@azure/msal-browser 3.3.0 → 3.5.0

package/src/interaction_client/RedirectClient.ts

@@ -18,6 +18,9 @@ import {
     IPerformanceClient,
     PerformanceEvents,
     ProtocolMode,
+    invokeAsync,
+    ServerResponseType,
+    UrlUtils,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
@@ -43,6 +46,7 @@ import { EventHandler } from "../event/EventHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class RedirectClient extends StandardInteractionClient {
     protected nativeStorage: BrowserCacheManager;
@@ -78,19 +82,19 @@ export class RedirectClient extends StandardInteractionClient {
      * @param request
      */
     async acquireToken(request: RedirectRequest): Promise<void> {
-        this.performanceClient.setPreQueueTime(
+        const validRequest = await invokeAsync(
+            this.initializeAuthorizationRequest.bind(this),
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
-            request.correlationId
-        );
-        const validRequest = await this.initializeAuthorizationRequest(
-            request,
-            InteractionType.Redirect
-        );
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(request, InteractionType.Redirect);
+
         this.browserStorage.updateCacheEntries(
             validRequest.state,
             validRequest.nonce,
             validRequest.authority,
-            validRequest.loginHint || Constants.EMPTY_STRING,
+            validRequest.loginHint || "",
             validRequest.account || null
         );
         const serverTelemetryManager = this.initializeServerTelemetryManager(
@@ -113,25 +117,27 @@ export class RedirectClient extends StandardInteractionClient {
 
         try {
             // Create auth code request and generate PKCE params
-            this.performanceClient.setPreQueueTime(
-                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                request.correlationId
-            );
             const authCodeRequest: CommonAuthorizationCodeRequest =
-                await this.initializeAuthorizationCodeRequest(validRequest);
+                await invokeAsync(
+                    this.initializeAuthorizationCodeRequest.bind(this),
+                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
+                    this.logger,
+                    this.performanceClient,
+                    this.correlationId
+                )(validRequest);
 
             // Initialize the client
-            this.performanceClient.setPreQueueTime(
+            const authClient: AuthorizationCodeClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
                 PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
-                request.correlationId
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(
+                serverTelemetryManager,
+                validRequest.authority,
+                validRequest.azureCloudOptions
             );
-            const authClient: AuthorizationCodeClient =
-                await this.createAuthCodeClient(
-                    serverTelemetryManager,
-                    validRequest.authority,
-                    validRequest.azureCloudOptions
-                );
-            this.logger.verbose("Auth code client created");
 
             // Create redirect interaction handler.
             const interactionHandler = new RedirectHandler(
@@ -139,7 +145,6 @@ export class RedirectClient extends StandardInteractionClient {
                 this.browserStorage,
                 authCodeRequest,
                 this.logger,
-                this.browserCrypto,
                 this.performanceClient
             );
 
@@ -199,33 +204,13 @@ export class RedirectClient extends StandardInteractionClient {
                 );
                 return null;
             }
-            const responseHash = this.getRedirectResponseHash(
-                hash || window.location.hash
+            const [serverParams, responseString] = this.getRedirectResponse(
+                hash || ""
             );
-            if (!responseHash) {
+            if (!serverParams) {
                 // Not a recognized server response hash or hash not associated with a redirect request
                 this.logger.info(
-                    "handleRedirectPromise did not detect a response hash as a result of a redirect. Cleaning temporary cache."
-                );
-                this.browserStorage.cleanRequestByInteractionType(
-                    InteractionType.Redirect
-                );
-                return null;
-            }
-
-            let state: string;
-            try {
-                // Deserialize hash fragment response parameters.
-                const serverParams: ServerAuthorizationCodeResponse =
-                    UrlString.getDeserializedHash(responseHash);
-                state = this.validateAndExtractStateFromHash(
-                    serverParams,
-                    InteractionType.Redirect
-                );
-                this.logger.verbose("State extracted from hash");
-            } catch (e) {
-                this.logger.info(
-                    `handleRedirectPromise was unable to extract state due to: ${e}`
+                    "handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."
                 );
                 this.browserStorage.cleanRequestByInteractionType(
                     InteractionType.Redirect
@@ -251,12 +236,7 @@ export class RedirectClient extends StandardInteractionClient {
             ) {
                 // We are on the page we need to navigate to - handle hash
                 this.logger.verbose(
-                    "Current page is loginRequestUrl, handling hash"
-                );
-                const handleHashResult = await this.handleHash(
-                    responseHash,
-                    state,
-                    serverTelemetryManager
+                    "Current page is loginRequestUrl, handling response"
                 );
 
                 if (loginRequestUrl.indexOf("#") > -1) {
@@ -264,14 +244,18 @@ export class RedirectClient extends StandardInteractionClient {
                     BrowserUtils.replaceHash(loginRequestUrl);
                 }
 
