@azure/msal-browser 4.27.0 → 5.0.0-beta.0

package/src/interaction_handler/SilentHandler.ts

@@ -6,21 +6,16 @@
 import {
     Logger,
     IPerformanceClient,
-    PerformanceEvents,
-    invokeAsync,
     invoke,
-    ServerResponseType,
     Authority,
     CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
-import {
-    BrowserConfiguration,
-    DEFAULT_IFRAME_TIMEOUT_MS,
-} from "../config/Configuration.js";
+import { BrowserConfiguration } from "../config/Configuration.js";
 import { getCodeForm, getEARForm } from "../protocol/Authorize.js";
 
 /**
@@ -32,31 +27,17 @@ export async function initiateCodeRequest(
     requestUrl: string,
     performanceClient: IPerformanceClient,
     logger: Logger,
-    correlationId: string,
-    navigateFrameWait?: number
+    correlationId: string
 ): Promise<HTMLIFrameElement> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.SilentHandlerInitiateAuthRequest,
-        correlationId
-    );
-
     if (!requestUrl) {
         // Throw error if request URL is empty.
-        logger.info("Navigate url is empty");
+        logger.info("Navigate url is empty", correlationId);
         throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
     }
-    if (navigateFrameWait) {
-        return invokeAsync(
-            loadFrame,
-            PerformanceEvents.SilentHandlerLoadFrame,
-            logger,
-            performanceClient,
-            correlationId
-        )(requestUrl, navigateFrameWait, performanceClient, correlationId);
-    }
+
     return invoke(
         loadFrameSync,
-        PerformanceEvents.SilentHandlerLoadFrameSync,
+        BrowserPerformanceEvents.SilentHandlerLoadFrameSync,
         logger,
         performanceClient,
         correlationId
@@ -109,121 +90,6 @@ export async function initiateEarRequest(
     return frame;
 }
 
-/**
- * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
- * @param iframe
- * @param timeout
- */
-export async function monitorIframeForHash(
-    iframe: HTMLIFrameElement,
-    timeout: number,
-    pollIntervalMilliseconds: number,
-    performanceClient: IPerformanceClient,
-    logger: Logger,
-    correlationId: string,
-    responseType: ServerResponseType
-): Promise<string> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.SilentHandlerMonitorIframeForHash,
-        correlationId
-    );
-
-    return new Promise<string>((resolve, reject) => {
-        if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
-            logger.warning(
-                `system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`
-            );
-        }
-
-        /*
-         * Polling for iframes can be purely timing based,
-         * since we don't need to account for interaction.
-         */
-        const timeoutId = window.setTimeout(() => {
-            window.clearInterval(intervalId);
-            reject(
-                createBrowserAuthError(
-                    BrowserAuthErrorCodes.monitorWindowTimeout
-                )
-            );
-        }, timeout);
-
-        const intervalId = window.setInterval(() => {
-            let href: string = "";
-            const contentWindow = iframe.contentWindow;
-            try {
-                /*
-                 * Will throw if cross origin,
-                 * which should be caught and ignored
-                 * since we need the interval to keep running while on STS UI.
-                 */
-                href = contentWindow ? contentWindow.location.href : "";
-            } catch (e) {}
-
-            if (!href || href === "about:blank") {
-                return;
-            }
-
-            let responseString = "";
-            if (contentWindow) {
-                if (responseType === ServerResponseType.QUERY) {
-                    responseString = contentWindow.location.search;
-                } else {
-                    responseString = contentWindow.location.hash;
-                }
-            }
-            window.clearTimeout(timeoutId);
-            window.clearInterval(intervalId);
-            resolve(responseString);
-        }, pollIntervalMilliseconds);
-    }).finally(() => {
-        invoke(
-            removeHiddenIframe,
-            PerformanceEvents.RemoveHiddenIframe,
-            logger,
-            performanceClient,
-            correlationId
-        )(iframe);
-    });
-}
-
-/**
- * @hidden
- * Loads iframe with authorization endpoint URL
- * @ignore
- * @deprecated
- */
-function loadFrame(
-    urlNavigate: string,
-    navigateFrameWait: number,
-    performanceClient: IPerformanceClient,
-    correlationId: string
-): Promise<HTMLIFrameElement> {
-    performanceClient.addQueueMeasurement(
-        PerformanceEvents.SilentHandlerLoadFrame,
-        correlationId
-    );
-
-    /*
-     * This trick overcomes iframe navigation in IE
-     * IE does not load the page consistently in iframe
-     */
-
-    return new Promise((resolve, reject) => {
-        const frameHandle = createHiddenIframe();
-
-        window.setTimeout(() => {
-            if (!frameHandle) {
-                reject("Unable to load iframe");
-                return;
-            }
-
-            frameHandle.src = urlNavigate;
-
-            resolve(frameHandle);
-        }, navigateFrameWait);
-    });
-}
 /**
  * @hidden
  * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
@@ -261,14 +127,3 @@ function createHiddenIframe(): HTMLIFrameElement {
 
     return authFrame;
 }
-
-/**
- * @hidden
- * Removes a hidden iframe from the page.
- * @ignore
- */
-function removeHiddenIframe(iframe: HTMLIFrameElement): void {
-    if (document.body === iframe.parentNode) {
-        document.body.removeChild(iframe);
-    }
-}

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -19,17 +19,16 @@ import {
     AuthToken,
     TokenClaims,
     ClientAuthErrorCodes,
-    AuthenticationScheme,
     RequestParameterBuilder,
     StringUtils,
     createClientAuthError,
-    OIDC_DEFAULT_SCOPES,
     AccountInfo,
     IdTokenEntity,
     AccessTokenEntity,
     TenantProfile,
     buildTenantProfile,
     TimeUtils,
+    Constants,
 } from "@azure/msal-common/browser";
 import { isBridgeError } from "../BridgeError.js";
 import { BridgeStatusCode } from "../BridgeStatusCode.js";
@@ -79,7 +78,7 @@ export class NestedAppAuthAdapter {
             request.claims,
             this.clientCapabilities
         );
-        const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
+        const scopes = request.scopes || Constants.OIDC_DEFAULT_SCOPES;
         const tokenRequest: TokenRequest = {
             platformBrokerId: request.account?.homeAccountId,
             clientId: this.clientId,
@@ -89,7 +88,8 @@ export class NestedAppAuthAdapter {
             claims: !StringUtils.isEmptyObj(claims) ? claims : undefined,
             state: request.state,
             authenticationScheme:
-                request.authenticationScheme || AuthenticationScheme.BEARER,
+                request.authenticationScheme ||
+                Constants.AuthenticationScheme.BEARER,
             extraParameters: extraParams,
         };
 
@@ -132,7 +132,8 @@ export class NestedAppAuthAdapter {
             fromCache: false,
             expiresOn: expiresOn,
             tokenType:
-                request.authenticationScheme || AuthenticationScheme.BEARER,
+                request.authenticationScheme ||
+                Constants.AuthenticationScheme.BEARER,
             correlationId: request.correlationId,
             extExpiresOn: expiresOn,
             state: request.state,
@@ -314,7 +315,8 @@ export class NestedAppAuthAdapter {
                 accessToken.extendedExpiresOn
             ),
             tokenType:
-                request.authenticationScheme || AuthenticationScheme.BEARER,
+                request.authenticationScheme ||
+                Constants.AuthenticationScheme.BEARER,
             correlationId,
             state: request.state,
         };

package/src/operatingcontext/BaseOperatingContext.ts

@@ -107,8 +107,9 @@ export abstract class BaseOperatingContext {
 
     /**
      * returns a boolean indicating whether this operating context is present
+     * @param correlationId
      */
-    abstract initialize(): Promise<boolean>;
+    abstract initialize(correlationId: string): Promise<boolean>;
 
     /**
      * Return the MSAL config

package/src/operatingcontext/NestedAppOperatingContext.ts

@@ -57,9 +57,10 @@ export class NestedAppOperatingContext extends BaseOperatingContext {
     /**
      * Checks whether the operating context is available.
      * Confirms that the code is running a browser rather.  This is required.
+     * @param correlationId
      * @returns Promise<boolean> indicating whether this operating context is currently available.
      */
-    async initialize(): Promise<boolean> {
+    async initialize(correlationId: string): Promise<boolean> {
         try {
             if (typeof window !== "undefined") {
                 if (typeof window.__initializeNestedAppAuth === "function") {
@@ -78,11 +79,15 @@ export class NestedAppOperatingContext extends BaseOperatingContext {
             }
         } catch (ex) {
             this.logger.infoPii(
-                `Could not initialize Nested App Auth bridge (${ex})`
+                `Could not initialize Nested App Auth bridge ('${ex}')`,
+                correlationId
             );
         }
 
-        this.logger.info(`Nested App Auth Bridge available: ${this.available}`);
+        this.logger.info(
+            `Nested App Auth Bridge available: '${this.available}'`,
+            correlationId
+        );
         return this.available;
     }
 }

package/src/operatingcontext/StandardOperatingContext.ts

@@ -39,7 +39,8 @@ export class StandardOperatingContext extends BaseOperatingContext {
      * Confirms that the code is running a browser rather.  This is required.
      * @returns Promise<boolean> indicating whether this operating context is currently available.
      */
-    async initialize(): Promise<boolean> {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    async initialize(correlationId: string): Promise<boolean> {
         this.available = typeof window !== "undefined";
         return this.available;
         /*

