@azure/msal-browser 3.4.0 → 3.5.0

package/src/interaction_client/RedirectClient.ts

@@ -19,6 +19,8 @@ import {
     PerformanceEvents,
     ProtocolMode,
     invokeAsync,
+    ServerResponseType,
+    UrlUtils,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
@@ -44,6 +46,7 @@ import { EventHandler } from "../event/EventHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class RedirectClient extends StandardInteractionClient {
     protected nativeStorage: BrowserCacheManager;
@@ -201,33 +204,13 @@ export class RedirectClient extends StandardInteractionClient {
                 );
                 return null;
             }
-            const responseHash = this.getRedirectResponseHash(
-                hash || window.location.hash
+            const [serverParams, responseString] = this.getRedirectResponse(
+                hash || ""
             );
-            if (!responseHash) {
+            if (!serverParams) {
                 // Not a recognized server response hash or hash not associated with a redirect request
                 this.logger.info(
-                    "handleRedirectPromise did not detect a response hash as a result of a redirect. Cleaning temporary cache."
-                );
-                this.browserStorage.cleanRequestByInteractionType(
-                    InteractionType.Redirect
-                );
-                return null;
-            }
-
-            let state: string;
-            try {
-                // Deserialize hash fragment response parameters.
-                const serverParams: ServerAuthorizationCodeResponse =
-                    UrlString.getDeserializedHash(responseHash);
-                state = this.validateAndExtractStateFromHash(
-                    serverParams,
-                    InteractionType.Redirect
-                );
-                this.logger.verbose("State extracted from hash");
-            } catch (e) {
-                this.logger.info(
-                    `handleRedirectPromise was unable to extract state due to: ${e}`
+                    "handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."
                 );
                 this.browserStorage.cleanRequestByInteractionType(
                     InteractionType.Redirect
@@ -253,12 +236,7 @@ export class RedirectClient extends StandardInteractionClient {
             ) {
                 // We are on the page we need to navigate to - handle hash
                 this.logger.verbose(
-                    "Current page is loginRequestUrl, handling hash"
-                );
-                const handleHashResult = await this.handleHash(
-                    responseHash,
-                    state,
-                    serverTelemetryManager
+                    "Current page is loginRequestUrl, handling response"
                 );
 
                 if (loginRequestUrl.indexOf("#") > -1) {
@@ -266,14 +244,18 @@ export class RedirectClient extends StandardInteractionClient {
                     BrowserUtils.replaceHash(loginRequestUrl);
                 }
 
+                const handleHashResult = await this.handleResponse(
+                    serverParams,
+                    serverTelemetryManager
+                );
+
                 return handleHashResult;
             } else if (!this.config.auth.navigateToLoginRequestUrl) {
                 this.logger.verbose(
-                    "NavigateToLoginRequestUrl set to false, handling hash"
+                    "NavigateToLoginRequestUrl set to false, handling response"
                 );
-                return this.handleHash(
-                    responseHash,
-                    state,
+                return this.handleResponse(
+                    serverParams,
                     serverTelemetryManager
                 );
             } else if (
@@ -286,7 +268,7 @@ export class RedirectClient extends StandardInteractionClient {
                  */
                 this.browserStorage.setTemporaryCache(
                     TemporaryCacheKeys.URL_HASH,
-                    responseHash,
+                    responseString,
                     true
                 );
                 const navigationOptions: NavigationOptions = {
@@ -331,9 +313,8 @@ export class RedirectClient extends StandardInteractionClient {
 
