@azure/msal-browser 3.4.0 → 3.5.1-beta.0

package/src/interaction_client/PopupClient.ts

@@ -11,9 +11,7 @@ import {
     UrlString,
     AuthError,
     OIDC_DEFAULT_SCOPES,
-    Constants,
     ProtocolUtils,
-    ServerAuthorizationCodeResponse,
     PerformanceEvents,
     IPerformanceClient,
     Logger,
@@ -21,6 +19,7 @@ import {
     ProtocolMode,
     ServerResponseType,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { EventType } from "../event/EventType";
@@ -47,6 +46,7 @@ import { InteractionHandler } from "../interaction_handler/InteractionHandler";
 import { PopupWindowAttributes } from "../request/PopupWindowAttributes";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -284,10 +284,19 @@ export class PopupClient extends StandardInteractionClient {
             );
 
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const hash = await this.monitorPopupForHash(popupWindow);
-            // Deserialize hash fragment response parameters.
-            const serverParams: ServerAuthorizationCodeResponse =
-                UrlString.getDeserializedHash(hash);
+            const responseString = await this.monitorPopupForHash(popupWindow);
+
+            const serverParams = invoke(
+                ResponseHandler.deserializeResponse,
+                PerformanceEvents.DeserializeResponse,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(
+                responseString,
+                this.config.auth.OIDCOptions.serverResponseType,
+                this.logger
+            );
             // Remove throttle if it exists
             ThrottlingUtils.removeThrottle(
                 this.browserStorage,
@@ -338,8 +347,8 @@ export class PopupClient extends StandardInteractionClient {
             }
 
             // Handle response from hash string.
-            const result = await interactionHandler.handleCodeResponseFromHash(
-                hash,
+            const result = await interactionHandler.handleCodeResponse(
+                serverParams,
                 validRequest
             );
 
@@ -464,7 +473,9 @@ export class PopupClient extends StandardInteractionClient {
                 null
             );
 
-            await this.waitForLogoutPopup(popupWindow);
+            await this.monitorPopupForHash(popupWindow).catch(() => {
+                // Swallow any errors related to monitoring the window. Server logout is best effort
+            });
 
             if (mainWindowRedirectUri) {
                 const navigationOptions: NavigationOptions = {
@@ -545,16 +556,7 @@ export class PopupClient extends StandardInteractionClient {
      * @param timeout - timeout for processing hash once popup is redirected back to application
      */
     monitorPopupForHash(popupWindow: Window): Promise<string> {
-        return new Promise((resolve, reject) => {
-            /*
-             * Polling for popups needs to be tick-based,
-             * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
-             */
-            const maxTicks =
-                this.config.system.windowHashTimeout /
-                this.config.system.pollIntervalMilliseconds;
-            let ticks = 0;
-
+        return new Promise<string>((resolve, reject) => {
             this.logger.verbose(
                 "PopupHandler.monitorPopupForHash - polling started"
             );
@@ -565,7 +567,6 @@ export class PopupClient extends StandardInteractionClient {
                     this.logger.error(
                         "PopupHandler.monitorPopupForHash - window closed"
                     );
-                    this.cleanPopup();
                     clearInterval(intervalId);
                     reject(
                         createBrowserAuthError(
@@ -575,8 +576,7 @@ export class PopupClient extends StandardInteractionClient {
                     return;
                 }
 
-                let href = Constants.EMPTY_STRING;
-                let serverResponseString = Constants.EMPTY_STRING;
+                let href = "";
                 try {
                     /*
                      * Will throw if cross origin,
@@ -584,117 +584,33 @@ export class PopupClient extends StandardInteractionClient {
                      * since we need the interval to keep running while on STS UI.
                      */
                     href = popupWindow.location.href;
-                    serverResponseString =
-                        this.extractServerResponseStringFromPopup(
-                            popupWindow,
-                            href
-                        );
                 } catch (e) {}
 
                 // Don't process blank pages or cross domain
                 if (!href || href === "about:blank") {
                     return;
                 }
+                clearInterval(intervalId);
 
