@azure/msal-browser 3.28.1 → 4.0.1

package/src/cache/TokenCache.ts

@@ -75,17 +75,20 @@ export class TokenCache implements ITokenCache {
      * @param options
      * @returns `AuthenticationResult` for the response that was loaded.
      */
-    loadExternalTokens(
+    async loadExternalTokens(
         request: SilentRequest,
         response: ExternalTokenResponse,
         options: LoadTokenOptions
-    ): AuthenticationResult {
+    ): Promise<AuthenticationResult> {
         if (!this.isBrowserEnvironment) {
             throw createBrowserAuthError(
                 BrowserAuthErrorCodes.nonBrowserEnvironment
             );
         }
 
+        const correlationId =
+            request.correlationId || BrowserCrypto.createNewGuid();
+
         const idTokenClaims = response.id_token
             ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
             : undefined;
@@ -112,33 +115,37 @@ export class TokenCache implements ITokenCache {
               )
             : undefined;
 
-        const cacheRecordAccount: AccountEntity = this.loadAccount(
+        const cacheRecordAccount: AccountEntity = await this.loadAccount(
             request,
             options.clientInfo || response.client_info || "",
+            correlationId,
             idTokenClaims,
             authority
         );
 
-        const idToken = this.loadIdToken(
+        const idToken = await this.loadIdToken(
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
-            cacheRecordAccount.realm
+            cacheRecordAccount.realm,
+            correlationId
         );
 
-        const accessToken = this.loadAccessToken(
+        const accessToken = await this.loadAccessToken(
             request,
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
-            options
+            options,
+            correlationId
         );
 
-        const refreshToken = this.loadRefreshToken(
+        const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
-            cacheRecordAccount.environment
+            cacheRecordAccount.environment,
+            correlationId
         );
 
         return this.generateAuthenticationResult(
@@ -163,19 +170,20 @@ export class TokenCache implements ITokenCache {
      * @param requestHomeAccountId
      * @returns `AccountEntity`
      */
-    private loadAccount(
+    private async loadAccount(
         request: SilentRequest,
         clientInfo: string,
+        correlationId: string,
         idTokenClaims?: TokenClaims,
         authority?: Authority
-    ): AccountEntity {
+    ): Promise<AccountEntity> {
         this.logger.verbose("TokenCache - loading account");
 
         if (request.account) {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            this.storage.setAccount(accountEntity);
+            await this.storage.setAccount(accountEntity, correlationId);
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -210,7 +218,7 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        this.storage.setAccount(cachedAccount);
+        await this.storage.setAccount(cachedAccount, correlationId);
         return cachedAccount;
     }
 
@@ -222,12 +230,13 @@ export class TokenCache implements ITokenCache {
      * @param tenantId
      * @returns `IdTokenEntity`
      */
-    private loadIdToken(
+    private async loadIdToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
-        tenantId: string
-    ): IdTokenEntity | null {
+        tenantId: string,
+        correlationId: string
+    ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
             return null;
@@ -242,7 +251,7 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        this.storage.setIdTokenCredential(idTokenEntity);
+        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
         return idTokenEntity;
     }
 
@@ -255,14 +264,15 @@ export class TokenCache implements ITokenCache {
      * @param tenantId
      * @returns `AccessTokenEntity`
      */
-    private loadAccessToken(
+    private async loadAccessToken(
         request: SilentRequest,
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
         tenantId: string,
-        options: LoadTokenOptions
-    ): AccessTokenEntity | null {
+        options: LoadTokenOptions,
+        correlationId: string
+    ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
                 "TokenCache - no access token found in response"
@@ -309,7 +319,10 @@ export class TokenCache implements ITokenCache {
             base64Decode
         );
 
-        this.storage.setAccessTokenCredential(accessTokenEntity);
+        await this.storage.setAccessTokenCredential(
+            accessTokenEntity,
+            correlationId
+        );
         return accessTokenEntity;
     }
 