                 // If navigateInternal implementation returns false, handle the hash now
                 if (!processHashOnRedirect) {
-                    return this.handleHash(
-                        responseHash,
-                        state,
+                    return this.handleResponse(
+                        serverParams,
                         serverTelemetryManager
                     );
                 }
@@ -357,18 +338,45 @@ export class RedirectClient extends StandardInteractionClient {
      * Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
      * @param hash
      */
-    protected getRedirectResponseHash(hash: string): string | null {
+    protected getRedirectResponse(
+        userProvidedResponse: string
+    ): [ServerAuthorizationCodeResponse | null, string] {
         this.logger.verbose("getRedirectResponseHash called");
         // Get current location hash from window or cache.
-        const isResponseHash: boolean =
-            UrlString.hashContainsKnownProperties(hash);
+        let responseString = userProvidedResponse;
+        if (!responseString) {
+            if (
+                this.config.auth.OIDCOptions.serverResponseType ===
+                ServerResponseType.QUERY
+            ) {
+                responseString = window.location.search;
+            } else {
+                responseString = window.location.hash;
+            }
+        }
+        let response = UrlUtils.getDeserializedResponse(responseString);
+
+        if (response) {
+            try {
+                ResponseHandler.validateInteractionType(
+                    response,
+                    this.browserCrypto,
+                    InteractionType.Redirect
+                );
+            } catch (e) {
+                if (e instanceof AuthError) {
+                    this.logger.error(
+                        `Interaction type validation failed due to ${e.errorCode}: ${e.errorMessage}`
+                    );
+                }
+                return [null, ""];
+            }
 
-        if (isResponseHash) {
             BrowserUtils.clearHash(window);
             this.logger.verbose(
                 "Hash contains known properties, returning response hash"
             );
-            return hash;
+            return [response, responseString];
         }
 
         const cachedHash = this.browserStorage.getTemporaryCache(
@@ -379,10 +387,17 @@ export class RedirectClient extends StandardInteractionClient {
             this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH)
         );
 
-        this.logger.verbose(
-            "Hash does not contain known properties, returning cached hash"
-        );
-        return cachedHash;
+        if (cachedHash) {
+            response = UrlUtils.getDeserializedResponse(cachedHash);
+            if (response) {
+                this.logger.verbose(
+                    "Hash does not contain known properties, returning cached hash"
+                );
+                return [response, cachedHash];
+            }
+        }
+
+        return [null, ""];
     }
 
     /**
@@ -390,16 +405,17 @@ export class RedirectClient extends StandardInteractionClient {
      * @param hash
      * @param state
      */
-    protected async handleHash(
-        hash: string,
-        state: string,
+    protected async handleResponse(
+        serverParams: ServerAuthorizationCodeResponse,
         serverTelemetryManager: ServerTelemetryManager
     ): Promise<AuthenticationResult> {
-        const cachedRequest = this.browserStorage.getCachedRequest(state);
-        this.logger.verbose("handleHash called, retrieved cached request");
+        const state = serverParams.state;
+        if (!state) {
+            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+        }
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
+        const cachedRequest = this.browserStorage.getCachedRequest(state);
+        this.logger.verbose("handleResponse called, retrieved cached request");
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -467,7 +483,7 @@ export class RedirectClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient
         );
-        return await interactionHandler.handleCodeResponseFromHash(hash, state);
+        return await interactionHandler.handleCodeResponse(serverParams, state);
     }
 
     /**

package/src/interaction_client/SilentIframeClient.ts

@@ -10,12 +10,11 @@ import {
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     AuthError,
-    UrlString,
-    ServerAuthorizationCodeResponse,
     ProtocolUtils,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -38,6 +37,7 @@ import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { InteractionHandler } from "../interaction_handler/InteractionHandler";
 import * as BrowserUtils from "../utils/BrowserUtils";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -231,8 +231,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId,
             this.config.system.navigateFrameWait
         );
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const hash = await invokeAsync(
+        const responseString = await invokeAsync(
             monitorIframeForHash,
             PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
@@ -244,26 +245,16 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.system.pollIntervalMilliseconds,
             this.performanceClient,
             this.logger,
-            correlationId
+            correlationId,
+            responseType
         );
-        if (!hash) {
-            // No hash is present
-            this.logger.error(
-                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
-            );
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        } else if (!UrlString.hashContainsKnownProperties(hash)) {
-            this.logger.error(
-                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
-            );
-            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-            );
-        }
-        // Deserialize hash fragment response parameters.
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(responseString, responseType, this.logger);
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -309,13 +300,11 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         // Handle response from hash string
         return invokeAsync(
-            interactionHandler.handleCodeResponseFromHash.bind(
-                interactionHandler
-            ),
-            PerformanceEvents.HandleCodeResponseFromHash,
+            interactionHandler.handleCodeResponse.bind(interactionHandler),
+            PerformanceEvents.HandleCodeResponse,
             this.logger,
             this.performanceClient,
             correlationId
-        )(hash, silentRequest);
+        )(serverParams, silentRequest);
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -12,7 +12,6 @@ import {
     AuthorityOptions,
     Authority,
     AuthorityFactory,
-    ServerAuthorizationCodeResponse,
     UrlString,
     CommonEndSessionRequest,
     ProtocolUtils,
@@ -28,14 +27,7 @@ import { BaseInteractionClient } from "./BaseInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 import { BrowserConstants, InteractionType } from "../utils/BrowserConstants";
 import { version } from "../packageMetadata";
-import {
-    createBrowserAuthError,
-    BrowserAuthErrorCodes,
-} from "../error/BrowserAuthError";
-import {
-    BrowserProtocolUtils,
-    BrowserStateObject,
-} from "../utils/BrowserProtocolUtils";
+import { BrowserStateObject } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
 import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
@@ -57,7 +49,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     ): Promise<CommonAuthorizationCodeRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            request.correlationId
+            this.correlationId
         );
         const generatedPkceParams = await invokeAsync(
             generatePkceCodes,
@@ -294,44 +286,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         };
     }
 
