.setItem(key, "", -1);

package/src/cache/ITokenCache.ts

@@ -17,5 +17,5 @@ export interface ITokenCache {
         request: SilentRequest,
         response: ExternalTokenResponse,
         options: LoadTokenOptions
-    ): AuthenticationResult;
+    ): Promise<AuthenticationResult>;
 }

package/src/cache/IWindowStorage.ts

@@ -4,12 +4,21 @@
  */
 
 export interface IWindowStorage<T> {
+    /**
+     * Async initializer
+     */
+    initialize(): Promise<void>;
     /**
      * Get the item from the window storage object matching the given key.
      * @param key
      */
     getItem(key: string): T | null;
 
+    /**
+     * Getter for sensitive data that may contain PII.
+     */
+    getUserData(key: string): T | null;
+
     /**
      * Sets the item in the window storage object with the given key.
      * @param key
@@ -17,6 +26,11 @@ export interface IWindowStorage<T> {
      */
     setItem(key: string, value: T): void;
 
+    /**
+     * Setter for sensitive data that may contain PII.
+     */
+    setUserData(key: string, value: T): Promise<void>;
+
     /**
      * Removes the item in the window storage object matching the given key.
      * @param key

package/src/cache/LocalStorage.ts

@@ -3,30 +3,139 @@
  * Licensed under the MIT License.
  */
 
+import { Constants, TokenKeys } from "@azure/msal-common/browser";
+import {
+    createNewGuid,
+    decrypt,
+    encrypt,
+    generateBaseKey,
+    generateHKDF,
+} from "../crypto/BrowserCrypto.js";
+import { base64DecToArr } from "../encode/Base64Decode.js";
+import { urlEncodeArr } from "../encode/Base64Encode.js";
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError.js";
 import {
     BrowserConfigurationAuthErrorCodes,
     createBrowserConfigurationAuthError,
 } from "../error/BrowserConfigurationAuthError.js";
+import { CookieStorage } from "./CookieStorage.js";
 import { IWindowStorage } from "./IWindowStorage.js";
+import { MemoryStorage } from "./MemoryStorage.js";
+import { getAccountKeys, getTokenKeys } from "./CacheHelpers.js";
+
+const ENCRYPTION_KEY = "msal.cache.encryption";
+
+type EncryptionCookie = {
+    id: string;
+    key: CryptoKey;
+};
+
+type EncryptedData = {
+    id: string;
+    nonce: string;
+    data: string;
+};
 
 export class LocalStorage implements IWindowStorage<string> {
-    constructor() {
+    private clientId: string;
+    private initialized: boolean;
+    private memoryStorage: MemoryStorage<string>;
+    private encryptionCookie?: EncryptionCookie;
+
+    constructor(clientId: string) {
         if (!window.localStorage) {
             throw createBrowserConfigurationAuthError(
                 BrowserConfigurationAuthErrorCodes.storageNotSupported
             );
         }
+        this.memoryStorage = new MemoryStorage<string>();
+        this.initialized = false;
+        this.clientId = clientId;
+    }
+
+    async initialize(): Promise<void> {
+        this.initialized = true;
+
+        const cookies = new CookieStorage();
+        const cookieString = cookies.getItem(ENCRYPTION_KEY);
+        let parsedCookie = { key: "", id: "" };
+        if (cookieString) {
+            try {
+                parsedCookie = JSON.parse(cookieString);
+            } catch (e) {
+                // TODO: Log telemetry but don't throw
+            }
+        }
+        if (parsedCookie.key && parsedCookie.id) {
+            // Encryption key already exists, import
+            this.encryptionCookie = {
+                id: parsedCookie.id,
+                key: await generateHKDF(base64DecToArr(parsedCookie.key)),
+            };
+            await this.importExistingCache();
+        } else {
+            // Encryption key doesn't exist or is invalid, generate a new one and clear existing cache
+            this.clear();
+            const id = createNewGuid();
+            const baseKey = await generateBaseKey();
+            const keyStr = urlEncodeArr(new Uint8Array(baseKey));
+            this.encryptionCookie = {
+                id: id,
+                key: await generateHKDF(baseKey),
+            };
+
+            const cookieData = {
+                id: id,
+                key: keyStr,
+            };
+            cookies.setItem(ENCRYPTION_KEY, JSON.stringify(cookieData));
+        }
     }
 
     getItem(key: string): string | null {
         return window.localStorage.getItem(key);
     }
 
+    getUserData(key: string): string | null {
+        if (!this.initialized) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.uninitializedPublicClientApplication
+            );
+        }
+        return this.memoryStorage.getItem(key);
+    }
+
     setItem(key: string, value: string): void {
         window.localStorage.setItem(key, value);
     }
 