-                this.logger.verbose(
-                    "PopupHandler.monitorPopupForHash - popup window is on same origin as caller"
-                );
-
-                /*
-                 * Only run clock when we are on same domain for popups
-                 * as popup operations can take a long time.
-                 */
-                ticks++;
-
-                if (serverResponseString) {
-                    this.logger.verbose(
-                        "PopupHandler.monitorPopupForHash - found hash in url"
-                    );
-                    clearInterval(intervalId);
-                    this.cleanPopup(popupWindow);
-
-                    if (
-                        UrlString.hashContainsKnownProperties(
-                            serverResponseString
-                        )
-                    ) {
-                        this.logger.verbose(
-                            "PopupHandler.monitorPopupForHash - hash contains known properties, returning."
-                        );
-                        resolve(serverResponseString);
+                let responseString = "";
+                const responseType =
+                    this.config.auth.OIDCOptions.serverResponseType;
+                if (popupWindow) {
+                    if (responseType === ServerResponseType.QUERY) {
+                        responseString = popupWindow.location.search;
                     } else {
-                        this.logger.error(
-                            "PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely."
-                        );
-                        this.logger.errorPii(
-                            `PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`
-                        );
-                        reject(
-                            createBrowserAuthError(
-                                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-                            )
-                        );
+                        responseString = popupWindow.location.hash;
                     }
-                } else if (ticks > maxTicks) {
-                    this.logger.error(
-                        "PopupHandler.monitorPopupForHash - unable to find hash in url, timing out"
-                    );
-                    clearInterval(intervalId);
-                    reject(
-                        createBrowserAuthError(
-                            BrowserAuthErrorCodes.monitorPopupTimeout
-                        )
-                    );
-                }
-            }, this.config.system.pollIntervalMilliseconds);
-        });
-    }
-
-    /**
-     * Waits for user interaction in logout popup window
-     * @param popupWindow
-     * @returns
-     */
-    waitForLogoutPopup(popupWindow: Window): Promise<void> {
-        return new Promise((resolve) => {
-            this.logger.verbose(
-                "PopupHandler.waitForLogoutPopup - polling started"
-            );
-
-            const intervalId = setInterval(() => {
-                // Window is closed
-                if (popupWindow.closed) {
-                    this.logger.error(
-                        "PopupHandler.waitForLogoutPopup - window closed"
-                    );
-                    this.cleanPopup();
-                    clearInterval(intervalId);
-                    resolve();
-                }
-
-                let href: string = Constants.EMPTY_STRING;
-                try {
-                    /*
-                     * Will throw if cross origin,
-                     * which should be caught and ignored
-                     * since we need the interval to keep running while on STS UI.
-                     */
-                    href = popupWindow.location.href;
-                } catch (e) {}
-
-                // Don't process blank pages or cross domain
-                if (!href || href === "about:blank") {
-                    return;
                 }
 
                 this.logger.verbose(
-                    "PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing."
+                    "PopupHandler.monitorPopupForHash - popup window is on same origin as caller"
                 );
 
-                clearInterval(intervalId);
-                this.cleanPopup(popupWindow);
-                resolve();
+                resolve(responseString);
             }, this.config.system.pollIntervalMilliseconds);
+        }).finally(() => {
+            this.cleanPopup(popupWindow);
         });
     }
 
@@ -884,23 +800,4 @@ export class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
-
-    /**
-     * Extracts the server response from the popup window
-     */
-    extractServerResponseStringFromPopup(
-        popupWindow: Window,
-        href: string
-    ): string {
-        let serverResponseString;
-        if (
-            this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY
-        ) {
-            serverResponseString = UrlString.parseQueryServerResponse(href);
-        } else {
-            serverResponseString = popupWindow.location.hash;
-        }
-        return serverResponseString;
-    }
 }

