@azure/msal-browser 4.25.1 → 4.26.1

package/src/cache/CacheKeys.ts

@@ -5,9 +5,9 @@
 
 export const PREFIX = "msal";
 const BROWSER_PREFIX = "browser";
-export const CACHE_KEY_SEPARATOR = "-";
-export const CREDENTIAL_SCHEMA_VERSION = 1;
-export const ACCOUNT_SCHEMA_VERSION = 1;
+export const CACHE_KEY_SEPARATOR = "|";
+export const CREDENTIAL_SCHEMA_VERSION = 2;
+export const ACCOUNT_SCHEMA_VERSION = 2;
 
 export const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 export const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;

package/src/cache/IWindowStorage.ts

@@ -35,7 +35,8 @@ export interface IWindowStorage<T> {
         key: string,
         value: T,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void>;
 
     /**

package/src/cache/LocalStorage.ts

@@ -205,7 +205,10 @@ export class LocalStorage implements IWindowStorage<string> {
         }
 
         try {
-            return JSON.parse(decryptedData);
+            return {
+                ...JSON.parse(decryptedData),
+                lastUpdatedAt: data.lastUpdatedAt,
+            };
         } catch (e) {
             this.performanceClient.incrementFields(
                 { encryptedCacheCorruptionCount: 1 },
@@ -223,7 +226,8 @@ export class LocalStorage implements IWindowStorage<string> {
         key: string,
         value: string,
         correlationId: string,
-        timestamp: string
+        timestamp: string,
+        kmsi: boolean
     ): Promise<void> {
         if (!this.initialized || !this.encryptionCookie) {
             throw createBrowserAuthError(
@@ -231,22 +235,26 @@ export class LocalStorage implements IWindowStorage<string> {
             );
         }
 
-        const { data, nonce } = await invokeAsync(
-            encrypt,
-            PerformanceEvents.Encrypt,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(this.encryptionCookie.key, value, this.getContext(key));
-        const encryptedData: EncryptedData = {
-            id: this.encryptionCookie.id,
-            nonce: nonce,
-            data: data,
-            lastUpdatedAt: timestamp,
-        };
+        if (kmsi) {
+            this.setItem(key, value);
+        } else {
+            const { data, nonce } = await invokeAsync(
+                encrypt,
+                PerformanceEvents.Encrypt,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(this.encryptionCookie.key, value, this.getContext(key));
+            const encryptedData: EncryptedData = {
+                id: this.encryptionCookie.id,
+                nonce: nonce,
+                data: data,
+                lastUpdatedAt: timestamp,
+            };
+            this.setItem(key, JSON.stringify(encryptedData));
+        }
 
         this.memoryStorage.setItem(key, value);
-        this.setItem(key, JSON.stringify(encryptedData));
 
         // Notify other frames to update their in-memory cache
         this.broadcast.postMessage({
@@ -382,7 +390,7 @@ export class LocalStorage implements IWindowStorage<string> {
                 { unencryptedCacheCount: 1 },
                 correlationId
             );
-            return encObj;
+            return rawCache;
         }
 
         if (encObj.id !== this.encryptionCookie.id) {
@@ -394,6 +402,11 @@ export class LocalStorage implements IWindowStorage<string> {
             return null;
         }
 
+        this.performanceClient.incrementFields(
+            { encryptedCacheCount: 1 },
+            correlationId
+        );
+
         return invokeAsync(
             decrypt,
             PerformanceEvents.Decrypt,

package/src/cache/TokenCache.ts

@@ -93,6 +93,7 @@ export class TokenCache implements ITokenCache {
         const idTokenClaims = response.id_token
             ? AuthToken.extractTokenClaims(response.id_token, base64Decode)
             : undefined;
+        const kmsi = AuthToken.isKmsi(idTokenClaims || {});
 
         const authorityOptions: AuthorityOptions = {
             protocolMode: this.config.auth.protocolMode,
@@ -129,7 +130,8 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         const accessToken = await this.loadAccessToken(
@@ -139,14 +141,16 @@ export class TokenCache implements ITokenCache {
             cacheRecordAccount.environment,
             cacheRecordAccount.realm,
             options,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         const refreshToken = await this.loadRefreshToken(
             response,
             cacheRecordAccount.homeAccountId,
             cacheRecordAccount.environment,
-            correlationId
+            correlationId,
+            kmsi
         );
 
         return this.generateAuthenticationResult(
@@ -184,7 +188,11 @@ export class TokenCache implements ITokenCache {
             const accountEntity = AccountEntity.createFromAccountInfo(
                 request.account
             );
-            await this.storage.setAccount(accountEntity, correlationId);
+            await this.storage.setAccount(
+                accountEntity,
+                correlationId,
+                AuthToken.isKmsi(idTokenClaims || {})
+            );
             return accountEntity;
         } else if (!authority || (!clientInfo && !idTokenClaims)) {
             this.logger.error(
@@ -220,7 +228,11 @@ export class TokenCache implements ITokenCache {
             this.logger
         );
 
-        await this.storage.setAccount(cachedAccount, correlationId);
+        await this.storage.setAccount(
+            cachedAccount,
+            correlationId,
+            AuthToken.isKmsi(idTokenClaims || {})
+        );
         return cachedAccount;
     }
 