+    async setUserData(key: string, value: string): Promise<void> {
+        if (!this.initialized || !this.encryptionCookie) {
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.uninitializedPublicClientApplication
+            );
+        }
+
+        const { data, nonce } = await encrypt(
+            this.encryptionCookie.key,
+            value,
+            this.getContext(key)
+        );
+        const encryptedData: EncryptedData = {
+            id: this.encryptionCookie.id,
+            nonce: nonce,
+            data: data,
+        };
+
+        this.memoryStorage.setItem(key, value);
+        this.setItem(key, JSON.stringify(encryptedData));
+    }
+
     removeItem(key: string): void {
+        this.memoryStorage.removeItem(key);
         window.localStorage.removeItem(key);
     }
 
@@ -37,4 +146,125 @@ export class LocalStorage implements IWindowStorage<string> {
     containsKey(key: string): boolean {
         return window.localStorage.hasOwnProperty(key);
     }
+
+    /**
+     * Removes all known MSAL keys from the cache
+     */
+    clear(): void {
+        // Removes all remaining MSAL cache items
+        this.memoryStorage.clear();
+
+        const accountKeys = getAccountKeys(this);
+        accountKeys.forEach((key) => this.removeItem(key));
+        const tokenKeys = getTokenKeys(this.clientId, this);
+        tokenKeys.idToken.forEach((key) => this.removeItem(key));
+        tokenKeys.accessToken.forEach((key) => this.removeItem(key));
+        tokenKeys.refreshToken.forEach((key) => this.removeItem(key));
+
+        // Clean up anything left
+        this.getKeys().forEach((cacheKey: string) => {
+            if (
+                cacheKey.startsWith(Constants.CACHE_PREFIX) ||
+                cacheKey.indexOf(this.clientId) !== -1
+            ) {
+                this.removeItem(cacheKey);
+            }
+        });
+    }
+
+    /**
+     * Helper to decrypt all known MSAL keys in localStorage and save them to inMemory storage
+     * @returns
+     */
+    private async importExistingCache(): Promise<void> {
+        if (!this.encryptionCookie) {
+            return;
+        }
+
+        const accountKeys = getAccountKeys(this);
+        await this.importArray(accountKeys);
+
+        const tokenKeys: TokenKeys = getTokenKeys(this.clientId, this);
+        await Promise.all([
+            this.importArray(tokenKeys.idToken),
+            this.importArray(tokenKeys.accessToken),
+            this.importArray(tokenKeys.refreshToken),
+        ]);
+    }
+
+    /**
+     * Helper to decrypt and save cache entries
+     * @param key
+     * @returns
+     */
+    private async getItemFromEncryptedCache(
+        key: string
+    ): Promise<string | null> {
+        if (!this.encryptionCookie) {
+            return null;
+        }
+
+        const rawCache = this.getItem(key);
+        if (!rawCache) {
+            return null;
+        }
+
+        let encObj: EncryptedData;
+        try {
+            encObj = JSON.parse(rawCache);
+            if (!encObj.id || !encObj.nonce || !encObj.data) {
+                throw "Not encrypted!"; // TODO: Typed error
+            }
+
+            if (encObj.id !== this.encryptionCookie.id) {
+                throw "Old item!"; // TODO: Typed error
+            }
+        } catch (e) {
+            // Not a valid encrypted object, remove
+            this.removeItem(key);
+            // TODO: Log to telemetry
+            return null;
+        }
+
+        return decrypt(
+            this.encryptionCookie.key,
+            encObj.nonce,
+            this.getContext(key),
+            encObj.data
+        );
+    }
+
+    /**
+     * Helper to decrypt and save an array of cache keys
+     * @param arr
+     */
+    private async importArray(arr: Array<string>): Promise<void> {
+        const promiseArr: Array<Promise<void>> = [];
+        arr.forEach((key) => {
+            const promise = this.getItemFromEncryptedCache(key).then(
+                (value) => {
+                    if (value) {
+                        this.memoryStorage.setItem(key, value);
+                    }
+                }
+            );
+            promiseArr.push(promise);
+        });
+
+        await Promise.all(promiseArr);
+    }
+
+    /**
+     * Gets encryption context for a given cache entry. This is clientId for app specific entries, empty string for shared entries
+     * @param key
+     * @returns
+     */
+    private getContext(key: string): string {
+        let context = "";
+        if (key.includes(this.clientId)) {
+            context = this.clientId; // Used to bind encryption key to this appId
+        }
+
+        return context;
+    }
 }

package/src/cache/MemoryStorage.ts

@@ -12,14 +12,26 @@ export class MemoryStorage<T> implements IWindowStorage<T> {
         this.cache = new Map<string, T>();
     }
 
+    async initialize(): Promise<void> {
+        // Memory storage does not require initialization
+    }
+
     getItem(key: string): T | null {
         return this.cache.get(key) || null;
     }
 
+    getUserData(key: string): T | null {
+        return this.getItem(key);
+    }
+
     setItem(key: string, value: T): void {
         this.cache.set(key, value);
     }
 
+    async setUserData(key: string, value: T): Promise<void> {
+        this.setItem(key, value);
+    }
+
     removeItem(key: string): void {
         this.cache.delete(key);
     }

package/src/cache/SessionStorage.ts

@@ -18,14 +18,26 @@ export class SessionStorage implements IWindowStorage<string> {
         }
     }
 
