@azure/msal-browser 4.15.0 → 4.16.0

package/src/interaction_client/RedirectClient.ts

@@ -20,6 +20,7 @@ import {
     UrlUtils,
     InProgressPerformanceEvent,
     CommonAuthorizationUrlRequest,
+    HttpMethod,
 } from "@azure/msal-common/browser";
 import { StandardInteractionClient } from "./StandardInteractionClient.js";
 import {
@@ -194,41 +195,45 @@ export class RedirectClient extends StandardInteractionClient {
         );
 
         try {
-            // Initialize the client
-            const authClient: AuthorizationCodeClient = await invokeAsync(
-                this.createAuthCodeClient.bind(this),
-                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )({
-                serverTelemetryManager,
-                requestAuthority: redirectRequest.authority,
-                requestAzureCloudOptions: redirectRequest.azureCloudOptions,
-                requestExtraQueryParameters:
-                    redirectRequest.extraQueryParameters,
-                account: redirectRequest.account,
-            });
-
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(
-                this.config,
-                authClient.authority,
-                redirectRequest,
-                this.logger,
-                this.performanceClient
-            );
-            // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-            return await this.initiateAuthRequest(
-                navigateUrl,
-                onRedirectNavigate
-            );
+            if (redirectRequest.httpMethod === HttpMethod.POST) {
+                return await this.executeCodeFlowWithPost(redirectRequest);
+            } else {
+                // Initialize the client
+                const authClient: AuthorizationCodeClient = await invokeAsync(
+                    this.createAuthCodeClient.bind(this),
+                    PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                    this.logger,
+                    this.performanceClient,
+                    this.correlationId
+                )({
+                    serverTelemetryManager,
+                    requestAuthority: redirectRequest.authority,
+                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                    requestExtraQueryParameters:
+                        redirectRequest.extraQueryParameters,
+                    account: redirectRequest.account,
+                });
+
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    redirectRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+                // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
+                return await this.initiateAuthRequest(
+                    navigateUrl,
+                    onRedirectNavigate
+                );
+            }
         } catch (e) {
             if (e instanceof AuthError) {
                 e.setCorrelationId(this.correlationId);
@@ -294,6 +299,52 @@ export class RedirectClient extends StandardInteractionClient {
         });
     }
 
+    /**
+     * Executes classic Authorization Code flow with a POST request.
+     * @param request
+     */
+    async executeCodeFlowWithPost(
+        request: CommonAuthorizationUrlRequest
+    ): Promise<void> {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(
+            this.getDiscoveredAuthority.bind(this),
+            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+
+        this.browserStorage.cacheAuthorizeRequest(request);
+
+        const form = await Authorize.getCodeForm(
+            document,
+            this.config,
+            discoveredAuthority,
+            request,
+            this.logger,
+            this.performanceClient
+        );
+
+        form.submit();
+        return new Promise<void>((resolve, reject) => {
+            setTimeout(() => {
+                reject(
+                    createBrowserAuthError(
+                        BrowserAuthErrorCodes.timedOut,
+                        "failed_to_redirect"
+                    )
+                );
+            }, this.config.system.redirectNavigationTimeout);
+        });
+    }
+
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate

package/src/interaction_client/SilentIframeClient.ts

@@ -15,6 +15,7 @@ import {
     invoke,
     ProtocolMode,
     CommonAuthorizationUrlRequest,
+    HttpMethod,
 } from "@azure/msal-common/browser";
 import { StandardInteractionClient } from "./StandardInteractionClient.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
@@ -32,6 +33,7 @@ import {
 } from "../utils/BrowserConstants.js";
 import {
     initiateCodeRequest,
+    initiateCodeFlowWithPost,
     initiateEarRequest,
     monitorIframeForHash,
 } from "../interaction_handler/SilentHandler.js";
@@ -337,35 +339,54 @@ export class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        // Create authorize request url
-        const navigateUrl = await invokeAsync(
-            Authorize.getAuthCodeRequestUrl,
-            PerformanceEvents.GetAuthCodeUrl,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config,
-            authClient.authority,
-            silentRequest,
-            this.logger,
-            this.performanceClient
-        );
 
-        // Get the frame handle for the silent request
-        const msalFrame = await invokeAsync(
-            initiateCodeRequest,
-            PerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            navigateUrl,
-            this.performanceClient,
-            this.logger,
-            correlationId,
-            this.config.system.navigateFrameWait
-        );
+        let msalFrame: HTMLIFrameElement;
+
+        if (request.httpMethod === HttpMethod.POST) {
+            msalFrame = await invokeAsync(
+                initiateCodeFlowWithPost,
+                PerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config,
+                authClient.authority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+        } else {
+            // Create authorize request url
+            const navigateUrl = await invokeAsync(
+                Authorize.getAuthCodeRequestUrl,
+                PerformanceEvents.GetAuthCodeUrl,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config,
+                authClient.authority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+
+            // Get the frame handle for the silent request
+            msalFrame = await invokeAsync(
+                initiateCodeRequest,
+                PerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                navigateUrl,
+                this.performanceClient,
+                this.logger,
+                correlationId,
+                this.config.system.navigateFrameWait
+            );
+        }
 
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.

package/src/interaction_client/StandardInteractionClient.ts

@@ -34,7 +34,10 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
-import { initializeBaseRequest } from "../request/RequestHelpers.js";
+import {
+    initializeBaseRequest,
+    validateRequestMethod,
+} from "../request/RequestHelpers.js";
 