+                const handleHashResult = await this.handleResponse(
+                    serverParams,
+                    serverTelemetryManager
+                );
+
                 return handleHashResult;
             } else if (!this.config.auth.navigateToLoginRequestUrl) {
                 this.logger.verbose(
-                    "NavigateToLoginRequestUrl set to false, handling hash"
+                    "NavigateToLoginRequestUrl set to false, handling response"
                 );
-                return this.handleHash(
-                    responseHash,
-                    state,
+                return this.handleResponse(
+                    serverParams,
                     serverTelemetryManager
                 );
             } else if (
@@ -284,7 +268,7 @@ export class RedirectClient extends StandardInteractionClient {
                  */
                 this.browserStorage.setTemporaryCache(
                     TemporaryCacheKeys.URL_HASH,
-                    responseHash,
+                    responseString,
                     true
                 );
                 const navigationOptions: NavigationOptions = {
@@ -329,9 +313,8 @@ export class RedirectClient extends StandardInteractionClient {
 
                 // If navigateInternal implementation returns false, handle the hash now
                 if (!processHashOnRedirect) {
-                    return this.handleHash(
-                        responseHash,
-                        state,
+                    return this.handleResponse(
+                        serverParams,
                         serverTelemetryManager
                     );
                 }
@@ -355,18 +338,45 @@ export class RedirectClient extends StandardInteractionClient {
      * Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
      * @param hash
      */
-    protected getRedirectResponseHash(hash: string): string | null {
+    protected getRedirectResponse(
+        userProvidedResponse: string
+    ): [ServerAuthorizationCodeResponse | null, string] {
         this.logger.verbose("getRedirectResponseHash called");
         // Get current location hash from window or cache.
-        const isResponseHash: boolean =
-            UrlString.hashContainsKnownProperties(hash);
+        let responseString = userProvidedResponse;
+        if (!responseString) {
+            if (
+                this.config.auth.OIDCOptions.serverResponseType ===
+                ServerResponseType.QUERY
+            ) {
+                responseString = window.location.search;
+            } else {
+                responseString = window.location.hash;
+            }
+        }
+        let response = UrlUtils.getDeserializedResponse(responseString);
+
+        if (response) {
+            try {
+                ResponseHandler.validateInteractionType(
+                    response,
+                    this.browserCrypto,
+                    InteractionType.Redirect
+                );
+            } catch (e) {
+                if (e instanceof AuthError) {
+                    this.logger.error(
+                        `Interaction type validation failed due to ${e.errorCode}: ${e.errorMessage}`
+                    );
+                }
+                return [null, ""];
+            }
 
-        if (isResponseHash) {
             BrowserUtils.clearHash(window);
             this.logger.verbose(
                 "Hash contains known properties, returning response hash"
             );
-            return hash;
+            return [response, responseString];
         }
 
         const cachedHash = this.browserStorage.getTemporaryCache(
@@ -377,10 +387,17 @@ export class RedirectClient extends StandardInteractionClient {
             this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH)
         );
 
-        this.logger.verbose(
-            "Hash does not contain known properties, returning cached hash"
-        );
-        return cachedHash;
+        if (cachedHash) {
+            response = UrlUtils.getDeserializedResponse(cachedHash);
+            if (response) {
+                this.logger.verbose(
+                    "Hash does not contain known properties, returning cached hash"
+                );
+                return [response, cachedHash];
+            }
+        }
+
+        return [null, ""];
     }
 