package/src/interaction_client/RedirectClient.ts

@@ -19,6 +19,8 @@ import {
     PerformanceEvents,
     ProtocolMode,
     invokeAsync,
+    ServerResponseType,
+    UrlUtils,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
@@ -44,6 +46,7 @@ import { EventHandler } from "../event/EventHandler";
 import { INavigationClient } from "../navigation/INavigationClient";
 import { EventError } from "../event/EventMessage";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class RedirectClient extends StandardInteractionClient {
     protected nativeStorage: BrowserCacheManager;
@@ -201,33 +204,13 @@ export class RedirectClient extends StandardInteractionClient {
                 );
                 return null;
             }
-            const responseHash = this.getRedirectResponseHash(
-                hash || window.location.hash
+            const [serverParams, responseString] = this.getRedirectResponse(
+                hash || ""
             );
-            if (!responseHash) {
+            if (!serverParams) {
                 // Not a recognized server response hash or hash not associated with a redirect request
                 this.logger.info(
-                    "handleRedirectPromise did not detect a response hash as a result of a redirect. Cleaning temporary cache."
-                );
-                this.browserStorage.cleanRequestByInteractionType(
-                    InteractionType.Redirect
-                );
-                return null;
-            }
-
-            let state: string;
-            try {
-                // Deserialize hash fragment response parameters.
-                const serverParams: ServerAuthorizationCodeResponse =
-                    UrlString.getDeserializedHash(responseHash);
-                state = this.validateAndExtractStateFromHash(
-                    serverParams,
-                    InteractionType.Redirect
-                );
-                this.logger.verbose("State extracted from hash");
-            } catch (e) {
-                this.logger.info(
-                    `handleRedirectPromise was unable to extract state due to: ${e}`
+                    "handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache."
                 );
                 this.browserStorage.cleanRequestByInteractionType(
                     InteractionType.Redirect
@@ -253,12 +236,7 @@ export class RedirectClient extends StandardInteractionClient {
             ) {
                 // We are on the page we need to navigate to - handle hash
                 this.logger.verbose(
-                    "Current page is loginRequestUrl, handling hash"
-                );
-                const handleHashResult = await this.handleHash(
-                    responseHash,
-                    state,
-                    serverTelemetryManager
+                    "Current page is loginRequestUrl, handling response"
                 );
 
                 if (loginRequestUrl.indexOf("#") > -1) {
@@ -266,14 +244,18 @@ export class RedirectClient extends StandardInteractionClient {
                     BrowserUtils.replaceHash(loginRequestUrl);
                 }
 
+                const handleHashResult = await this.handleResponse(
+                    serverParams,
+                    serverTelemetryManager
+                );
+
                 return handleHashResult;
             } else if (!this.config.auth.navigateToLoginRequestUrl) {
                 this.logger.verbose(
-                    "NavigateToLoginRequestUrl set to false, handling hash"
+                    "NavigateToLoginRequestUrl set to false, handling response"
                 );
-                return this.handleHash(
-                    responseHash,
-                    state,
+                return this.handleResponse(
+                    serverParams,
                     serverTelemetryManager
                 );
             } else if (
@@ -286,7 +268,7 @@ export class RedirectClient extends StandardInteractionClient {
                  */
                 this.browserStorage.setTemporaryCache(
                     TemporaryCacheKeys.URL_HASH,
-                    responseHash,
+                    responseString,
                     true
                 );
                 const navigationOptions: NavigationOptions = {
@@ -331,9 +313,8 @@ export class RedirectClient extends StandardInteractionClient {
 