@@ -321,11 +334,12 @@ export class TokenCache implements ITokenCache {
      * @param environment
      * @returns `RefreshTokenEntity`
      */
-    private loadRefreshToken(
+    private async loadRefreshToken(
         response: ExternalTokenResponse,
         homeAccountId: string,
-        environment: string
-    ): RefreshTokenEntity | null {
+        environment: string,
+        correlationId: string
+    ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
                 "TokenCache - no refresh token found in response"
@@ -344,7 +358,10 @@ export class TokenCache implements ITokenCache {
             response.refresh_token_expires_in
         );
 
-        this.storage.setRefreshTokenCredential(refreshTokenEntity);
+        await this.storage.setRefreshTokenCredential(
+            refreshTokenEntity,
+            correlationId
+        );
         return refreshTokenEntity;
     }
 

package/src/config/Configuration.ts

@@ -192,9 +192,9 @@ export type BrowserSystemOptions = SystemOptions & {
      */
     allowRedirectInIframe?: boolean;
     /**
-     * Flag to enable native broker support (e.g. acquiring tokens from WAM on Windows)
+     * Flag to enable native broker support (e.g. acquiring tokens from WAM on Windows, MacBroker on Mac)
      */
-    allowNativeBroker?: boolean;
+    allowPlatformBroker?: boolean;
     /**
      * Sets the timeout for waiting for the native broker handshake to resolve
      */
@@ -340,7 +340,7 @@ export function buildConfiguration(
         redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS,
         asyncPopups: false,
         allowRedirectInIframe: false,
-        allowNativeBroker: false,
+        allowPlatformBroker: false,
         nativeBrokerHandshakeTimeout:
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
@@ -376,14 +376,14 @@ export function buildConfiguration(
         );
     }
 
-    // Throw an error if user has set allowNativeBroker to true without being in AAD protocol mode
+    // Throw an error if user has set allowPlatformBroker to true without being in AAD protocol mode
     if (
         userInputAuth?.protocolMode &&
         userInputAuth.protocolMode !== ProtocolMode.AAD &&
-        providedSystemOptions?.allowNativeBroker
+        providedSystemOptions?.allowPlatformBroker
     ) {
         throw createClientConfigurationError(
-            ClientConfigurationErrorCodes.cannotAllowNativeBroker
+            ClientConfigurationErrorCodes.cannotAllowPlatformBroker
         );
     }
 

package/src/controllers/NestedAppAuthController.ts

@@ -53,6 +53,8 @@ import {
 } from "../cache/BrowserCacheManager.js";
 import { ClearCacheRequest } from "../request/ClearCacheRequest.js";
 import * as AccountManager from "../cache/AccountManager.js";
+import { InitializeApplicationRequest } from "../request/InitializeApplicationRequest.js";
+import { createNewGuid } from "../crypto/BrowserCrypto.js";
 
 export class NestedAppAuthController implements IController {
     // OperatingContext
@@ -112,11 +114,13 @@ export class NestedAppAuthController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
+                  this.performanceClient,
                   buildStaticAuthorityOptions(this.config.auth)
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
 
         this.eventHandler = new EventHandler(this.logger);
@@ -157,8 +161,9 @@ export class NestedAppAuthController implements IController {
      * Specific implementation of initialize function for NestedAppAuthController
      * @returns
      */
-    initialize(): Promise<void> {
-        // do nothing not required by this controller
+    async initialize(request?: InitializeApplicationRequest): Promise<void> {
+        const initCorrelationId = request?.correlationId || createNewGuid();
+        await this.browserStorage.initialize(initCorrelationId);
         return Promise.resolve();
     }
 
@@ -568,7 +573,7 @@ export class NestedAppAuthController implements IController {
                       | "responseMode"
                       | "codeChallenge"
                       | "codeChallengeMethod"
-                      | "nativeBroker"
+                      | "platformBroker"
                   >
               >
             | PopupRequest,
@@ -761,7 +766,7 @@ export class NestedAppAuthController implements IController {
                 | "responseMode"
                 | "codeChallenge"
                 | "codeChallengeMethod"
-                | "nativeBroker"
+                | "platformBroker"
             >
         >
     ): Promise<AuthenticationResult> {
@@ -842,7 +847,10 @@ export class NestedAppAuthController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(
+            accountEntity,
+            result.correlationId
+        );
         return this.browserStorage.hydrateCache(result, request);
     }
 }

package/src/controllers/StandardController.ts

@@ -242,12 +242,13 @@ export class StandardController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
-                  buildStaticAuthorityOptions(this.config.auth),
-                  this.performanceClient
+                  this.performanceClient,
+                  buildStaticAuthorityOptions(this.config.auth)
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
 
