@azure/msal-browser 3.4.0 → 3.5.0

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",
@@ -100,6 +100,6 @@
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@azure/msal-common": "14.3.0"
+    "@azure/msal-common": "14.4.0"
   }
 }

package/src/cache/BrowserCacheManager.ts

@@ -53,7 +53,7 @@ import {
 import { BrowserStorage } from "./BrowserStorage";
 import { MemoryStorage } from "./MemoryStorage";
 import { IWindowStorage } from "./IWindowStorage";
-import { BrowserProtocolUtils } from "../utils/BrowserProtocolUtils";
+import { extractBrowserRequestState } from "../utils/BrowserProtocolUtils";
 import { NativeTokenRequest } from "../broker/nativeBroker/NativeRequest";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { SilentRequest } from "../request/SilentRequest";
@@ -880,12 +880,12 @@ export class BrowserCacheManager extends CacheManager {
             );
             return null;
         }
-        const parsedMetadata = this.validateAndParseJson(value);
+        const parsedEntity = this.validateAndParseJson(value);
         if (
-            !parsedMetadata ||
-            !ServerTelemetryEntity.isServerTelemetryEntity(
+            !parsedEntity ||
+            !CacheHelpers.isServerTelemetryEntity(
                 serverTelemetryKey,
-                parsedMetadata
+                parsedEntity
             )
         ) {
             this.logger.trace(
@@ -895,10 +895,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit");
-        return CacheManager.toObject(
-            new ServerTelemetryEntity(),
-            parsedMetadata
-        );
+        return parsedEntity as ServerTelemetryEntity;
     }
 
     /**
@@ -1587,7 +1584,7 @@ export class BrowserCacheManager extends CacheManager {
                 return;
             }
             // Extract state and ensure it matches given InteractionType, then clean request cache
-            const parsedState = BrowserProtocolUtils.extractBrowserRequestState(
+            const parsedState = extractBrowserRequestState(
                 this.cryptoImpl,
                 stateValue
             );

package/src/controllers/StandardController.ts

@@ -22,8 +22,6 @@ import {
     InProgressPerformanceEvent,
     RequestThumbprint,
     AccountEntity,
-    ServerResponseType,
-    UrlString,
     invokeAsync,
     createClientAuthError,
     ClientAuthErrorCodes,
@@ -336,16 +334,6 @@ export class StandardController implements IController {
         // Block token acquisition before initialize has been called
         BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
 
-        let foundServerResponse = hash;
-
-        if (
-            this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY
-        ) {
-            const url = window.location.href;
-            foundServerResponse = UrlString.parseQueryServerResponse(url);
-        }
-
         const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
@@ -353,8 +341,7 @@ export class StandardController implements IController {
              * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
              * several times concurrently.
              */
-            const redirectResponseKey =
-                foundServerResponse || Constants.EMPTY_STRING;
+            const redirectResponseKey = hash || "";
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
                 this.eventHandler.emitEvent(
@@ -376,7 +363,7 @@ export class StandardController implements IController {
                         this.nativeExtensionProvider
                     ) &&
                     this.nativeExtensionProvider &&
-                    !foundServerResponse
+                    !hash
                 ) {
                     this.logger.trace(
                         "handleRedirectPromise - acquiring token from native platform"
@@ -408,9 +395,7 @@ export class StandardController implements IController {
                     const redirectClient =
                         this.createRedirectClient(correlationId);
                     redirectResponse =
-                        redirectClient.handleRedirectPromise(
-                            foundServerResponse
-                        );
+                        redirectClient.handleRedirectPromise(hash);
                 }
 
                 response = redirectResponse
@@ -533,7 +518,7 @@ export class StandardController implements IController {
                 this.nativeExtensionProvider,
                 this.getNativeAccountId(request),
                 this.nativeInternalStorage,
-                request.correlationId
+                correlationId
             );
             result = nativeClient
                 .acquireTokenRedirect(request)
@@ -543,26 +528,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const redirectClient = this.createRedirectClient(
-                request.correlationId
-            );
+            const redirectClient = this.createRedirectClient(correlationId);
             result = redirectClient.acquireToken(request);
         }
 
@@ -632,7 +613,13 @@ export class StandardController implements IController {
         let result: Promise<AuthenticationResult>;
 
         if (this.canUseNative(request)) {
-            result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
+            result = this.acquireTokenNative(
+                {
+                    ...request,
+                    correlationId,
+                },
+                ApiId.acquireTokenPopup
+            )
                 .then((response) => {
                     this.getBrowserStorage().setInteractionInProgress(false);
                     atPopupMeasurement.end({
@@ -648,24 +635,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const popupClient = this.createPopupClient(request.correlationId);
+            const popupClient = this.createPopupClient(correlationId);
             result = popupClient.acquireToken(request);
         }
 