                 // If navigateInternal implementation returns false, handle the hash now
                 if (!processHashOnRedirect) {
-                    return this.handleHash(
-                        responseHash,
-                        state,
+                    return this.handleResponse(
+                        serverParams,
                         serverTelemetryManager
                     );
                 }
@@ -357,18 +338,45 @@ export class RedirectClient extends StandardInteractionClient {
      * Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
      * @param hash
      */
-    protected getRedirectResponseHash(hash: string): string | null {
+    protected getRedirectResponse(
+        userProvidedResponse: string
+    ): [ServerAuthorizationCodeResponse | null, string] {
         this.logger.verbose("getRedirectResponseHash called");
         // Get current location hash from window or cache.
-        const isResponseHash: boolean =
-            UrlString.hashContainsKnownProperties(hash);
+        let responseString = userProvidedResponse;
+        if (!responseString) {
+            if (
+                this.config.auth.OIDCOptions.serverResponseType ===
+                ServerResponseType.QUERY
+            ) {
+                responseString = window.location.search;
+            } else {
+                responseString = window.location.hash;
+            }
+        }
+        let response = UrlUtils.getDeserializedResponse(responseString);
+
+        if (response) {
+            try {
+                ResponseHandler.validateInteractionType(
+                    response,
+                    this.browserCrypto,
+                    InteractionType.Redirect
+                );
+            } catch (e) {
+                if (e instanceof AuthError) {
+                    this.logger.error(
+                        `Interaction type validation failed due to ${e.errorCode}: ${e.errorMessage}`
+                    );
+                }
+                return [null, ""];
+            }
 
-        if (isResponseHash) {
             BrowserUtils.clearHash(window);
             this.logger.verbose(
                 "Hash contains known properties, returning response hash"
             );
-            return hash;
+            return [response, responseString];
         }
 
         const cachedHash = this.browserStorage.getTemporaryCache(
@@ -379,10 +387,17 @@ export class RedirectClient extends StandardInteractionClient {
             this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH)
         );
 
-        this.logger.verbose(
-            "Hash does not contain known properties, returning cached hash"
-        );
-        return cachedHash;
+        if (cachedHash) {
+            response = UrlUtils.getDeserializedResponse(cachedHash);
+            if (response) {
+                this.logger.verbose(
+                    "Hash does not contain known properties, returning cached hash"
+                );
+                return [response, cachedHash];
+            }
+        }
+
+        return [null, ""];
     }
 
     /**
@@ -390,16 +405,17 @@ export class RedirectClient extends StandardInteractionClient {
      * @param hash
      * @param state
      */
-    protected async handleHash(
-        hash: string,
-        state: string,
+    protected async handleResponse(
+        serverParams: ServerAuthorizationCodeResponse,
         serverTelemetryManager: ServerTelemetryManager
     ): Promise<AuthenticationResult> {
-        const cachedRequest = this.browserStorage.getCachedRequest(state);
-        this.logger.verbose("handleHash called, retrieved cached request");
+        const state = serverParams.state;
+        if (!state) {
+            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+        }
 
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
+        const cachedRequest = this.browserStorage.getCachedRequest(state);
+        this.logger.verbose("handleResponse called, retrieved cached request");
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -467,7 +483,7 @@ export class RedirectClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient
         );
-        return await interactionHandler.handleCodeResponseFromHash(hash, state);
+        return await interactionHandler.handleCodeResponse(serverParams, state);
     }
 
     /**

package/src/interaction_client/SilentIframeClient.ts

@@ -10,12 +10,11 @@ import {
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     AuthError,
-    UrlString,
-    ServerAuthorizationCodeResponse,
     ProtocolUtils,
     IPerformanceClient,
     PerformanceEvents,
     invokeAsync,
+    invoke,
 } from "@azure/msal-common";
 import { StandardInteractionClient } from "./StandardInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
@@ -38,6 +37,7 @@ import { NativeInteractionClient } from "./NativeInteractionClient";
 import { AuthenticationResult } from "../response/AuthenticationResult";
 import { InteractionHandler } from "../interaction_handler/InteractionHandler";
 import * as BrowserUtils from "../utils/BrowserUtils";
+import * as ResponseHandler from "../response/ResponseHandler";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -231,8 +231,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId,
             this.config.system.navigateFrameWait
         );
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const hash = await invokeAsync(
+        const responseString = await invokeAsync(
             monitorIframeForHash,
             PerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
@@ -244,26 +245,16 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.system.pollIntervalMilliseconds,
             this.performanceClient,
             this.logger,
-            correlationId
+            correlationId,
+            responseType
         );
-        if (!hash) {
-            // No hash is present
-            this.logger.error(
-                "The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page."
-            );
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        } else if (!UrlString.hashContainsKnownProperties(hash)) {
-            this.logger.error(
-                "A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page."
-            );
-            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.hashDoesNotContainKnownProperties
-            );
-        }
-        // Deserialize hash fragment response parameters.
-        const serverParams: ServerAuthorizationCodeResponse =
-            UrlString.getDeserializedHash(hash);
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(responseString, responseType, this.logger);
 