     /**
@@ -388,16 +405,17 @@ export class RedirectClient extends StandardInteractionClient {
      * @param hash
      * @param state
      */
-    protected async handleHash(
-        hash: string,
-        state: string,
+    protected async handleResponse(
+        serverParams: ServerAuthorizationCodeResponse,
         serverTelemetryManager: ServerTelemetryManager
     ): Promise<AuthenticationResult> {
-        const cachedRequest = this.browserStorage.getCachedRequest(state);
-        this.logger.verbose("handleHash called, retrieved cached request");
+        const state = serverParams.state;
+        if (!state) {
+            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+        }
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
+        const cachedRequest = this.browserStorage.getCachedRequest(state);
+        this.logger.verbose("handleResponse called, retrieved cached request");
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -444,15 +462,15 @@ export class RedirectClient extends StandardInteractionClient {
                 BrowserAuthErrorCodes.noCachedAuthorityError
             );
         }
-        this.performanceClient.setPreQueueTime(
+
+        const authClient = await invokeAsync(
+            this.createAuthCodeClient.bind(this),
             PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
-            cachedRequest.correlationId
-        );
-        const authClient = await this.createAuthCodeClient(
-            serverTelemetryManager,
-            currentAuthority
-        );
-        this.logger.verbose("Auth code client created");
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(serverTelemetryManager, currentAuthority);
+
         ThrottlingUtils.removeThrottle(
             this.browserStorage,
             this.config.auth.clientId,
@@ -463,15 +481,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.browserStorage,
             cachedRequest,
             this.logger,
-            this.browserCrypto,
             this.performanceClient
         );
-        return await interactionHandler.handleCodeResponseFromHash(
-            hash,
-            state,
-            authClient.authority,
-            this.networkClient
-        );
+        return await interactionHandler.handleCodeResponse(serverParams, state);
     }
 
     /**
@@ -501,15 +513,14 @@ export class RedirectClient extends StandardInteractionClient {
                 timeout: this.config.system.redirectNavigationTimeout,
                 noHistory: false,
             };
-            this.performanceClient.setPreQueueTime(
+
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
                 PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
-                validLogoutRequest.correlationId
-            );
-            const authClient = await this.createAuthCodeClient(
-                serverTelemetryManager,
-                logoutRequest && logoutRequest.authority
-            );
-            this.logger.verbose("Auth code client created");
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(serverTelemetryManager, logoutRequest && logoutRequest.authority);
 
             if (authClient.authority.protocolMode === ProtocolMode.OIDC) {
                 try {

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -8,7 +8,6 @@ import {
     Logger,
     CommonAuthorizationCodeRequest,
     AuthError,
-    Constants,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
@@ -81,13 +80,6 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             this.performanceClient,
             request.correlationId
         )(request, InteractionType.Silent);
-        this.browserStorage.updateCacheEntries(
-            silentRequest.state,
-            silentRequest.nonce,
-            silentRequest.authority,
-            silentRequest.loginHint || Constants.EMPTY_STRING,
-            silentRequest.account || null
-        );
 
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             this.apiId
@@ -137,9 +129,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
                     cloud_graph_host_name: request.cloudGraphHostName,
                     cloud_instance_host_name: request.cloudInstanceHostName,
                 },
-                silentRequest.state,
-                authClient.authority,
-                this.networkClient,
+                silentRequest,
                 false
             );
         } catch (e) {
@@ -147,7 +137,6 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
             }
-            this.browserStorage.cleanRequestByState(silentRequest.state);
             throw e;
         }
     }

package/src/interaction_client/SilentIframeClient.ts

@@ -10,13 +10,11 @@ import {
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     AuthError,
-    Constants,
-    UrlString,
-    ServerAuthorizationCodeResponse,
     ProtocolUtils,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -39,6 +37,7 @@ import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { InteractionHandler } from "../interaction_handler/InteractionHandler";
 import * as BrowserUtils from "../utils/BrowserUtils";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -120,13 +119,6 @@ export class SilentIframeClient extends StandardInteractionClient {
             InteractionType.Silent
         );
         BrowserUtils.preconnect(silentRequest.authority);
-        this.browserStorage.updateCacheEntries(
-            silentRequest.state,
-            silentRequest.nonce,
-            silentRequest.authority,
-            silentRequest.loginHint || Constants.EMPTY_STRING,
-            silentRequest.account || null
-        );
 
         const serverTelemetryManager = this.initializeServerTelemetryManager(
             this.apiId
@@ -158,7 +150,6 @@ export class SilentIframeClient extends StandardInteractionClient {
                 (e as AuthError).setCorrelationId(this.correlationId);
                 serverTelemetryManager.cacheFailedRequest(e);
             }
-            this.browserStorage.cleanRequestByState(silentRequest.state);
             throw e;
         }
     }
@@ -240,8 +231,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId,
             this.config.system.navigateFrameWait
         );
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const hash = await invokeAsync(
+        const responseString = await invokeAsync(
             monitorIframeForHash,
             PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
@@ -253,31 +245,16 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.system.pollIntervalMilliseconds,
             this.performanceClient,
             this.logger,
-            correlationId
-        );
-        if (!hash) {
-            // No hash is present
-            this.logger.error(
-                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
-            );
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        } else if (!UrlString.hashContainsKnownProperties(hash)) {
-            this.logger.error(
-                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
-            );
-            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-            );
-        }
-        // Deserialize hash fragment response parameters.
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
-        const state = this.validateAndExtractStateFromHash(
-            serverParams,
-            InteractionType.Silent,
-            correlationId
+            correlationId,
+            responseType
         );
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(responseString, responseType, this.logger);
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -304,7 +281,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
             const { userRequestState } = ProtocolUtils.parseRequestState(
                 this.browserCrypto,
-                state
+                silentRequest.state
             );
             return invokeAsync(
                 nativeInteractionClient.acquireToken.bind(
@@ -318,20 +295,16 @@ export class SilentIframeClient extends StandardInteractionClient {
                 ...silentRequest,
                 state: userRequestState,
                 prompt: silentRequest.prompt || PromptValue.NONE,
-            }).finally(() => {
-                this.browserStorage.cleanRequestByState(state);
             });
         }
 