@@ -876,7 +861,7 @@ export class StandardController implements IController {
         );
         const atbcMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.AcquireTokenByCode,
-            request.correlationId
+            correlationId
         );
 
         try {
@@ -934,7 +919,7 @@ export class StandardController implements IController {
                 } else {
                     this.logger.verbose(
                         "Existing acquireTokenByCode request found",
-                        request.correlationId
+                        correlationId
                     );
                     atbcMeasurement.discard();
                 }
@@ -942,7 +927,10 @@ export class StandardController implements IController {
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
                     return this.acquireTokenNative(
-                        request,
+                        {
+                            ...request,
+                            correlationId,
+                        },
                         ApiId.acquireTokenByCode,
                         request.nativeAccountId
                     ).catch((e: AuthError) => {
@@ -1911,6 +1899,7 @@ export class StandardController implements IController {
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
+            shrOptions: request.shrOptions,
         };
         const silentRequestKey = JSON.stringify(thumbprint);
 

package/src/crypto/CryptoOps.ts

@@ -9,6 +9,7 @@ import {
     JoseHeader,
     Logger,
     PerformanceEvents,
+    ShrOptions,
     SignedHttpRequest,
     SignedHttpRequestParameters,
 } from "@azure/msal-common";
@@ -161,6 +162,7 @@ export class CryptoOps implements ICrypto {
     async signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string> {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(
@@ -180,15 +182,15 @@ export class CryptoOps implements ICrypto {
             cachedKeyPair.publicKey
         );
         const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
-
         // Base64URL encode public key thumbprint with keyId only: BASE64URL({ kid: "FULL_PUBLIC_KEY_HASH" })
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
-
         // Generate header
         const shrHeader = JoseHeader.getShrHeaderString({
-            kid: encodedKeyIdThumbprint,
+            ...shrOptions?.header,
             alg: publicKeyJwk.alg,
+            kid: encodedKeyIdThumbprint,
         });
+
         const encodedShrHeader = urlEncode(shrHeader);
 
         // Generate payload

package/src/index.ts

@@ -135,6 +135,7 @@ export {
     // Utils
     StringUtils,
     UrlString,
+    JsonWebTokenTypes,
     // AzureCloudInstance enum
     AzureCloudInstance,
     AzureCloudOptions,

package/src/interaction_client/BaseInteractionClient.ts

@@ -141,7 +141,7 @@ export abstract class BaseInteractionClient {
     ): Promise<BaseAuthRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.InitializeBaseRequest,
-            request.correlationId
+            this.correlationId
         );
         const authority = request.authority || this.config.auth.authority;
 
@@ -266,7 +266,6 @@ export abstract class BaseInteractionClient {
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
-     * @param requestCorrelationId
      */
     protected async getDiscoveredAuthority(
         requestAuthority?: string

package/src/interaction_client/PopupClient.ts

@@ -11,9 +11,7 @@ import {
     UrlString,
     AuthError,
     OIDC_DEFAULT_SCOPES,
-    Constants,
     ProtocolUtils,
-    ServerAuthorizationCodeResponse,
     PerformanceEvents,
     IPerformanceClient,
     Logger,
@@ -21,6 +19,7 @@ import {
     ProtocolMode,
     ServerResponseType,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { EventType } from "../event/EventType";
@@ -47,6 +46,7 @@ import { InteractionHandler } from "../interaction_handler/InteractionHandler";
 import { PopupWindowAttributes } from "../request/PopupWindowAttributes";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -284,10 +284,19 @@ export class PopupClient extends StandardInteractionClient {
             );
 
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const hash = await this.monitorPopupForHash(popupWindow);
-            // Deserialize hash fragment response parameters.
-            const serverParams: ServerAuthorizationCodeResponse =
-                UrlString.getDeserializedHash(hash);
+            const responseString = await this.monitorPopupForHash(popupWindow);
+
+            const serverParams = invoke(
+                ResponseHandler.deserializeResponse,
+                PerformanceEvents.DeserializeResponse,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(
+                responseString,
+                this.config.auth.OIDCOptions.serverResponseType,
+                this.logger
+            );
             // Remove throttle if it exists
             ThrottlingUtils.removeThrottle(
                 this.browserStorage,
@@ -338,8 +347,8 @@ export class PopupClient extends StandardInteractionClient {
             }
 
             // Handle response from hash string.
-            const result = await interactionHandler.handleCodeResponseFromHash(
-                hash,
+            const result = await interactionHandler.handleCodeResponse(
+                serverParams,
                 validRequest
             );
 
@@ -464,7 +473,9 @@ export class PopupClient extends StandardInteractionClient {
                 null
             );
 
-            await this.waitForLogoutPopup(popupWindow);
+            await this.monitorPopupForHash(popupWindow).catch(() => {
+                // Swallow any errors related to monitoring the window. Server logout is best effort
+            });
 
             if (mainWindowRedirectUri) {
                 const navigationOptions: NavigationOptions = {
@@ -545,16 +556,7 @@ export class PopupClient extends StandardInteractionClient {
      * @param timeout - timeout for processing hash once popup is redirected back to application
      */
     monitorPopupForHash(popupWindow: Window): Promise<string> {
-        return new Promise((resolve, reject) => {
-            /*
-             * Polling for popups needs to be tick-based,
-             * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
-             */
-            const maxTicks =
-                this.config.system.windowHashTimeout /
-                this.config.system.pollIntervalMilliseconds;
-            let ticks = 0;
-
+        return new Promise<string>((resolve, reject) => {
             this.logger.verbose(
                 "PopupHandler.monitorPopupForHash - polling started"
             );
@@ -565,7 +567,6 @@ export class PopupClient extends StandardInteractionClient {
                     this.logger.error(
                         "PopupHandler.monitorPopupForHash - window closed"
                     );
-                    this.cleanPopup();
                     clearInterval(intervalId);
                     reject(
                         createBrowserAuthError(
@@ -575,8 +576,7 @@ export class PopupClient extends StandardInteractionClient {
                     return;
                 }
 
