@azure/msal-browser 3.3.0 → 3.5.0

package/src/interaction_handler/InteractionHandler.ts

@@ -7,17 +7,14 @@ import {
     AuthorizationCodePayload,
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
-    AuthorityFactory,
-    Authority,
-    INetworkModule,
     CcsCredential,
     Logger,
     ServerError,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
-    createClientAuthError,
-    ClientAuthErrorCodes,
+    CcsCredentialType,
+    ServerAuthorizationCodeResponse,
 } from "@azure/msal-common";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -25,10 +22,8 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { TemporaryCacheKeys } from "../utils/BrowserConstants";
 import { AuthenticationResult } from "../response/AuthenticationResult";
-
-export type InteractionParams = {};
+import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 
 /**
  * Abstract class which defines operations for a browser interaction handling class.
@@ -58,36 +53,20 @@ export class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponseFromHash(
-        locationHash: string,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule
+    async handleCodeResponse(
+        response: ServerAuthorizationCodeResponse,
+        request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.HandleCodeResponseFromHash,
-            this.authCodeRequest.correlationId
+            PerformanceEvents.HandleCodeResponse,
+            request.correlationId
         );
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        }
-
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.stateNotFound,
-                "Cached State"
-            );
-        }
 
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
-                locationHash,
-                requestState
+                response,
+                request.state
             );
         } catch (e) {
             if (
@@ -108,8 +87,8 @@ export class InteractionHandler {
             PerformanceEvents.HandleCodeResponseFromServer,
             this.logger,
             this.performanceClient,
-            this.authCodeRequest.correlationId
-        )(authCodeResponse, state, authority, networkModule);
+            request.correlationId
+        )(authCodeResponse, request);
     }
 
     /**
@@ -122,65 +101,46 @@ export class InteractionHandler {
      */
     async handleCodeResponseFromServer(
         authCodeResponse: AuthorizationCodePayload,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule,
+        request: AuthorizationUrlRequest,
         validateNonce: boolean = true
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.HandleCodeResponseFromServer,
-            this.authCodeRequest.correlationId
+            request.correlationId
         );
         this.logger.trace(
             "InteractionHandler.handleCodeResponseFromServer called"
         );
 
-        // Handle code response.
-        const stateKey = this.browserStorage.generateStateKey(state);
-        const requestState = this.browserStorage.getTemporaryCache(stateKey);
-        if (!requestState) {
-            throw createClientAuthError(
-                ClientAuthErrorCodes.stateNotFound,
-                "Cached State"
-            );
-        }
-
-        // Get cached items
-        const nonceKey = this.browserStorage.generateNonceKey(requestState);
-        const cachedNonce = this.browserStorage.getTemporaryCache(nonceKey);
-
         // Assign code to request
         this.authCodeRequest.code = authCodeResponse.code;
 
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
             await invokeAsync(
-                this.updateTokenEndpointAuthority.bind(this),
+                this.authModule.updateAuthority.bind(this.authModule),
                 PerformanceEvents.UpdateTokenEndpointAuthority,
                 this.logger,
                 this.performanceClient,
-                this.authCodeRequest.correlationId
-            )(
-                authCodeResponse.cloud_instance_host_name,
-                authority,
-                networkModule
-            );
+                request.correlationId
+            )(authCodeResponse.cloud_instance_host_name, request.correlationId);
         }
 
         // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
         if (validateNonce) {
-            authCodeResponse.nonce = cachedNonce || undefined;
+            // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly
+            authCodeResponse.nonce = request.nonce || undefined;
         }
 
-        authCodeResponse.state = requestState;
+        authCodeResponse.state = request.state;
 
         // Add CCS parameters if available
         if (authCodeResponse.client_info) {
             this.authCodeRequest.clientInfo = authCodeResponse.client_info;
         } else {
-            const cachedCcsCred = this.checkCcsCredentials();
-            if (cachedCcsCred) {
-                this.authCodeRequest.ccsCredential = cachedCcsCred;
+            const ccsCred = this.createCcsCredentials(request);
+            if (ccsCred) {
+                this.authCodeRequest.ccsCredential = ccsCred;
             }
         }
 
@@ -190,62 +150,29 @@ export class InteractionHandler {
             PerformanceEvents.AuthClientAcquireToken,
             this.logger,
             this.performanceClient,
-            this.authCodeRequest.correlationId
+            request.correlationId
         )(this.authCodeRequest, authCodeResponse)) as AuthenticationResult;
-        this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
 
     /**
-     * Updates authority based on cloudInstanceHostname
-     * @param cloudInstanceHostname
-     * @param authority
-     * @param networkModule
-     */
-    protected async updateTokenEndpointAuthority(
-        cloudInstanceHostname: string,
-        authority: Authority,
-        networkModule: INetworkModule
-    ): Promise<void> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.UpdateTokenEndpointAuthority,
-            this.authCodeRequest.correlationId
-        );
-        const cloudInstanceAuthorityUri = `https://${cloudInstanceHostname}/${authority.tenant}/`;
-        const cloudInstanceAuthority =
-            await AuthorityFactory.createDiscoveredInstance(
-                cloudInstanceAuthorityUri,
-                networkModule,
-                this.browserStorage,
-                authority.options,
-                this.logger,
-                this.performanceClient,
-                this.authCodeRequest.correlationId
-            );
-        this.authModule.updateAuthority(cloudInstanceAuthority);
-    }
-
-    /**
-     * Looks up ccs creds in the cache
+     * Build ccs creds if available
      */
-    protected checkCcsCredentials(): CcsCredential | null {
-        // Look up ccs credential in temp cache
-        const cachedCcsCred = this.browserStorage.getTemporaryCache(
-            TemporaryCacheKeys.CCS_CREDENTIAL,
-            true
-        );
-        if (cachedCcsCred) {
-            try {
-                return JSON.parse(cachedCcsCred) as CcsCredential;
-            } catch (e) {
-                this.authModule.logger.error(
-                    "Cache credential could not be parsed"
-                );
-                this.authModule.logger.errorPii(
-                    `Cache credential could not be parsed: ${cachedCcsCred}`
-                );
-            }
+    protected createCcsCredentials(
+        request: AuthorizationUrlRequest
+    ): CcsCredential | null {
+        if (request.account) {
+            return {
+                credential: request.account.homeAccountId,
+                type: CcsCredentialType.HOME_ACCOUNT_ID,
+            };
+        } else if (request.loginHint) {
+            return {
+                credential: request.loginHint,
+                type: CcsCredentialType.UPN,
+            };
         }
+
         return null;
     }
 }

package/src/interaction_handler/RedirectHandler.ts

@@ -6,14 +6,15 @@
 import {
     AuthorizationCodeClient,
     CommonAuthorizationCodeRequest,
-    ICrypto,
-    Authority,
-    INetworkModule,
     Logger,
     ServerError,
     IPerformanceClient,
     createClientAuthError,
     ClientAuthErrorCodes,
+    CcsCredential,
+    invokeAsync,
+    PerformanceEvents,
+    ServerAuthorizationCodeResponse,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -21,37 +22,36 @@ import {
 } from "../error/BrowserAuthError";
 import { ApiId, TemporaryCacheKeys } from "../utils/BrowserConstants";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
-import { InteractionHandler, InteractionParams } from "./InteractionHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { NavigationOptions } from "../navigation/NavigationOptions";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 
-export type RedirectParams = InteractionParams & {
+export type RedirectParams = {
     navigationClient: INavigationClient;
     redirectTimeout: number;
     redirectStartPage: string;
     onRedirectNavigate?: (url: string) => void | boolean;
 };
 
-export class RedirectHandler extends InteractionHandler {
-    private browserCrypto: ICrypto;
+export class RedirectHandler {
+    authModule: AuthorizationCodeClient;
+    browserStorage: BrowserCacheManager;
+    authCodeRequest: CommonAuthorizationCodeRequest;
+    logger: Logger;
+    performanceClient: IPerformanceClient;
 
     constructor(
         authCodeModule: AuthorizationCodeClient,
         storageImpl: BrowserCacheManager,
         authCodeRequest: CommonAuthorizationCodeRequest,
         logger: Logger,
-        browserCrypto: ICrypto,
         performanceClient: IPerformanceClient
     ) {
-        super(
-            authCodeModule,
-            storageImpl,
-            authCodeRequest,
-            logger,
-            performanceClient
-        );
-        this.browserCrypto = browserCrypto;
+        this.authModule = authCodeModule;
+        this.browserStorage = storageImpl;
+        this.authCodeRequest = authCodeRequest;
+        this.logger = logger;
+        this.performanceClient = performanceClient;
     }
 
     /**
@@ -142,19 +142,12 @@ export class RedirectHandler extends InteractionHandler {
      * Handle authorization code response in the window.
      * @param hash
      */
-    async handleCodeResponseFromHash(
-        locationHash: string,
-        state: string,
-        authority: Authority,
-        networkModule: INetworkModule
+    async handleCodeResponse(
+        response: ServerAuthorizationCodeResponse,
+        state: string
     ): Promise<AuthenticationResult> {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
 
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        }
-
         // Interaction is completed - remove interaction status.
         this.browserStorage.setInteractionInProgress(false);
 
@@ -171,7 +164,7 @@ export class RedirectHandler extends InteractionHandler {
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
-                locationHash,
+                response,
                 requestState
             );
         } catch (e) {
@@ -197,10 +190,15 @@ export class RedirectHandler extends InteractionHandler {
 
         // Check for new cloud instance
         if (authCodeResponse.cloud_instance_host_name) {
-            await this.updateTokenEndpointAuthority(
+            await invokeAsync(
+                this.authModule.updateAuthority.bind(this.authModule),
+                PerformanceEvents.UpdateTokenEndpointAuthority,
+                this.logger,
+                this.performanceClient,
+                this.authCodeRequest.correlationId
+            )(
                 authCodeResponse.cloud_instance_host_name,
-                authority,
-                networkModule
+                this.authCodeRequest.correlationId
             );
         }
 
@@ -226,4 +224,28 @@ export class RedirectHandler extends InteractionHandler {
         this.browserStorage.cleanRequestByState(state);
         return tokenResponse;
     }
+
+    /**
+     * Looks up ccs creds in the cache
+     */
+    protected checkCcsCredentials(): CcsCredential | null {
+        // Look up ccs credential in temp cache
+        const cachedCcsCred = this.browserStorage.getTemporaryCache(
+            TemporaryCacheKeys.CCS_CREDENTIAL,
+            true
+        );
+        if (cachedCcsCred) {
+            try {
+                return JSON.parse(cachedCcsCred) as CcsCredential;
+            } catch (e) {
+                this.authModule.logger.error(
+                    "Cache credential could not be parsed"
+                );
+                this.authModule.logger.errorPii(
+                    `Cache credential could not be parsed: ${cachedCcsCred}`
+                );
+            }
+        }
+        return null;
+    }
 }

package/src/interaction_handler/SilentHandler.ts

@@ -9,6 +9,7 @@ import {
     PerformanceEvents,
     invokeAsync,
     invoke,
+    ServerResponseType,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -67,7 +68,8 @@ export async function monitorIframeForHash(
     pollIntervalMilliseconds: number,
     performanceClient: IPerformanceClient,
     logger: Logger,
-    correlationId: string
+    correlationId: string,
+    responseType: ServerResponseType
 ): Promise<string> {
     performanceClient.addQueueMeasurement(
         PerformanceEvents.SilentHandlerMonitorIframeForHash,
@@ -110,12 +112,17 @@ export async function monitorIframeForHash(
                 return;
             }
 