         // Handle response from hash string
         return invokeAsync(
-            interactionHandler.handleCodeResponseFromHash.bind(
-                interactionHandler
-            ),
-            PerformanceEvents.HandleCodeResponseFromHash,
+            interactionHandler.handleCodeResponse.bind(interactionHandler),
+            PerformanceEvents.HandleCodeResponse,
             this.logger,
             this.performanceClient,
             correlationId
-        )(hash, state, authClient.authority, this.networkClient);
+        )(serverParams, silentRequest);
     }
 }

package/src/interaction_client/SilentRefreshClient.ts

@@ -53,7 +53,6 @@ export class SilentRefreshClient extends StandardInteractionClient {
             silentRequest.authority,
             silentRequest.azureCloudOptions
         );
-        this.logger.verbose("Refresh token client created");
         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
         return invokeAsync(
             refreshTokenClient.acquireTokenByRefreshToken.bind(
@@ -63,24 +62,11 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(silentRequest)
-            .then((result) => result as AuthenticationResult)
-            .then((result: AuthenticationResult) => {
-                this.performanceClient.addFields(
-                    {
-                        fromCache: result.fromCache,
-                        requestId: result.requestId,
-                    },
-                    request.correlationId
-                );
-
-                return result;
-            })
-            .catch((e: AuthError) => {
-                (e as AuthError).setCorrelationId(this.correlationId);
-                serverTelemetryManager.cacheFailedRequest(e);
-                throw e;
-            });
+        )(silentRequest).catch((e: AuthError) => {
+            (e as AuthError).setCorrelationId(this.correlationId);
+            serverTelemetryManager.cacheFailedRequest(e);
+            throw e;
+        }) as Promise<AuthenticationResult>;
     }
 
     /**

package/src/interaction_client/StandardInteractionClient.ts

@@ -12,7 +12,6 @@ import {
     AuthorityOptions,
     Authority,
     AuthorityFactory,
-    ServerAuthorizationCodeResponse,
     UrlString,
     CommonEndSessionRequest,
     ProtocolUtils,
@@ -28,14 +27,7 @@ import { BaseInteractionClient } from "./BaseInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 import { BrowserConstants, InteractionType } from "../utils/BrowserConstants";
 import { version } from "../packageMetadata";
-import {
-    createBrowserAuthError,
-    BrowserAuthErrorCodes,
-} from "../error/BrowserAuthError";
-import {
-    BrowserProtocolUtils,
-    BrowserStateObject,
-} from "../utils/BrowserProtocolUtils";
+import { BrowserStateObject } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
 import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
@@ -57,7 +49,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     ): Promise<CommonAuthorizationCodeRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            request.correlationId
+            this.correlationId
         );
         const generatedPkceParams = await invokeAsync(
             generatePkceCodes,
@@ -294,44 +286,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         };
     }
 
-    /**
-     * @param hash
-     * @param interactionType
-     */
-    protected validateAndExtractStateFromHash(
-        serverParams: ServerAuthorizationCodeResponse,
-        interactionType: InteractionType,
-        requestCorrelationId?: string
-    ): string {
-        this.logger.verbose(
-            "validateAndExtractStateFromHash called",
-            requestCorrelationId
-        );
-        if (!serverParams.state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
-        }
-
-        const platformStateObj =
-            BrowserProtocolUtils.extractBrowserRequestState(
-                this.browserCrypto,
-                serverParams.state
-            );
-        if (!platformStateObj) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToParseState
-            );
-        }
-
-        if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.stateInteractionTypeMismatch
-            );
-        }
-
-        this.logger.verbose("Returning state from hash", requestCorrelationId);
-        return serverParams.state;
-    }
-
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority