@azure/msal-browser 4.26.0 → 4.26.2

package/src/custom_auth/core/auth_flow/mfa/state/MfaState.ts

@@ -31,7 +31,6 @@ abstract class MfaState<
      * Requests an MFA challenge for a specific authentication method.
      * @param authMethodId The authentication method ID to use for the challenge.
      * @returns Promise that resolves to MfaRequestChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async requestChallenge(
         authMethodId: string
@@ -101,7 +100,6 @@ export class MfaAwaitingState extends MfaState<MfaAwaitingStateParameters> {
     /**
      * Gets the available authentication methods for MFA.
      * @returns Array of available authentication methods.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getAuthMethods(): AuthenticationMethod[] {
         return this.stateParameters.authMethods;
@@ -121,7 +119,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the length of the code that the user needs to provide.
      * @returns The expected code length.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getCodeLength(): number {
         return this.stateParameters.codeLength;
@@ -130,7 +127,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the channel through which the challenge was sent.
      * @returns The challenge channel (e.g., "email").
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getChannel(): string {
         return this.stateParameters.challengeChannel;
@@ -139,7 +135,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the target label indicating where the challenge was sent.
      * @returns The challenge target label (e.g., masked email address).
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getSentTo(): string {
         return this.stateParameters.challengeTargetLabel;
@@ -149,7 +144,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
      * Submits the MFA challenge (e.g., OTP code) to complete the authentication.
      * @param challenge The challenge code (e.g., OTP code) entered by the user.
      * @returns Promise that resolves to MfaSubmitChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async submitChallenge(
         challenge: string

package/src/custom_auth/sign_in/auth_flow/result/SignInResult.ts

@@ -83,7 +83,6 @@ export class SignInResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -96,7 +95,6 @@ export class SignInResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInResult & { state: MfaAwaitingState } {
         return this.state.stateType === MFA_AWAITING_STATE_TYPE;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitCodeResult.ts

@@ -57,7 +57,6 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInSubmitCodeResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -70,7 +69,6 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInSubmitCodeResult & {
         state: MfaAwaitingState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitPasswordResult.ts

@@ -54,7 +54,6 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInSubmitPasswordResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -67,7 +66,6 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInSubmitPasswordResult & {
         state: MfaAwaitingState;

package/src/interaction_client/PopupClient.ts

@@ -243,7 +243,7 @@ export class PopupClient extends StandardInteractionClient {
         validRequest.platformBroker = isPlatformBroker;
 
         if (this.config.auth.protocolMode === ProtocolMode.EAR) {
-            return this.executeEarFlow(validRequest, popupParams);
+            return this.executeEarFlow(validRequest, popupParams, pkceCodes);
         } else {
             return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
         }
@@ -389,7 +389,8 @@ export class PopupClient extends StandardInteractionClient {
      */
     async executeEarFlow(
         request: CommonAuthorizationUrlRequest,
-        popupParams: PopupParams
+        popupParams: PopupParams,
+        pkceCodes?: PkceCodes
     ): Promise<AuthenticationResult> {
         const correlationId = request.correlationId;
         // Get the frame handle for the silent request
@@ -413,9 +414,20 @@ export class PopupClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkce =
+            pkceCodes ||
+            (await invokeAsync(
+                generatePkceCodes,
+                PerformanceEvents.GeneratePkceCodes,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(this.performanceClient, this.logger, correlationId));
+
         const popupRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkce.challenge,
         };
         const popupWindow =
             popupParams.popup || this.openPopup("about:blank", popupParams);
@@ -451,25 +463,65 @@ export class PopupClient extends StandardInteractionClient {
             this.logger
         );
 
-        return invokeAsync(
-            Authorize.handleResponseEAR,
-            PerformanceEvents.HandleResponseEar,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            popupRequest,
-            serverParams,
-            ApiId.acquireTokenPopup,
-            this.config,
-            discoveredAuthority,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        if (!serverParams.ear_jwe && serverParams.code) {
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )({
+                serverTelemetryManager: this.initializeServerTelemetryManager(
+                    ApiId.acquireTokenPopup
+                ),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+
+            return invokeAsync(
+                Authorize.handleResponseCode,
+                PerformanceEvents.HandleResponseCode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                popupRequest,
+                serverParams,
+                pkce.verifier,
+                ApiId.acquireTokenPopup,
+                this.config,
+                authClient,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        } else {
+            return invokeAsync(
+                Authorize.handleResponseEAR,
+                PerformanceEvents.HandleResponseEar,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                popupRequest,
+                serverParams,
+                ApiId.acquireTokenPopup,
+                this.config,
+                discoveredAuthority,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        }
     }
 