-                let href = Constants.EMPTY_STRING;
-                let serverResponseString = Constants.EMPTY_STRING;
+                let href = "";
                 try {
                     /*
                      * Will throw if cross origin,
@@ -584,117 +584,33 @@ export class PopupClient extends StandardInteractionClient {
                      * since we need the interval to keep running while on STS UI.
                      */
                     href = popupWindow.location.href;
-                    serverResponseString =
-                        this.extractServerResponseStringFromPopup(
-                            popupWindow,
-                            href
-                        );
                 } catch (e) {}
 
                 // Don't process blank pages or cross domain
                 if (!href || href === "about:blank") {
                     return;
                 }
+                clearInterval(intervalId);
 
-                this.logger.verbose(
-                    "PopupHandler.monitorPopupForHash - popup window is on same origin as caller"
-                );
-
-                /*
-                 * Only run clock when we are on same domain for popups
-                 * as popup operations can take a long time.
-                 */
-                ticks++;
-
-                if (serverResponseString) {
-                    this.logger.verbose(
-                        "PopupHandler.monitorPopupForHash - found hash in url"
-                    );
-                    clearInterval(intervalId);
-                    this.cleanPopup(popupWindow);
-
-                    if (
-                        UrlString.hashContainsKnownProperties(
-                            serverResponseString
-                        )
-                    ) {
-                        this.logger.verbose(
-                            "PopupHandler.monitorPopupForHash - hash contains known properties, returning."
-                        );
-                        resolve(serverResponseString);
+                let responseString = "";
+                const responseType =
+                    this.config.auth.OIDCOptions.serverResponseType;
+                if (popupWindow) {
+                    if (responseType === ServerResponseType.QUERY) {
+                        responseString = popupWindow.location.search;
                     } else {
-                        this.logger.error(
-                            "PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely."
-                        );
-                        this.logger.errorPii(
-                            `PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`
-                        );
-                        reject(
-                            createBrowserAuthError(
-                                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-                            )
-                        );
+                        responseString = popupWindow.location.hash;
                     }
-                } else if (ticks > maxTicks) {
-                    this.logger.error(
-                        "PopupHandler.monitorPopupForHash - unable to find hash in url, timing out"
-                    );
-                    clearInterval(intervalId);
-                    reject(
-                        createBrowserAuthError(
-                            BrowserAuthErrorCodes.monitorPopupTimeout
-                        )
-                    );
-                }
-            }, this.config.system.pollIntervalMilliseconds);
-        });
-    }
-
-    /**
-     * Waits for user interaction in logout popup window
-     * @param popupWindow
-     * @returns
-     */
-    waitForLogoutPopup(popupWindow: Window): Promise<void> {
-        return new Promise((resolve) => {
-            this.logger.verbose(
-                "PopupHandler.waitForLogoutPopup - polling started"
-            );
-
-            const intervalId = setInterval(() => {
-                // Window is closed
-                if (popupWindow.closed) {
-                    this.logger.error(
-                        "PopupHandler.waitForLogoutPopup - window closed"
-                    );
-                    this.cleanPopup();
-                    clearInterval(intervalId);
-                    resolve();
-                }
-
-                let href: string = Constants.EMPTY_STRING;
-                try {
-                    /*
-                     * Will throw if cross origin,
-                     * which should be caught and ignored
-                     * since we need the interval to keep running while on STS UI.
-                     */
-                    href = popupWindow.location.href;
-                } catch (e) {}
-
-                // Don't process blank pages or cross domain
-                if (!href || href === "about:blank") {
-                    return;
                 }
 
                 this.logger.verbose(
-                    "PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing."
+                    "PopupHandler.monitorPopupForHash - popup window is on same origin as caller"
                 );
 
-                clearInterval(intervalId);
-                this.cleanPopup(popupWindow);
-                resolve();
+                resolve(responseString);
             }, this.config.system.pollIntervalMilliseconds);
+        }).finally(() => {
+            this.cleanPopup(popupWindow);
         });
     }
 
@@ -884,23 +800,4 @@ export class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
-
-    /**
-     * Extracts the server response from the popup window
-     */
-    extractServerResponseStringFromPopup(
-        popupWindow: Window,
-        href: string
-    ): string {
-        let serverResponseString;
-        if (
-            this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY
-        ) {
-            serverResponseString = UrlString.parseQueryServerResponse(href);
-        } else {
-            serverResponseString = popupWindow.location.hash;
-        }
-        return serverResponseString;
-    }
 }