@azure/msal-browser 3.3.0 → 3.5.0

package/src/controllers/StandardController.ts

@@ -21,15 +21,13 @@ import {
     PromptValue,
     InProgressPerformanceEvent,
     RequestThumbprint,
-    ServerError,
     AccountEntity,
-    ServerResponseType,
-    UrlString,
     invokeAsync,
     createClientAuthError,
     ClientAuthErrorCodes,
     AccountFilter,
     buildStaticAuthorityOptions,
+    InteractionRequiredAuthErrorCodes,
 } from "@azure/msal-common";
 import {
     BrowserCacheManager,
@@ -336,16 +334,6 @@ export class StandardController implements IController {
         // Block token acquisition before initialize has been called
         BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
 
-        let foundServerResponse = hash;
-
-        if (
-            this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY
-        ) {
-            const url = window.location.href;
-            foundServerResponse = UrlString.parseQueryServerResponse(url);
-        }
-
         const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
@@ -353,8 +341,7 @@ export class StandardController implements IController {
              * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
              * several times concurrently.
              */
-            const redirectResponseKey =
-                foundServerResponse || Constants.EMPTY_STRING;
+            const redirectResponseKey = hash || "";
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
                 this.eventHandler.emitEvent(
@@ -376,7 +363,7 @@ export class StandardController implements IController {
                         this.nativeExtensionProvider
                     ) &&
                     this.nativeExtensionProvider &&
-                    !foundServerResponse
+                    !hash
                 ) {
                     this.logger.trace(
                         "handleRedirectPromise - acquiring token from native platform"
@@ -408,9 +395,7 @@ export class StandardController implements IController {
                     const redirectClient =
                         this.createRedirectClient(correlationId);
                     redirectResponse =
-                        redirectClient.handleRedirectPromise(
-                            foundServerResponse
-                        );
+                        redirectClient.handleRedirectPromise(hash);
                 }
 
                 response = redirectResponse
@@ -533,7 +518,7 @@ export class StandardController implements IController {
                 this.nativeExtensionProvider,
                 this.getNativeAccountId(request),
                 this.nativeInternalStorage,
-                request.correlationId
+                correlationId
             );
             result = nativeClient
                 .acquireTokenRedirect(request)
@@ -543,26 +528,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const redirectClient = this.createRedirectClient(
-                request.correlationId
-            );
+            const redirectClient = this.createRedirectClient(correlationId);
             result = redirectClient.acquireToken(request);
         }
 
@@ -632,7 +613,13 @@ export class StandardController implements IController {
         let result: Promise<AuthenticationResult>;
 
         if (this.canUseNative(request)) {
-            result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
+            result = this.acquireTokenNative(
+                {
+                    ...request,
+                    correlationId,
+                },
+                ApiId.acquireTokenPopup
+            )
                 .then((response) => {
                     this.getBrowserStorage().setInteractionInProgress(false);
                     atPopupMeasurement.end({
@@ -648,24 +635,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const popupClient = this.createPopupClient(request.correlationId);
+            const popupClient = this.createPopupClient(correlationId);
             result = popupClient.acquireToken(request);
         }
 
@@ -876,7 +861,7 @@ export class StandardController implements IController {
         );
         const atbcMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.AcquireTokenByCode,
-            request.correlationId
+            correlationId
         );
 