         if (serverParams.accountId) {
             this.logger.verbose(
@@ -309,13 +300,11 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         // Handle response from hash string
         return invokeAsync(
-            interactionHandler.handleCodeResponseFromHash.bind(
-                interactionHandler
-            ),
-            PerformanceEvents.HandleCodeResponseFromHash,
+            interactionHandler.handleCodeResponse.bind(interactionHandler),
+            PerformanceEvents.HandleCodeResponse,
             this.logger,
             this.performanceClient,
             correlationId
-        )(hash, silentRequest);
+        )(serverParams, silentRequest);
     }
 }

package/src/interaction_client/StandardInteractionClient.ts

@@ -12,7 +12,6 @@ import {
     AuthorityOptions,
     Authority,
     AuthorityFactory,
-    ServerAuthorizationCodeResponse,
     UrlString,
     CommonEndSessionRequest,
     ProtocolUtils,
@@ -28,14 +27,7 @@ import { BaseInteractionClient } from "./BaseInteractionClient";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest";
 import { BrowserConstants, InteractionType } from "../utils/BrowserConstants";
 import { version } from "../packageMetadata";
-import {
-    createBrowserAuthError,
-    BrowserAuthErrorCodes,
-} from "../error/BrowserAuthError";
-import {
-    BrowserProtocolUtils,
-    BrowserStateObject,
-} from "../utils/BrowserProtocolUtils";
+import { BrowserStateObject } from "../utils/BrowserProtocolUtils";
 import { EndSessionRequest } from "../request/EndSessionRequest";
 import * as BrowserUtils from "../utils/BrowserUtils";
 import { RedirectRequest } from "../request/RedirectRequest";
@@ -57,7 +49,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
     ): Promise<CommonAuthorizationCodeRequest> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            request.correlationId
+            this.correlationId
         );
         const generatedPkceParams = await invokeAsync(
             generatePkceCodes,
@@ -294,44 +286,6 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         };
     }
 
-    /**
-     * @param hash
-     * @param interactionType
-     */
-    protected validateAndExtractStateFromHash(
-        serverParams: ServerAuthorizationCodeResponse,
-        interactionType: InteractionType,
-        requestCorrelationId?: string
-    ): string {
-        this.logger.verbose(
-            "validateAndExtractStateFromHash called",
-            requestCorrelationId
-        );
-        if (!serverParams.state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
-        }
-
-        const platformStateObj =
-            BrowserProtocolUtils.extractBrowserRequestState(
-                this.browserCrypto,
-                serverParams.state
-            );
-        if (!platformStateObj) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.unableToParseState
-            );
-        }
-
-        if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.stateInteractionTypeMismatch
-            );
-        }
-
-        this.logger.verbose("Returning state from hash", requestCorrelationId);
-        return serverParams.state;
-    }
-
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority

package/src/interaction_handler/InteractionHandler.ts

@@ -14,6 +14,7 @@ import {
     PerformanceEvents,
     invokeAsync,
     CcsCredentialType,
+    ServerAuthorizationCodeResponse,
 } from "@azure/msal-common";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager";
@@ -52,23 +53,19 @@ export class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponseFromHash(
-        locationHash: string,
+    async handleCodeResponse(
+        response: ServerAuthorizationCodeResponse,
         request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.HandleCodeResponseFromHash,
+            PerformanceEvents.HandleCodeResponse,
             request.correlationId
         );
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.hashEmptyError);
-        }
 
         let authCodeResponse;
         try {
             authCodeResponse = this.authModule.handleFragmentResponse(
-                locationHash,
+                response,
                 request.state
             );
         } catch (e) {