@azure/msal-browser 3.4.0 → 3.5.1-beta.0

package/package.json

@@ -1,105 +1,105 @@
 {
-  "name": "@azure/msal-browser",
-  "author": {
-    "name": "Microsoft",
-    "email": "nugetaad@microsoft.com",
-    "url": "https://www.microsoft.com"
-  },
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
-  },
-  "version": "3.4.0",
-  "description": "Microsoft Authentication Library for js",
-  "keywords": [
-    "implicit",
-    "authorization code",
-    "PKCE",
-    "js",
-    "AAD",
-    "msal",
-    "oauth"
-  ],
-  "type": "module",
-  "sideEffects": false,
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "module": "./dist/index.mjs",
-      "import": "./dist/index.mjs",
-      "require": "./lib/msal-browser.cjs",
-      "default": "./dist/index.mjs"
+    "name": "@azure/msal-browser",
+    "author": {
+        "name": "Microsoft",
+        "email": "nugetaad@microsoft.com",
+        "url": "https://www.microsoft.com"
     },
-    "./package.json": "./package.json"
-  },
-  "engines": {
-    "node": ">=0.8.0"
-  },
-  "beachball": {
-    "disallowedChangeTypes": [
-      "major"
-    ]
-  },
-  "directories": {
-    "test": "test"
-  },
-  "files": [
-    "dist",
-    "lib/msal-browser.js",
-    "lib/msal-browser.js.map",
-    "lib/msal-browser.cjs",
-    "lib/msal-browser.cjs.map",
-    "lib/msal-browser.min.js",
-    "src"
-  ],
-  "scripts": {
-    "clean": "shx rm -rf dist lib",
-    "clean:coverage": "rimraf ../../.nyc_output/*",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "npm run lint -- --fix",
-    "test": "jest",
-    "test:coverage": "jest --coverage",
-    "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
-    "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
-    "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
-    "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
-    "build": "npm run clean && npm run build:modules",
-    "prepack": "npm run build:all",
-    "format:check": "npx prettier --ignore-path .gitignore --check src test",
-    "format:fix": "npx prettier --ignore-path .gitignore --write src test"
-  },
-  "devDependencies": {
-    "@azure/storage-blob": "^12.2.1",
-    "@babel/core": "^7.7.2",
-    "@babel/plugin-proposal-class-properties": "^7.7.0",
-    "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
-    "@babel/preset-env": "^7.7.1",
-    "@babel/preset-typescript": "^7.7.2",
-    "@rollup/plugin-node-resolve": "^15.0.1",
-    "@rollup/plugin-terser": "^0.4.0",
-    "@rollup/plugin-typescript": "^11.0.0",
-    "@types/jest": "^29.5.0",
-    "@types/node": "^20.3.1",
-    "@types/sinon": "^7.5.0",
-    "dotenv": "^8.2.0",
-    "eslint-config-msal": "^0.0.0",
-    "fake-indexeddb": "^3.1.3",
-    "jest": "^29.5.0",
-    "jest-environment-jsdom": "^29.5.0",
-    "prettier": "2.8.7",
-    "rimraf": "^3.0.0",
-    "rollup": "^3.14.0",
-    "shx": "^0.3.2",
-    "sinon": "^7.5.0",
-    "ssri": "^8.0.1",
-    "ts-jest": "^29.1.0",
-    "tslib": "^1.10.0",
-    "typescript": "^4.9.5"
-  },
-  "dependencies": {
-    "@azure/msal-common": "14.3.0"
-  }
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
+    },
+    "version": "3.5.1-beta.0",
+    "description": "Microsoft Authentication Library for js",
+    "keywords": [
+        "implicit",
+        "authorization code",
+        "PKCE",
+        "js",
+        "AAD",
+        "msal",
+        "oauth"
+    ],
+    "type": "module",
+    "sideEffects": false,
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "module": "./dist/index.mjs",
+            "import": "./dist/index.mjs",
+            "require": "./lib/msal-browser.cjs",
+            "default": "./dist/index.mjs"
+        },
+        "./package.json": "./package.json"
+    },
+    "engines": {
+        "node": ">=0.8.0"
+    },
+    "beachball": {
+        "disallowedChangeTypes": [
+            "major"
+        ]
+    },
+    "directories": {
+        "test": "test"
+    },
+    "files": [
+        "dist",
+        "lib/msal-browser.js",
+        "lib/msal-browser.js.map",
+        "lib/msal-browser.cjs",
+        "lib/msal-browser.cjs.map",
+        "lib/msal-browser.min.js",
+        "src"
+    ],
+    "scripts": {
+        "clean": "shx rm -rf dist lib",
+        "clean:coverage": "rimraf ../../.nyc_output/*",
+        "lint": "eslint src --ext .ts",
+        "lint:fix": "npm run lint -- --fix",
+        "test": "jest",
+        "test:coverage": "jest --coverage",
+        "test:coverage:only": "npm run clean:coverage && npm run test:coverage",
+        "build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
+        "build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
+        "build:modules:watch": "rollup -cw --bundleConfigAsCjs",
+        "build": "npm run clean && npm run build:modules",
+        "prepack": "npm run build:all",
+        "format:check": "npx prettier --ignore-path .gitignore --check src test",
+        "format:fix": "npx prettier --ignore-path .gitignore --write src test"
+    },
+    "devDependencies": {
+        "@azure/storage-blob": "^12.2.1",
+        "@babel/core": "^7.7.2",
+        "@babel/plugin-proposal-class-properties": "^7.7.0",
+        "@babel/plugin-proposal-object-rest-spread": "^7.6.2",
+        "@babel/preset-env": "^7.7.1",
+        "@babel/preset-typescript": "^7.7.2",
+        "@rollup/plugin-node-resolve": "^15.0.1",
+        "@rollup/plugin-terser": "^0.4.0",
+        "@rollup/plugin-typescript": "^11.0.0",
+        "@types/jest": "^29.5.0",
+        "@types/node": "^20.3.1",
+        "@types/sinon": "^7.5.0",
+        "dotenv": "^8.2.0",
+        "eslint-config-msal": "^0.0.0",
+        "fake-indexeddb": "^3.1.3",
+        "jest": "^29.5.0",
+        "jest-environment-jsdom": "^29.5.0",
+        "prettier": "2.8.7",
+        "rimraf": "^3.0.0",
+        "rollup": "^3.14.0",
+        "shx": "^0.3.2",
+        "sinon": "^7.5.0",
+        "ssri": "^8.0.1",
+        "ts-jest": "^29.1.0",
+        "tslib": "^1.10.0",
+        "typescript": "^4.9.5"
+    },
+    "dependencies": {
+        "@azure/msal-common": "14.4.1-beta.0"
+    }
 }