-    /**
-     * @param hash
-     * @param interactionType
-     */
-    protected validateAndExtractStateFromHash(
-        serverParams: ServerAuthorizationCodeResponse,
-        interactionType: InteractionType,
-        requestCorrelationId?: string
-    ): string {
-        this.logger.verbose(
-            "validateAndExtractStateFromHash called",
-            requestCorrelationId
-        );
-        if (!serverParams.state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
-        }
-
-        const platformStateObj =
-            BrowserProtocolUtils.extractBrowserRequestState(
-                this.browserCrypto,
-                serverParams.state
-            );
-        if (!platformStateObj) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToParseState
-            );
-        }
-
-        if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.stateInteractionTypeMismatch
-            );
-        }
-
-        this.logger.verbose("Returning state from hash", requestCorrelationId);
-        return serverParams.state;
-    }
-
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority

package/src/interaction_handler/InteractionHandler.ts

@@ -14,6 +14,7 @@ import {
     PerformanceEvents,
     invokeAsync,
     CcsCredentialType,
+    ServerAuthorizationCodeResponse,
 } from "@azure/msal-common";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -52,23 +53,19 @@ export class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponseFromHash(
-        locationHash: string,
+    async handleCodeResponse(
+        response: ServerAuthorizationCodeResponse,
         request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.HandleCodeResponseFromHash,
+            PerformanceEvents.HandleCodeResponse,
             request.correlationId
         );
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        }
 
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
-                locationHash,
+                response,
                 request.state
             );
         } catch (e) {

package/src/interaction_handler/RedirectHandler.ts

@@ -14,6 +14,7 @@ import {
     CcsCredential,
     invokeAsync,
     PerformanceEvents,
+    ServerAuthorizationCodeResponse,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -141,17 +142,12 @@ export class RedirectHandler {
      * Handle authorization code response in the window.
      * @param hash
      */
-    async handleCodeResponseFromHash(
-        locationHash: string,
+    async handleCodeResponse(
+        response: ServerAuthorizationCodeResponse,
         state: string
     ): Promise<AuthenticationResult> {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
 
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        }
-
         // Interaction is completed - remove interaction status.
         this.browserStorage.setInteractionInProgress(false);
 
@@ -168,7 +164,7 @@ export class RedirectHandler {
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
-                locationHash,
+                response,
                 requestState
             );
         } catch (e) {

package/src/interaction_handler/SilentHandler.ts

@@ -9,6 +9,7 @@ import {
     PerformanceEvents,
     invokeAsync,
     invoke,
+    ServerResponseType,
 } from "@azure/msal-common";
 import {
     createBrowserAuthError,
@@ -67,7 +68,8 @@ export async function monitorIframeForHash(
     pollIntervalMilliseconds: number,
     performanceClient: IPerformanceClient,
     logger: Logger,
-    correlationId: string
+    correlationId: string,
+    responseType: ServerResponseType
 ): Promise<string> {
     performanceClient.addQueueMeasurement(
         PerformanceEvents.SilentHandlerMonitorIframeForHash,
@@ -110,12 +112,17 @@ export async function monitorIframeForHash(
                 return;
             }
 