-            const contentHash = contentWindow
-                ? contentWindow.location.hash
-                : "";
+            let responseString = "";
+            if (contentWindow) {
+                if (responseType === ServerResponseType.QUERY) {
+                    responseString = contentWindow.location.search;
+                } else {
+                    responseString = contentWindow.location.hash;
+                }
+            }
             window.clearTimeout(timeoutId);
             window.clearInterval(intervalId);
-            resolve(contentHash);
+            resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
         invoke(

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.3.0";
+export const version = "3.5.0";

package/src/response/ResponseHandler.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ICrypto,
+    Logger,
+    ServerAuthorizationCodeResponse,
+    UrlUtils,
+} from "@azure/msal-common";
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError";
+import { extractBrowserRequestState } from "../utils/BrowserProtocolUtils";
+import { InteractionType } from "../utils/BrowserConstants";
+
+export function deserializeResponse(
+    responseString: string,
+    responseLocation: string,
+    logger: Logger
+): ServerAuthorizationCodeResponse {
+    // Deserialize hash fragment response parameters.
+    const serverParams = UrlUtils.getDeserializedResponse(responseString);
+    if (!serverParams) {
+        if (!UrlUtils.stripLeadingHashOrQuery(responseString)) {
+            // Hash or Query string is empty
+            logger.error(
+                `The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`
+            );
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        } else {
+            logger.error(
+                `A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`
+            );
+            logger.errorPii(
+                `The ${responseLocation} detected is: ${responseString}`
+            );
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+            );
+        }
+    }
+    return serverParams;
+}
+
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+export function validateInteractionType(
+    response: ServerAuthorizationCodeResponse,
+    browserCrypto: ICrypto,
+    interactionType: InteractionType
+): void {
+    if (!response.state) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+    }
+
+    const platformStateObj = extractBrowserRequestState(
+        browserCrypto,
+        response.state
+    );
+    if (!platformStateObj) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.unableToParseState);
+    }
+
+    if (platformStateObj.interactionType !== interactionType) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.stateInteractionTypeMismatch
+        );
+    }
+}

package/src/utils/BrowserProtocolUtils.ts

@@ -8,8 +8,6 @@ import {
     ICrypto,
     RequestStateObject,
     ProtocolUtils,
-    ServerAuthorizationCodeResponse,
-    UrlString,
     createClientAuthError,
     ClientAuthErrorCodes,
 } from "@azure/msal-common";
@@ -18,41 +16,24 @@ export type BrowserStateObject = {
     interactionType: InteractionType;
 };
 
-export class BrowserProtocolUtils {
-    /**
-     * Extracts the BrowserStateObject from the state string.
-     * @param browserCrypto
-     * @param state
-     */
-    static extractBrowserRequestState(
-        browserCrypto: ICrypto,
-        state: string
-    ): BrowserStateObject | null {
-        if (!state) {
-            return null;
-        }
-
-        try {
-            const requestStateObj: RequestStateObject =
-                ProtocolUtils.parseRequestState(browserCrypto, state);
-            return requestStateObj.libraryState.meta as BrowserStateObject;
-        } catch (e) {
-            throw createClientAuthError(ClientAuthErrorCodes.invalidState);
-        }
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+export function extractBrowserRequestState(
+    browserCrypto: ICrypto,
+    state: string
+): BrowserStateObject | null {
+    if (!state) {
+        return null;
     }
 
-    /**
-     * Parses properties of server response from url hash
-     * @param locationHash Hash from url
-     */
-    static parseServerResponseFromHash(
-        locationHash: string
-    ): ServerAuthorizationCodeResponse {
-        if (!locationHash) {
-            return {};
-        }
-
-        const hashUrlString = new UrlString(locationHash);
-        return UrlString.getDeserializedHash(hashUrlString.getHash());
+    try {
+        const requestStateObj: RequestStateObject =
+            ProtocolUtils.parseRequestState(browserCrypto, state);
+        return requestStateObj.libraryState.meta as BrowserStateObject;
+    } catch (e) {
+        throw createClientAuthError(ClientAuthErrorCodes.invalidState);
     }
 }