package/src/cache/BrowserCacheManager.ts

@@ -53,7 +53,7 @@ import {
 import { BrowserStorage } from "./BrowserStorage";
 import { MemoryStorage } from "./MemoryStorage";
 import { IWindowStorage } from "./IWindowStorage";
-import { BrowserProtocolUtils } from "../utils/BrowserProtocolUtils";
+import { extractBrowserRequestState } from "../utils/BrowserProtocolUtils";
 import { NativeTokenRequest } from "../broker/nativeBroker/NativeRequest";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { SilentRequest } from "../request/SilentRequest";
@@ -880,12 +880,12 @@ export class BrowserCacheManager extends CacheManager {
             );
             return null;
         }
-        const parsedMetadata = this.validateAndParseJson(value);
+        const parsedEntity = this.validateAndParseJson(value);
         if (
-            !parsedMetadata ||
-            !ServerTelemetryEntity.isServerTelemetryEntity(
+            !parsedEntity ||
+            !CacheHelpers.isServerTelemetryEntity(
                 serverTelemetryKey,
-                parsedMetadata
+                parsedEntity
             )
         ) {
             this.logger.trace(
@@ -895,10 +895,7 @@ export class BrowserCacheManager extends CacheManager {
         }
 
         this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit");
-        return CacheManager.toObject(
-            new ServerTelemetryEntity(),
-            parsedMetadata
-        );
+        return parsedEntity as ServerTelemetryEntity;
     }
 