         // initialize in memory storage for native flows
@@ -264,7 +265,6 @@ export class StandardController implements IController {
             nativeCacheOptions,
             this.browserCrypto,
             this.logger,
-            undefined,
             this.performanceClient
         );
 
@@ -333,14 +333,22 @@ export class StandardController implements IController {
 
         const initCorrelationId =
             request?.correlationId || this.getRequestCorrelationId();
-        const allowNativeBroker = this.config.system.allowNativeBroker;
+        const allowPlatformBroker = this.config.system.allowPlatformBroker;
         const initMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.InitializeClientApplication,
             initCorrelationId
         );
         this.eventHandler.emitEvent(EventType.INITIALIZE_START);
 
-        if (allowNativeBroker) {
+        await invokeAsync(
+            this.browserStorage.initialize.bind(this.browserStorage),
+            PerformanceEvents.InitializeCache,
+            this.logger,
+            this.performanceClient,
+            initCorrelationId
+        )(initCorrelationId);
+
+        if (allowPlatformBroker) {
             try {
                 this.nativeExtensionProvider =
                     await NativeMessageHandler.createProvider(
@@ -371,7 +379,10 @@ export class StandardController implements IController {
 
         this.initialized = true;
         this.eventHandler.emitEvent(EventType.INITIALIZE_END);
-        initMeasurement.end({ allowNativeBroker, success: true });
+        initMeasurement.end({
+            allowPlatformBroker: allowPlatformBroker,
+            success: true,
+        });
     }
 
     // #region Redirect Flow
@@ -431,7 +442,7 @@ export class StandardController implements IController {
             this.browserStorage.getCachedNativeRequest();
         const useNative =
             request &&
-            NativeMessageHandler.isNativeAvailable(
+            NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider
@@ -654,7 +665,10 @@ export class StandardController implements IController {
 
             let result: Promise<void>;
 
-            if (this.nativeExtensionProvider && this.canUseNative(request)) {
+            if (
+                this.nativeExtensionProvider &&
+                this.canUsePlatformBroker(request)
+            ) {
                 const nativeClient = new NativeInteractionClient(
                     this.config,
                     this.browserStorage,
@@ -768,7 +782,7 @@ export class StandardController implements IController {
 
         let result: Promise<AuthenticationResult>;
 
-        if (this.canUseNative(request)) {
+        if (this.canUsePlatformBroker(request)) {
             result = this.acquireTokenNative(
                 {
                     ...request,
@@ -937,7 +951,7 @@ export class StandardController implements IController {
 
         let result: Promise<AuthenticationResult>;
 
-        if (this.canUseNative(validRequest)) {
+        if (this.canUsePlatformBroker(validRequest)) {
             result = this.acquireTokenNative(
                 validRequest,
                 ApiId.ssoSilent
@@ -1085,7 +1099,9 @@ export class StandardController implements IController {
                 }
                 return await response;
             } else if (request.nativeAccountId) {
-                if (this.canUseNative(request, request.nativeAccountId)) {
+                if (
+                    this.canUsePlatformBroker(request, request.nativeAccountId)
+                ) {
                     const result = await this.acquireTokenNative(
                         {
                             ...request,
@@ -1472,7 +1488,10 @@ export class StandardController implements IController {
             result.cloudGraphHostName,
             result.msGraphHost
         );
-        this.browserStorage.setAccount(accountEntity);
+        await this.browserStorage.setAccount(
+            accountEntity,
+            result.correlationId
+        );
 
         if (result.fromNativeBroker) {
             this.logger.verbose(
@@ -1522,16 +1541,16 @@ export class StandardController implements IController {
     }
 