         try {
@@ -934,7 +919,7 @@ export class StandardController implements IController {
                 } else {
                     this.logger.verbose(
                         "Existing acquireTokenByCode request found",
-                        request.correlationId
+                        correlationId
                     );
                     atbcMeasurement.discard();
                 }
@@ -942,7 +927,10 @@ export class StandardController implements IController {
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
                     return this.acquireTokenNative(
-                        request,
+                        {
+                            ...request,
+                            correlationId,
+                        },
                         ApiId.acquireTokenByCode,
                         request.nativeAccountId
                     ).catch((e: AuthError) => {
@@ -1047,13 +1035,13 @@ export class StandardController implements IController {
     protected async acquireTokenFromCache(
         silentCacheClient: SilentCacheClient,
         commonRequest: CommonSilentFlowRequest,
-        silentRequest: SilentRequest
+        cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.AcquireTokenFromCache,
             commonRequest.correlationId
         );
-        switch (silentRequest.cacheLookupPolicy) {
+        switch (cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessToken:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
@@ -1074,18 +1062,18 @@ export class StandardController implements IController {
     /**
      * Attempt to acquire an access token via a refresh token
      * @param commonRequest CommonSilentFlowRequest
-     * @param silentRequest SilentRequest
+     * @param cacheLookupPolicy CacheLookupPolicy
      * @returns A promise that, when resolved, returns the access token
      */
     public async acquireTokenByRefreshToken(
         commonRequest: CommonSilentFlowRequest,
-        silentRequest: SilentRequest
+        cacheLookupPolicy: CacheLookupPolicy
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.AcquireTokenByRefreshToken,
             commonRequest.correlationId
         );
-        switch (silentRequest.cacheLookupPolicy) {
+        switch (cacheLookupPolicy) {
             case CacheLookupPolicy.Default:
             case CacheLookupPolicy.AccessTokenAndRefreshToken:
             case CacheLookupPolicy.RefreshToken:
@@ -1911,6 +1899,7 @@ export class StandardController implements IController {
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
+            shrOptions: request.shrOptions,
         };
         const silentRequestKey = JSON.stringify(thumbprint);
 
@@ -2055,12 +2044,8 @@ export class StandardController implements IController {
                 request.correlationId
             )(request, account);
 
-            const requestWithCLP = {
-                ...request,
-                // set the request's CacheLookupPolicy to Default if it was not optionally passed in
-                cacheLookupPolicy:
-                    request.cacheLookupPolicy || CacheLookupPolicy.Default,
-            };
+            const cacheLookupPolicy =
+                request.cacheLookupPolicy || CacheLookupPolicy.Default;
 
             result = invokeAsync(
                 this.acquireTokenFromCache.bind(this),
@@ -2068,10 +2053,10 @@ export class StandardController implements IController {
                 this.logger,
                 this.performanceClient,
                 silentRequest.correlationId
-            )(silentCacheClient, silentRequest, requestWithCLP).catch(
+            )(silentCacheClient, silentRequest, cacheLookupPolicy).catch(
                 (cacheError: AuthError) => {
                     if (
-                        requestWithCLP.cacheLookupPolicy ===
+                        request.cacheLookupPolicy ===
                         CacheLookupPolicy.AccessToken
                     ) {
                         throw cacheError;
@@ -2091,42 +2076,42 @@ export class StandardController implements IController {
                         this.logger,
                         this.performanceClient,
                         silentRequest.correlationId
-                    )(silentRequest, requestWithCLP).catch(
+                    )(silentRequest, cacheLookupPolicy).catch(
                         (refreshTokenError: AuthError) => {
-                            const isServerError =
-                                refreshTokenError instanceof ServerError;
-                            const isInteractionRequiredError =
-                                refreshTokenError instanceof
-                                InteractionRequiredAuthError;
-                            const isInvalidGrantError =
+                            const isSilentlyResolvable =
+                                (!(
+                                    refreshTokenError instanceof
+                                    InteractionRequiredAuthError
+                                ) &&
+                                    (refreshTokenError.errorCode ===
+                                        BrowserConstants.INVALID_GRANT_ERROR ||
+                                        refreshTokenError.errorCode ===
+                                            ClientAuthErrorCodes.tokenRefreshRequired)) ||
                                 refreshTokenError.errorCode ===
-                                BrowserConstants.INVALID_GRANT_ERROR;
-
-                            if (
-                                (!isServerError ||
-                                    !isInvalidGrantError ||
-                                    isInteractionRequiredError ||
-                                    requestWithCLP.cacheLookupPolicy ===
-                                        CacheLookupPolicy.AccessTokenAndRefreshToken ||
-                                    requestWithCLP.cacheLookupPolicy ===
-                                        CacheLookupPolicy.RefreshToken) &&
-                                requestWithCLP.cacheLookupPolicy !==
-                                    CacheLookupPolicy.Skip
-                            ) {
+                                    InteractionRequiredAuthErrorCodes.noTokensFound;
+
+                            const tryIframeRenewal =
+                                cacheLookupPolicy ===
+                                    CacheLookupPolicy.Default ||
+                                cacheLookupPolicy === CacheLookupPolicy.Skip ||
+                                cacheLookupPolicy ===
+                                    CacheLookupPolicy.RefreshTokenAndNetwork;
+
+                            if (isSilentlyResolvable && tryIframeRenewal) {
+                                this.logger.verbose(
+                                    "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
+                                    request.correlationId
+                                );
+                                return invokeAsync(
+                                    this.acquireTokenBySilentIframe.bind(this),
+                                    PerformanceEvents.AcquireTokenBySilentIframe,
+                                    this.logger,
+                                    this.performanceClient,
+                                    silentRequest.correlationId
+                                )(silentRequest);
+                            } else {
                                 throw refreshTokenError;
                             }
-
-                            this.logger.verbose(
-                                "Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.",
-                                request.correlationId
-                            );
-                            return invokeAsync(
-                                this.acquireTokenBySilentIframe.bind(this),
-                                PerformanceEvents.AcquireTokenBySilentIframe,
-                                this.logger,
-                                this.performanceClient,
-                                silentRequest.correlationId
-                            )(silentRequest);
                         }
                     );
                 }