     /**
@@ -1587,7 +1584,7 @@ export class BrowserCacheManager extends CacheManager {
                 return;
             }
             // Extract state and ensure it matches given InteractionType, then clean request cache
-            const parsedState = BrowserProtocolUtils.extractBrowserRequestState(
+            const parsedState = extractBrowserRequestState(
                 this.cryptoImpl,
                 stateValue
             );

package/src/controllers/NestedAppAuthController.ts

@@ -14,6 +14,7 @@ import {
     DEFAULT_CRYPTO_IMPLEMENTATION,
     PerformanceEvents,
     AccountFilter,
+    TimeUtils,
 } from "@azure/msal-common";
 import { ITokenCache } from "../cache/ITokenCache";
 import { BrowserConfiguration } from "../config/Configuration";
@@ -134,13 +135,15 @@ export class NestedAppAuthController implements IController {
         try {
             const naaRequest =
                 this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const reqTimestamp = TimeUtils.nowSeconds();
             const response = await this.bridgeProxy.getTokenInteractive(
                 naaRequest
             );
             const result: AuthenticationResult =
                 this.nestedAppAuthAdapter.fromNaaTokenResponse(
                     naaRequest,
-                    response
+                    response,
+                    reqTimestamp
                 );
 
             this.operatingContext.setActiveAccount(result.account);
@@ -204,13 +207,15 @@ export class NestedAppAuthController implements IController {
 
         try {
             const naaRequest =
-                this.nestedAppAuthAdapter.toNaaSilentTokenRequest(request);
+                this.nestedAppAuthAdapter.toNaaTokenRequest(request);
+            const reqTimestamp = TimeUtils.nowSeconds();
             const response = await this.bridgeProxy.getTokenSilent(naaRequest);
 
             const result: AuthenticationResult =
                 this.nestedAppAuthAdapter.fromNaaTokenResponse(
                     naaRequest,
-                    response
+                    response,
+                    reqTimestamp
                 );
 
             this.operatingContext.setActiveAccount(result.account);

package/src/controllers/StandardController.ts

@@ -22,8 +22,6 @@ import {
     InProgressPerformanceEvent,
     RequestThumbprint,
     AccountEntity,
-    ServerResponseType,
-    UrlString,
     invokeAsync,
     createClientAuthError,
     ClientAuthErrorCodes,
@@ -336,16 +334,6 @@ export class StandardController implements IController {
         // Block token acquisition before initialize has been called
         BrowserUtils.blockAPICallsBeforeInitialize(this.initialized);
 
-        let foundServerResponse = hash;
-
-        if (
-            this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY
-        ) {
-            const url = window.location.href;
-            foundServerResponse = UrlString.parseQueryServerResponse(url);
-        }
-
         const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
@@ -353,8 +341,7 @@ export class StandardController implements IController {
              * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
              * several times concurrently.
              */
-            const redirectResponseKey =
-                foundServerResponse || Constants.EMPTY_STRING;
+            const redirectResponseKey = hash || "";
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
                 this.eventHandler.emitEvent(
@@ -376,7 +363,7 @@ export class StandardController implements IController {
                         this.nativeExtensionProvider
                     ) &&
                     this.nativeExtensionProvider &&
-                    !foundServerResponse
+                    !hash
                 ) {
                     this.logger.trace(
                         "handleRedirectPromise - acquiring token from native platform"
@@ -408,9 +395,7 @@ export class StandardController implements IController {
                     const redirectClient =
                         this.createRedirectClient(correlationId);
                     redirectResponse =
-                        redirectClient.handleRedirectPromise(
-                            foundServerResponse
-                        );
+                        redirectClient.handleRedirectPromise(hash);
                 }
 
                 response = redirectResponse
@@ -533,7 +518,7 @@ export class StandardController implements IController {
                 this.nativeExtensionProvider,
                 this.getNativeAccountId(request),
                 this.nativeInternalStorage,
-                request.correlationId
+                correlationId
             );
             result = nativeClient
                 .acquireTokenRedirect(request)
@@ -543,26 +528,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const redirectClient = this.createRedirectClient(
-                            request.correlationId
-                        );
+                        const redirectClient =
+                            this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const redirectClient = this.createRedirectClient(
-                request.correlationId
-            );
+            const redirectClient = this.createRedirectClient(correlationId);
             result = redirectClient.acquireToken(request);
         }
 