     /**
-     * Returns boolean indicating if this request can use the native broker
+     * Returns boolean indicating if this request can use the platform broker
      * @param request
      */
-    public canUseNative(
+    public canUsePlatformBroker(
         request: RedirectRequest | PopupRequest | SsoSilentRequest,
         accountId?: string
     ): boolean {
-        this.logger.trace("canUseNative called");
+        this.logger.trace("canUsePlatformBroker called");
         if (
-            !NativeMessageHandler.isNativeAvailable(
+            !NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider,
@@ -1539,7 +1558,7 @@ export class StandardController implements IController {
             )
         ) {
             this.logger.trace(
-                "canUseNative: isNativeAvailable returned false, returning false"
+                "canUsePlatformBroker: isPlatformBrokerAvailable returned false, returning false"
             );
             return false;
         }
@@ -1550,12 +1569,12 @@ export class StandardController implements IController {
                 case PromptValue.CONSENT:
                 case PromptValue.LOGIN:
                     this.logger.trace(
-                        "canUseNative: prompt is compatible with native flow"
+                        "canUsePlatformBroker: prompt is compatible with platform broker flow"
                     );
                     break;
                 default:
                     this.logger.trace(
-                        `canUseNative: prompt = ${request.prompt} is not compatible with native flow, returning false`
+                        `canUsePlatformBroker: prompt = ${request.prompt} is not compatible with platform broker flow, returning false`
                     );
                     return false;
             }
@@ -1563,7 +1582,7 @@ export class StandardController implements IController {
 
         if (!accountId && !this.getNativeAccountId(request)) {
             this.logger.trace(
-                "canUseNative: nativeAccountId is not available, returning false"
+                "canUsePlatformBroker: nativeAccountId is not available, returning false"
             );
             return false;
         }
@@ -2252,7 +2271,7 @@ export class StandardController implements IController {
         cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         if (
-            NativeMessageHandler.isNativeAvailable(
+            NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
                 this.nativeExtensionProvider,

package/src/controllers/UnknownOperatingContextController.ts

@@ -105,12 +105,13 @@ export class UnknownOperatingContextController implements IController {
                   this.config.cache,
                   this.browserCrypto,
                   this.logger,
-                  undefined,
-                  this.performanceClient
+                  this.performanceClient,
+                  undefined
               )
             : DEFAULT_BROWSER_CACHE_MANAGER(
                   this.config.auth.clientId,
-                  this.logger
+                  this.logger,
+                  this.performanceClient
               );
     }
     getBrowserStorage(): BrowserCacheManager {
@@ -180,7 +181,7 @@ export class UnknownOperatingContextController implements IController {
                       | "codeChallenge"
                       | "codeChallengeMethod"
                       | "requestedClaimsHash"
-                      | "nativeBroker"
+                      | "platformBroker"
                   >
               >,
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -287,7 +288,7 @@ export class UnknownOperatingContextController implements IController {
                 | "codeChallenge"
                 | "codeChallengeMethod"
                 | "requestedClaimsHash"
-                | "nativeBroker"
+                | "platformBroker"
             >
         >
     ): Promise<AuthenticationResult> {

package/src/crypto/BrowserCrypto.ts

@@ -13,6 +13,7 @@ import {
 } from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
 import { urlEncodeArr } from "../encode/Base64Encode.js";
+import { base64DecToArr } from "../encode/Base64Decode.js";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -22,8 +23,10 @@ import { urlEncodeArr } from "../encode/Base64Encode.js";
 /**
  * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
  */
-// RSA KeyGen Algorithm
+// Algorithms
 const PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+const AES_GCM = "AES-GCM";
+const HKDF = "HKDF";
 // SHA-256 hashing algorithm
 const S256_HASH_ALG = "SHA-256";
 // MOD length for PoP tokens
@@ -35,6 +38,14 @@ const UUID_CHARS = "0123456789abcdef";
 // Array to store UINT32 random value
 const UINT32_ARR = new Uint32Array(1);
 
+// Key Format
+const RAW = "raw";
+// Key Usages
+const ENCRYPT = "encrypt";
+const DECRYPT = "decrypt";
+const DERIVE_KEY = "deriveKey";
+
+// Suberror
 const SUBTLE_SUBERROR = "crypto_subtle_undefined";
 
 const keygenAlgorithmOptions: RsaHashedKeyGenParams = {
@@ -215,6 +226,114 @@ export async function sign(
     ) as Promise<ArrayBuffer>;
 }
 