package/src/crypto/CryptoOps.ts

@@ -9,6 +9,7 @@ import {
     JoseHeader,
     Logger,
     PerformanceEvents,
+    ShrOptions,
     SignedHttpRequest,
     SignedHttpRequestParameters,
 } from "@azure/msal-common";
@@ -161,6 +162,7 @@ export class CryptoOps implements ICrypto {
     async signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string> {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(
@@ -180,15 +182,15 @@ export class CryptoOps implements ICrypto {
             cachedKeyPair.publicKey
         );
         const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
-
         // Base64URL encode public key thumbprint with keyId only: BASE64URL({ kid: "FULL_PUBLIC_KEY_HASH" })
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
-
         // Generate header
         const shrHeader = JoseHeader.getShrHeaderString({
-            kid: encodedKeyIdThumbprint,
+            ...shrOptions?.header,
             alg: publicKeyJwk.alg,
+            kid: encodedKeyIdThumbprint,
         });
+
         const encodedShrHeader = urlEncode(shrHeader);
 
         // Generate payload

package/src/index.ts

@@ -135,6 +135,7 @@ export {
     // Utils
     StringUtils,
     UrlString,
+    JsonWebTokenTypes,
     // AzureCloudInstance enum
     AzureCloudInstance,
     AzureCloudOptions,

package/src/interaction_client/BaseInteractionClient.ts

@@ -141,7 +141,7 @@ export abstract class BaseInteractionClient {
     ): Promise<BaseAuthRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.InitializeBaseRequest,
-            request.correlationId
+            this.correlationId
         );
         const authority = request.authority || this.config.auth.authority;
 
@@ -266,7 +266,6 @@ export abstract class BaseInteractionClient {
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
-     * @param requestCorrelationId
      */
     protected async getDiscoveredAuthority(
         requestAuthority?: string

package/src/interaction_client/NativeInteractionClient.ts

@@ -33,6 +33,7 @@ import {
     invokeAsync,
     createAuthError,
     AuthErrorCodes,
+    CacheHelpers,
 } from "@azure/msal-common";
 import { BaseInteractionClient } from "./BaseInteractionClient";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -656,7 +657,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
         reqTimestamp: number
     ): void {
         const cachedIdToken: IdTokenEntity | null =
-            IdTokenEntity.createIdTokenEntity(
+            CacheHelpers.createIdTokenEntity(
                 homeAccountIdentifier,
                 request.authority,
                 response.id_token || "",
@@ -675,7 +676,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
         const responseScopes = this.generateScopes(response, request);
 
         const cachedAccessToken: AccessTokenEntity | null =
-            AccessTokenEntity.createAccessTokenEntity(
+            CacheHelpers.createAccessTokenEntity(
                 homeAccountIdentifier,
                 request.authority,
                 responseAccessToken,
@@ -684,7 +685,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 responseScopes.printScopes(),
                 tokenExpirationSeconds,
                 0,
-                this.browserCrypto
+                base64Decode
             );
 
         const nativeCacheRecord = new CacheRecord(