-            const contentHash = contentWindow
-                ? contentWindow.location.hash
-                : "";
+            let responseString = "";
+            if (contentWindow) {
+                if (responseType === ServerResponseType.QUERY) {
+                    responseString = contentWindow.location.search;
+                } else {
+                    responseString = contentWindow.location.hash;
+                }
+            }
             window.clearTimeout(timeoutId);
             window.clearInterval(intervalId);
-            resolve(contentHash);
+            resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
         invoke(

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.4.0";
+export const version = "3.5.0";

package/src/response/ResponseHandler.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import {
+    ICrypto,
+    Logger,
+    ServerAuthorizationCodeResponse,
+    UrlUtils,
+} from "@azure/msal-common";
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError";
+import { extractBrowserRequestState } from "../utils/BrowserProtocolUtils";
+import { InteractionType } from "../utils/BrowserConstants";
+
+export function deserializeResponse(
+    responseString: string,
+    responseLocation: string,
+    logger: Logger
+): ServerAuthorizationCodeResponse {
+    // Deserialize hash fragment response parameters.
+    const serverParams = UrlUtils.getDeserializedResponse(responseString);
+    if (!serverParams) {
+        if (!UrlUtils.stripLeadingHashOrQuery(responseString)) {
+            // Hash or Query string is empty
+            logger.error(
+                `The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`
+            );
+            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
+        } else {
+            logger.error(
+                `A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`
+            );
+            logger.errorPii(
+                `The ${responseLocation} detected is: ${responseString}`
+            );
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
+            );
+        }
+    }
+    return serverParams;
+}
+
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+export function validateInteractionType(
+    response: ServerAuthorizationCodeResponse,
+    browserCrypto: ICrypto,
+    interactionType: InteractionType
+): void {
+    if (!response.state) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+    }
+
+    const platformStateObj = extractBrowserRequestState(
+        browserCrypto,
+        response.state
+    );
+    if (!platformStateObj) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.unableToParseState);
+    }
+
+    if (platformStateObj.interactionType !== interactionType) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.stateInteractionTypeMismatch
+        );
+    }
+}

package/src/utils/BrowserProtocolUtils.ts

@@ -8,8 +8,6 @@ import {
     ICrypto,
     RequestStateObject,
     ProtocolUtils,
-    ServerAuthorizationCodeResponse,
-    UrlString,
     createClientAuthError,
     ClientAuthErrorCodes,
 } from "@azure/msal-common";
@@ -18,41 +16,24 @@ export type BrowserStateObject = {
     interactionType: InteractionType;
 };
 
-export class BrowserProtocolUtils {
-    /**
-     * Extracts the BrowserStateObject from the state string.
-     * @param browserCrypto
-     * @param state
-     */
-    static extractBrowserRequestState(
-        browserCrypto: ICrypto,
-        state: string
-    ): BrowserStateObject | null {
-        if (!state) {
-            return null;
-        }
-
-        try {
-            const requestStateObj: RequestStateObject =
-                ProtocolUtils.parseRequestState(browserCrypto, state);
-            return requestStateObj.libraryState.meta as BrowserStateObject;
-        } catch (e) {
-            throw createClientAuthError(ClientAuthErrorCodes.invalidState);
-        }
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+export function extractBrowserRequestState(
+    browserCrypto: ICrypto,
+    state: string
+): BrowserStateObject | null {
+    if (!state) {
+        return null;
     }
 
-    /**
-     * Parses properties of server response from url hash
-     * @param locationHash Hash from url
-     */
-    static parseServerResponseFromHash(
-        locationHash: string
-    ): ServerAuthorizationCodeResponse {
-        if (!locationHash) {
-            return {};
-        }
-
-        const hashUrlString = new UrlString(locationHash);
-        return UrlString.getDeserializedHash(hashUrlString.getHash());
+    try {
+        const requestStateObj: RequestStateObject =
+            ProtocolUtils.parseRequestState(browserCrypto, state);
+        return requestStateObj.libraryState.meta as BrowserStateObject;
+    } catch (e) {
+        throw createClientAuthError(ClientAuthErrorCodes.invalidState);
     }
 }