+/**
+ * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
+ */
+export async function generateBaseKey(): Promise<ArrayBuffer> {
+    const key = await window.crypto.subtle.generateKey(
+        {
+            name: AES_GCM,
+            length: 256,
+        },
+        true,
+        [ENCRYPT, DECRYPT]
+    );
+    return window.crypto.subtle.exportKey(RAW, key);
+}
+
+/**
+ * Returns the raw key to be passed into the key derivation function
+ * @param baseKey
+ * @returns
+ */
+export async function generateHKDF(baseKey: ArrayBuffer): Promise<CryptoKey> {
+    return window.crypto.subtle.importKey(RAW, baseKey, HKDF, false, [
+        DERIVE_KEY,
+    ]);
+}
+
+/**
+ * Given a base key and a nonce generates a derived key to be used in encryption and decryption.
+ * Note: every time we encrypt a new key is derived
+ * @param baseKey
+ * @param nonce
+ * @returns
+ */
+async function deriveKey(
+    baseKey: CryptoKey,
+    nonce: ArrayBuffer,
+    context: string
+): Promise<CryptoKey> {
+    return window.crypto.subtle.deriveKey(
+        {
+            name: HKDF,
+            salt: nonce,
+            hash: S256_HASH_ALG,
+            info: new TextEncoder().encode(context),
+        },
+        baseKey,
+        { name: AES_GCM, length: 256 },
+        false,
+        [ENCRYPT, DECRYPT]
+    );
+}
+
+/**
+ * Encrypt the given data given a base key. Returns encrypted data and a nonce that must be provided during decryption
+ * @param key
+ * @param rawData
+ */
+export async function encrypt(
+    baseKey: CryptoKey,
+    rawData: string,
+    context: string
+): Promise<{ data: string; nonce: string }> {
+    const encodedData = new TextEncoder().encode(rawData);
+    // The nonce must never be reused with a given key.
+    const nonce = window.crypto.getRandomValues(new Uint8Array(16));
+    const derivedKey = await deriveKey(baseKey, nonce, context);
+    const encryptedData = await window.crypto.subtle.encrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return {
+        data: urlEncodeArr(new Uint8Array(encryptedData)),
+        nonce: urlEncodeArr(nonce),
+    };
+}
+
+/**
+ * Decrypt data with the given key and nonce
+ * @param key
+ * @param nonce
+ * @param encryptedData
+ * @returns
+ */
+export async function decrypt(
+    baseKey: CryptoKey,
+    nonce: string,
+    context: string,
+    encryptedData: string
+): Promise<string> {
+    const encodedData = base64DecToArr(encryptedData);
+    const derivedKey = await deriveKey(baseKey, base64DecToArr(nonce), context);
+    const decryptedData = await window.crypto.subtle.decrypt(
+        {
+            name: AES_GCM,
+            iv: new Uint8Array(12), // New key is derived for every encrypt so we don't need a new nonce
+        },
+        derivedKey,
+        encodedData
+    );
+
+    return new TextDecoder().decode(decryptedData);
+}
+
 /**
  * Returns the SHA-256 hash of an input string
  * @param plainText

package/src/encode/Base64Decode.ts

@@ -25,7 +25,7 @@ export function base64Decode(input: string): string {
  * Decodes base64 into Uint8Array
  * @param base64String
  */
-function base64DecToArr(base64String: string): Uint8Array {
+export function base64DecToArr(base64String: string): Uint8Array {
     let encodedString = base64String.replace(/-/g, "+").replace(/_/g, "/");
     switch (encodedString.length % 4) {
         case 0:

package/src/index.ts

@@ -74,7 +74,6 @@ export { ITokenCache } from "./cache/ITokenCache.js";
 
 // Storage
 export { MemoryStorage } from "./cache/MemoryStorage.js";
-export { BrowserStorage } from "./cache/BrowserStorage.js";
 export { LocalStorage } from "./cache/LocalStorage.js";
 export { SessionStorage } from "./cache/SessionStorage.js";
 export { IWindowStorage } from "./cache/IWindowStorage.js";