@@ -632,7 +613,13 @@ export class StandardController implements IController {
         let result: Promise<AuthenticationResult>;
 
         if (this.canUseNative(request)) {
-            result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
+            result = this.acquireTokenNative(
+                {
+                    ...request,
+                    correlationId,
+                },
+                ApiId.acquireTokenPopup
+            )
                 .then((response) => {
                     this.getBrowserStorage().setInteractionInProgress(false);
                     atPopupMeasurement.end({
@@ -648,24 +635,22 @@ export class StandardController implements IController {
                         isFatalNativeAuthError(e)
                     ) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     } else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose(
                             "acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow"
                         );
-                        const popupClient = this.createPopupClient(
-                            request.correlationId
-                        );
+                        const popupClient =
+                            this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
                     throw e;
                 });
         } else {
-            const popupClient = this.createPopupClient(request.correlationId);
+            const popupClient = this.createPopupClient(correlationId);
             result = popupClient.acquireToken(request);
         }
 
@@ -876,7 +861,7 @@ export class StandardController implements IController {
         );
         const atbcMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.AcquireTokenByCode,
-            request.correlationId
+            correlationId
         );
 
         try {
@@ -934,7 +919,7 @@ export class StandardController implements IController {
                 } else {
                     this.logger.verbose(
                         "Existing acquireTokenByCode request found",
-                        request.correlationId
+                        correlationId
                     );
                     atbcMeasurement.discard();
                 }
@@ -942,7 +927,10 @@ export class StandardController implements IController {
             } else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
                     return this.acquireTokenNative(
-                        request,
+                        {
+                            ...request,
+                            correlationId,
+                        },
                         ApiId.acquireTokenByCode,
                         request.nativeAccountId
                     ).catch((e: AuthError) => {
@@ -1911,6 +1899,7 @@ export class StandardController implements IController {
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
+            shrOptions: request.shrOptions,
         };
         const silentRequestKey = JSON.stringify(thumbprint);
 
@@ -2099,7 +2088,9 @@ export class StandardController implements IController {
                                         refreshTokenError.errorCode ===
                                             ClientAuthErrorCodes.tokenRefreshRequired)) ||
                                 refreshTokenError.errorCode ===
-                                    InteractionRequiredAuthErrorCodes.noTokensFound;
+                                    InteractionRequiredAuthErrorCodes.noTokensFound ||
+                                refreshTokenError.errorCode ===
+                                    InteractionRequiredAuthErrorCodes.refreshTokenExpired;
 
                             const tryIframeRenewal =
                                 cacheLookupPolicy ===

package/src/crypto/CryptoOps.ts

@@ -9,6 +9,7 @@ import {
     JoseHeader,
     Logger,
     PerformanceEvents,
+    ShrOptions,
     SignedHttpRequest,
     SignedHttpRequestParameters,
 } from "@azure/msal-common";
@@ -161,6 +162,7 @@ export class CryptoOps implements ICrypto {
     async signJwt(
         payload: SignedHttpRequest,
         kid: string,
+        shrOptions?: ShrOptions,
         correlationId?: string
     ): Promise<string> {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(
@@ -180,15 +182,15 @@ export class CryptoOps implements ICrypto {
             cachedKeyPair.publicKey
         );
         const publicKeyJwkString = getSortedObjectString(publicKeyJwk);
-
         // Base64URL encode public key thumbprint with keyId only: BASE64URL({ kid: "FULL_PUBLIC_KEY_HASH" })
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
-
         // Generate header
         const shrHeader = JoseHeader.getShrHeaderString({
-            kid: encodedKeyIdThumbprint,
+            ...shrOptions?.header,
             alg: publicKeyJwk.alg,
+            kid: encodedKeyIdThumbprint,
         });
+
         const encodedShrHeader = urlEncode(shrHeader);
 
         // Generate payload

package/src/index.ts

@@ -135,6 +135,7 @@ export {
     // Utils
     StringUtils,
     UrlString,
+    JsonWebTokenTypes,
     // AzureCloudInstance enum
     AzureCloudInstance,
     AzureCloudOptions,

package/src/interaction_client/BaseInteractionClient.ts

@@ -141,7 +141,7 @@ export abstract class BaseInteractionClient {
     ): Promise<BaseAuthRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.InitializeBaseRequest,
-            request.correlationId
+            this.correlationId
         );
         const authority = request.authority || this.config.auth.authority;
 
@@ -266,7 +266,6 @@ export abstract class BaseInteractionClient {
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
-     * @param requestCorrelationId
      */
     protected async getDiscoveredAuthority(
         requestAuthority?: string