@@ -237,7 +249,8 @@ export class TokenCache implements ITokenCache {
         homeAccountId: string,
         environment: string,
         tenantId: string,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<IdTokenEntity | null> {
         if (!response.id_token) {
             this.logger.verbose("TokenCache - no id token found in response");
@@ -253,7 +266,11 @@ export class TokenCache implements ITokenCache {
             tenantId
         );
 
-        await this.storage.setIdTokenCredential(idTokenEntity, correlationId);
+        await this.storage.setIdTokenCredential(
+            idTokenEntity,
+            correlationId,
+            kmsi
+        );
         return idTokenEntity;
     }
 
@@ -273,7 +290,8 @@ export class TokenCache implements ITokenCache {
         environment: string,
         tenantId: string,
         options: LoadTokenOptions,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<AccessTokenEntity | null> {
         if (!response.access_token) {
             this.logger.verbose(
@@ -322,7 +340,8 @@ export class TokenCache implements ITokenCache {
 
         await this.storage.setAccessTokenCredential(
             accessTokenEntity,
-            correlationId
+            correlationId,
+            kmsi
         );
         return accessTokenEntity;
     }
@@ -339,7 +358,8 @@ export class TokenCache implements ITokenCache {
         response: ExternalTokenResponse,
         homeAccountId: string,
         environment: string,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<RefreshTokenEntity | null> {
         if (!response.refresh_token) {
             this.logger.verbose(
@@ -361,7 +381,8 @@ export class TokenCache implements ITokenCache {
 
         await this.storage.setRefreshTokenCredential(
             refreshTokenEntity,
-            correlationId
+            correlationId,
+            kmsi
         );
         return refreshTokenEntity;
     }
@@ -406,7 +427,7 @@ export class TokenCache implements ITokenCache {
             uniqueId: cacheRecord.account.localAccountId,
             tenantId: cacheRecord.account.realm,
             scopes: responseScopes,
-            account: accountEntity.getAccountInfo(),
+            account: AccountEntity.getAccountInfo(accountEntity),
             idToken: cacheRecord.idToken?.secret || "",
             idTokenClaims: idTokenClaims || {},
             accessToken: accessToken,

package/src/controllers/NestedAppAuthController.ts

@@ -20,6 +20,7 @@ import {
     BaseAuthRequest,
     AccountFilter,
     AuthError,
+    AuthToken,
 } from "@azure/msal-common/browser";
 import { ITokenCache } from "../cache/ITokenCache.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
@@ -937,7 +938,8 @@ export class NestedAppAuthController implements IController {
         );
         await this.browserStorage.setAccount(
             accountEntity,
-            result.correlationId
+            result.correlationId,
+            AuthToken.isKmsi(result.idTokenClaims)
         );
         return this.browserStorage.hydrateCache(result, request);
     }

package/src/controllers/StandardController.ts

@@ -30,6 +30,7 @@ import {
     buildStaticAuthorityOptions,
     InteractionRequiredAuthErrorCodes,
     PkceCodes,
+    AuthToken,
 } from "@azure/msal-common/browser";
 import {
     BrowserCacheManager,
@@ -1624,7 +1625,8 @@ export class StandardController implements IController {
         );
         await this.browserStorage.setAccount(
             accountEntity,
-            result.correlationId
+            result.correlationId,
+            AuthToken.isKmsi(result.idTokenClaims)
         );
 
         if (result.fromNativeBroker) {

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -534,7 +534,11 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         );
 
         // cache accounts and tokens in the appropriate storage
-        await this.cacheAccount(baseAccount, this.correlationId);
+        await this.cacheAccount(
+            baseAccount,
+            this.correlationId,
+            AuthToken.isKmsi(idTokenClaims)
+        );
         await this.cacheNativeTokens(
             response,
             request,
@@ -677,7 +681,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             Constants.EMPTY_STRING;
 
         const accountInfo: AccountInfo | null = updateAccountTenantProfileData(
-            accountEntity.getAccountInfo(),
+            AccountEntity.getAccountInfo(accountEntity),
             undefined, // tenantProfile optional
             idTokenClaims,
             response.id_token
@@ -730,13 +734,18 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     async cacheAccount(
         accountEntity: AccountEntity,
-        correlationId: string
+        correlationId: string,
+        kmsi: boolean
     ): Promise<void> {
         // Store the account info and hence `nativeAccountId` in browser cache
-        await this.browserStorage.setAccount(accountEntity, this.correlationId);
+        await this.browserStorage.setAccount(
+            accountEntity,
+            this.correlationId,
+            kmsi
+        );
         // Remove any existing cached tokens for this account in browser storage
         this.browserStorage.removeAccountContext(
-            accountEntity.getAccountInfo(),
+            AccountEntity.getAccountInfo(accountEntity),
             correlationId
         );
     }
@@ -807,6 +816,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         return this.nativeStorageManager.saveCacheRecord(
             nativeCacheRecord,
             this.correlationId,
+            AuthToken.isKmsi(idTokenClaims),
             request.storeInCache
         );
     }

package/src/interaction_handler/SilentHandler.ts

@@ -256,6 +256,7 @@ function createHiddenIframe(): HTMLIFrameElement {
         "sandbox",
         "allow-scripts allow-same-origin allow-forms"
     );
+    authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
 
     return authFrame;

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.25.1";
+export const version = "4.26.1";