     async executeCodeFlowWithPost(

package/src/interaction_client/RedirectClient.ts

@@ -272,11 +272,24 @@ export class RedirectClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
+
         const redirectRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
-        this.browserStorage.cacheAuthorizeRequest(redirectRequest);
+
+        this.browserStorage.cacheAuthorizeRequest(
+            redirectRequest,
+            pkceCodes.verifier
+        );
 
         const form = await Authorize.getEARForm(
             document,

package/src/interaction_client/SilentIframeClient.ts

@@ -235,9 +235,17 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
         const msalFrame = await invokeAsync(
             initiateEarRequest,
@@ -279,25 +287,66 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId
         )(responseString, responseType, this.logger);
 
-        return invokeAsync(
-            Authorize.handleResponseEAR,
-            PerformanceEvents.HandleResponseEar,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            silentRequest,
-            serverParams,
-            this.apiId,
-            this.config,
-            discoveredAuthority,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        if (!serverParams.ear_jwe && serverParams.code) {
+            // If server doesn't support EAR, they may fallback to auth code flow instead
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )({
+                serverTelemetryManager: this.initializeServerTelemetryManager(
+                    this.apiId
+                ),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+
+            return invokeAsync(
+                Authorize.handleResponseCode,
+                PerformanceEvents.HandleResponseCode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                pkceCodes.verifier,
+                this.apiId,
+                this.config,
+                authClient,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        } else {
+            return invokeAsync(
+                Authorize.handleResponseEAR,
+                PerformanceEvents.HandleResponseEar,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                this.apiId,
+                this.config,
+                discoveredAuthority,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        }
     }
 
     /**

package/src/interaction_client/StandardInteractionClient.ts

@@ -20,6 +20,7 @@ import {
     BaseAuthRequest,
     StringDict,
     CommonAuthorizationUrlRequest,
+    Authority,
 } from "@azure/msal-common/browser";
 import { BaseInteractionClient } from "./BaseInteractionClient.js";
 import {
@@ -186,6 +187,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         requestAzureCloudOptions?: AzureCloudOptions;
         requestExtraQueryParameters?: StringDict;
         account?: AccountInfo;
+        authority?: Authority;
     }): Promise<AuthorizationCodeClient> {
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
@@ -222,6 +224,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         requestAzureCloudOptions?: AzureCloudOptions;
         requestExtraQueryParameters?: StringDict;
         account?: AccountInfo;
+        authority?: Authority;
     }): Promise<ClientConfiguration> {
         const {
             serverTelemetryManager,
@@ -235,18 +238,20 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             PerformanceEvents.StandardInteractionClientGetClientConfiguration,
             this.correlationId
         );
-        const discoveredAuthority = await invokeAsync(
-            this.getDiscoveredAuthority.bind(this),
-            PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )({
-            requestAuthority,
-            requestAzureCloudOptions,
-            requestExtraQueryParameters,
-            account,
-        });
+        const discoveredAuthority =
+            params.authority ||
+            (await invokeAsync(
+                this.getDiscoveredAuthority.bind(this),
+                PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )({
+                requestAuthority,
+                requestAzureCloudOptions,
+                requestExtraQueryParameters,
+                account,
+            }));
         const logger = this.config.system.loggerOptions;
 
         return {

package/src/interaction_handler/SilentHandler.ts

@@ -256,6 +256,7 @@ function createHiddenIframe(): HTMLIFrameElement {
         "sandbox",
         "allow-scripts allow-same-origin allow-forms"
     );
+    authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
 
     return authFrame;

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.26.0";
+export const version = "4.26.2";

package/src/protocol/Authorize.ts

@@ -203,6 +203,13 @@ export async function getEARForm(
     );
     RequestParameterBuilder.addEARParameters(parameters, request.earJwk);
 
+    // Also add codeChallenge as backup in case EAR is not supported
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
     const queryParams = new Map<string, string>();
     RequestParameterBuilder.addExtraQueryParameters(
         queryParams,