+    async initialize(): Promise<void> {
+        // Session storage does not require initialization
+    }
+
     getItem(key: string): string | null {
         return window.sessionStorage.getItem(key);
     }
 
+    getUserData(key: string): string | null {
+        return this.getItem(key);
+    }
+
     setItem(key: string, value: string): void {
         window.sessionStorage.setItem(key, value);
     }
 
+    async setUserData(key: string, value: string): Promise<void> {
+        this.setItem(key, value);
+    }
+
     removeItem(key: string): void {
         window.sessionStorage.removeItem(key);
     }

package/src/cache/TokenCache.ts

@@ -75,11 +75,11 @@ export class TokenCache implements ITokenCache {
      * @param options
      * @returns `AuthenticationResult` for the response that was loaded.
      */
-    loadExternalTokens(
+    async loadExternalTokens(
         request: SilentRequest,
         response: ExternalTokenResponse,
         options: LoadTokenOptions
-    ): AuthenticationResult {
+    ): Promise<AuthenticationResult> {
         if (!this.isBrowserEnvironment) {
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.nonBrowserEnvironment
@@ -112,21 +112,21 @@ export class TokenCache implements ITokenCache {
               )
             : undefined;
 
-        const cacheRecordAccount: AccountEntity = this.loadAccount(
+        const cacheRecordAccount: AccountEntity = await this.loadAccount(
             request,
             options.clientInfo || response.client_info || "",
             idTokenClaims,
             authority
         );
 
-        const idToken = this.loadIdToken(
+        const idToken = await this.loadIdToken(
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm
         );
 
-        const accessToken = this.loadAccessToken(
+        const accessToken = await this.loadAccessToken(
             request,
             response,
             cacheRecordAccount.homeAccountId,
@@ -135,7 +135,7 @@ export class TokenCache implements ITokenCache {
             options
         );
 
-        const refreshToken = this.loadRefreshToken(
+        const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment
@@ -163,19 +163,19 @@ export class TokenCache implements ITokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    private loadAccount(
+    private async loadAccount(
         request: SilentRequest,
         clientInfo: string,
         idTokenClaims?: TokenClaims,
         authority?: Authority
-    ): AccountEntity {
+    ): Promise<AccountEntity> {
         this.logger.verbose("TokenCache - loading account");
 
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            this.storage.setAccount(accountEntity);
+            await this.storage.setAccount(accountEntity);
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -210,7 +210,7 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        this.storage.setAccount(cachedAccount);
+        await this.storage.setAccount(cachedAccount);
         return cachedAccount;
     }
 
@@ -222,12 +222,12 @@ export class TokenCache implements ITokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    private loadIdToken(
+    private async loadIdToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
         tenantId: string
-    ): IdTokenEntity | null {
+    ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
@@ -242,7 +242,7 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        this.storage.setIdTokenCredential(idTokenEntity);
+        await this.storage.setIdTokenCredential(idTokenEntity);
         return idTokenEntity;
     }
 
@@ -255,14 +255,14 @@ export class TokenCache implements ITokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    private loadAccessToken(
+    private async loadAccessToken(
         request: SilentRequest,
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
         tenantId: string,
         options: LoadTokenOptions
-    ): AccessTokenEntity | null {
+    ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
                 "TokenCache - no access token found in response"
@@ -309,7 +309,7 @@ export class TokenCache implements ITokenCache {
             base64Decode
         );
 
-        this.storage.setAccessTokenCredential(accessTokenEntity);
+        await this.storage.setAccessTokenCredential(accessTokenEntity);
         return accessTokenEntity;
     }
 
@@ -321,11 +321,11 @@ export class TokenCache implements ITokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    private loadRefreshToken(
+    private async loadRefreshToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string
-    ): RefreshTokenEntity | null {
+    ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
                 "TokenCache - no refresh token found in response"
@@ -344,7 +344,7 @@ export class TokenCache implements ITokenCache {
             response.refresh_token_expires_in
         );
 
-        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        await this.storage.setRefreshTokenCredential(refreshTokenEntity);
         return refreshTokenEntity;
     }
 

package/src/controllers/NestedAppAuthController.ts

@@ -157,8 +157,8 @@ export class NestedAppAuthController implements IController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    initialize(): Promise<void> {
-        // do nothing not required by this controller
+    async initialize(): Promise<void> {
+        await this.browserStorage.initialize();
         return Promise.resolve();
     }
 
@@ -842,7 +842,7 @@ export class NestedAppAuthController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
         return this.browserStorage.hydrateCache(result, request);
     }
 }

package/src/controllers/StandardController.ts

@@ -331,6 +331,8 @@ export class StandardController implements IController {
             return;
         }
 
+        await this.browserStorage.initialize();
+
         const initCorrelationId =
             request?.correlationId || this.getRequestCorrelationId();
         const allowNativeBroker = this.config.system.allowNativeBroker;
@@ -1472,7 +1474,7 @@ export class StandardController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(accountEntity);
 
         if (result.fromNativeBroker) {
             this.logger.verbose(