 /**
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
@@ -319,7 +322,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             this.logger
         );
 
-        const validatedRequest: CommonAuthorizationUrlRequest = {
+        const interactionRequest: CommonAuthorizationUrlRequest = {
             ...baseRequest,
             redirectUri: redirectUri,
             state: state,
@@ -328,6 +331,14 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 .serverResponseType as ResponseMode,
         };
 
+        const validatedRequest = {
+            ...interactionRequest,
+            httpMethod: validateRequestMethod(
+                interactionRequest,
+                this.config.auth.protocolMode
+            ),
+        };
+
         // Skip active account lookup if either login hint or session id is set
         if (request.loginHint || request.sid) {
             return validatedRequest;

package/src/interaction_handler/SilentHandler.ts

@@ -21,7 +21,7 @@ import {
     BrowserConfiguration,
     DEFAULT_IFRAME_TIMEOUT_MS,
 } from "../config/Configuration.js";
-import { getEARForm } from "../protocol/Authorize.js";
+import { getCodeForm, getEARForm } from "../protocol/Authorize.js";
 
 /**
  * Creates a hidden iframe to given URL using user-requested scopes as an id.
@@ -63,6 +63,29 @@ export async function initiateCodeRequest(
     )(requestUrl);
 }
 
+export async function initiateCodeFlowWithPost(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<HTMLIFrameElement> {
+    const frame = createHiddenIframe();
+    if (!frame.contentDocument) {
+        throw "No document associated with iframe!";
+    }
+    const form = await getCodeForm(
+        frame.contentDocument,
+        config,
+        authority,
+        request,
+        logger,
+        performanceClient
+    );
+    form.submit();
+    return frame;
+}
+
 export async function initiateEarRequest(
     config: BrowserConfiguration,
     authority: Authority,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.15.0";
+export const version = "4.16.0";

package/src/protocol/Authorize.ts

@@ -210,6 +210,54 @@ export async function getEARForm(
     return createForm(frame, url, parameters);
 }
 
+/**
+ * Gets the form that will be posted to /authorize with request parameters when using POST method
+ */
+export async function getCodeForm(
+    frame: Document,
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<HTMLFormElement> {
+    const parameters = await getStandardParameters(
+        config,
+        authority,
+        request,
+        logger,
+        performanceClient
+    );
+
+    RequestParameterBuilder.addResponseType(parameters, OAuthResponseType.CODE);
+
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
+    RequestParameterBuilder.addPostBodyParameters(
+        parameters,
+        request.authorizePostBodyParameters || {}
+    );
+
+    const queryParams = new Map<string, string>();
+    RequestParameterBuilder.addExtraQueryParameters(
+        queryParams,
+        request.extraQueryParameters || {}
+    );
+
+    const url = AuthorizeProtocol.getAuthorizeUrl(
+        authority,
+        queryParams,
+        config.auth.encodeExtraQueryParams,
+        request.extraQueryParameters
+    );
+
+    return createForm(frame, url, parameters);
+}
+
 /**
  * Creates form element in the provided document with auth parameters in the post body
  * @param frame

package/src/request/RequestHelpers.ts

@@ -9,9 +9,11 @@ import {
     BaseAuthRequest,
     ClientConfigurationErrorCodes,
     CommonSilentFlowRequest,
+    HttpMethod,
     IPerformanceClient,
     Logger,
     PerformanceEvents,
+    ProtocolMode,
     StringUtils,
     createClientConfigurationError,
     invokeAsync,
@@ -19,6 +21,8 @@ import {
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { SilentRequest } from "./SilentRequest.js";
 import { hashString } from "../crypto/BrowserCrypto.js";
+import { PopupRequest } from "./PopupRequest.js";
+import { RedirectRequest } from "./RedirectRequest.js";
 
 /**
  * Initializer function for all request APIs
@@ -110,3 +114,44 @@ export async function initializeSilentRequest(
         forceRefresh: request.forceRefresh || false,
     };
 }
+
+/**
+ * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
+ * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
+ * @param interactionRequest
+ * @param protocolMode
+ * @returns
+ */
+export function validateRequestMethod(
+    interactionRequest: BaseAuthRequest | PopupRequest | RedirectRequest,
+    protocolMode: ProtocolMode
+): HttpMethod {
+    let httpMethod: HttpMethod | undefined;
+    const requestMethod = interactionRequest.httpMethod;
+
+    if (protocolMode === ProtocolMode.EAR) {
+        // Don't override httpMethod if it is already set, default to POST if not set
+        httpMethod = requestMethod || HttpMethod.POST;
+        // Validate that method is not GET if protocol mode is EAR
+        if (httpMethod !== HttpMethod.POST) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.invalidRequestMethodForEAR
+            );
+        }
+    } else {
+        // For non-EAR protocol modes, default to GET if httpMethod is not set
+        httpMethod = requestMethod || HttpMethod.GET;
+    }
+
+    // Regardless of protocolMode, if there are authorizePostBodyParameters, validate the request method is POST
+    if (
+        interactionRequest.authorizePostBodyParameters &&
+        httpMethod !== HttpMethod.POST
+    ) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.invalidAuthorizePostBodyParameters
+        );
+    }
+
+    return httpMethod;
+}