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.27.0";
+export const version = "5.0.0-beta.0";

package/src/protocol/Authorize.ts

@@ -4,7 +4,6 @@
  */
 
 import {
-    AuthenticationScheme,
     Authority,
     AuthorizeProtocol,
     ClientConfigurationErrorCodes,
@@ -17,8 +16,6 @@ import {
     PopTokenGenerator,
     ProtocolMode,
     RequestParameterBuilder,
-    OAuthResponseType,
-    Constants,
     CommonAuthorizationCodeRequest,
     AuthorizationCodeClient,
     ProtocolUtils,
@@ -28,7 +25,9 @@ import {
     TimeUtils,
     AuthorizationCodePayload,
     ServerAuthorizationTokenResponse,
+    Constants,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { ApiId, BrowserConstants } from "../utils/BrowserConstants.js";
 import { version } from "../packageMetadata.js";
@@ -73,7 +72,7 @@ async function getStandardParameters(
         os: "",
         cpu: "",
     });
-    if (config.auth.protocolMode !== ProtocolMode.OIDC) {
+    if (config.system.protocolMode !== ProtocolMode.OIDC) {
         RequestParameterBuilder.addApplicationTelemetry(
             parameters,
             config.telemetry.application
@@ -84,18 +83,15 @@ async function getStandardParameters(
         // signal ests that this is a WAM call
         RequestParameterBuilder.addNativeBroker(parameters);
 
-        // instrument JS-platform bridge specific fields
-        performanceClient.addFields(
-            {
-                isPlatformAuthorizeRequest: true,
-            },
-            request.correlationId
-        );
-
         // pass the req_cnf for POP
-        if (request.authenticationScheme === AuthenticationScheme.POP) {
+        if (
+            request.authenticationScheme === Constants.AuthenticationScheme.POP
+        ) {
             const cryptoOps = new CryptoOps(logger, performanceClient);
-            const popTokenGenerator = new PopTokenGenerator(cryptoOps);
+            const popTokenGenerator = new PopTokenGenerator(
+                cryptoOps,
+                performanceClient
+            );
 
             // req_cnf is always sent as a string for SPAs
             let reqCnfData;
@@ -148,12 +144,15 @@ export async function getAuthCodeRequestUrl(
 
     const parameters = await invokeAsync(
         getStandardParameters,
-        PerformanceEvents.GetStandardParams,
+        BrowserPerformanceEvents.GetStandardParams,
         logger,
         performanceClient,
         request.correlationId
     )(config, authority, request, logger, performanceClient);
-    RequestParameterBuilder.addResponseType(parameters, OAuthResponseType.CODE);
+    RequestParameterBuilder.addResponseType(
+        parameters,
+        Constants.OAuthResponseType.CODE
+    );
 
     RequestParameterBuilder.addCodeChallengeParams(
         parameters,
@@ -161,17 +160,13 @@ export async function getAuthCodeRequestUrl(
         Constants.S256_CODE_CHALLENGE_METHOD
     );
 
-    RequestParameterBuilder.addExtraQueryParameters(
-        parameters,
-        request.extraQueryParameters || {}
-    );
+    // Merge extraQueryParameters and extraParameters to be appended to request URL
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraQueryParameters,
+        ...request.extraParameters,
+    });
 
-    return AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        parameters,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
+    return AuthorizeProtocol.getAuthorizeUrl(authority, parameters);
 }
 
 /**
@@ -199,7 +194,7 @@ export async function getEARForm(
 
     RequestParameterBuilder.addResponseType(
         parameters,
-        OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN
+        Constants.OAuthResponseType.IDTOKEN_TOKEN_REFRESHTOKEN
     );
     RequestParameterBuilder.addEARParameters(parameters, request.earJwk);
 
@@ -210,17 +205,16 @@ export async function getEARForm(
         Constants.S256_CODE_CHALLENGE_METHOD
     );
 
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraParameters,
+    });
+
     const queryParams = new Map<string, string>();
-    RequestParameterBuilder.addExtraQueryParameters(
+    RequestParameterBuilder.addExtraParameters(
         queryParams,
         request.extraQueryParameters || {}
     );
-    const url = AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        queryParams,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
+    const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
 }
@@ -244,7 +238,10 @@ export async function getCodeForm(
         performanceClient
     );
 
-    RequestParameterBuilder.addResponseType(parameters, OAuthResponseType.CODE);
+    RequestParameterBuilder.addResponseType(
+        parameters,
+        Constants.OAuthResponseType.CODE
+    );
 
     RequestParameterBuilder.addCodeChallengeParams(
         parameters,
@@ -252,23 +249,19 @@ export async function getCodeForm(
         request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD
     );
 
-    RequestParameterBuilder.addPostBodyParameters(
-        parameters,
-        request.authorizePostBodyParameters || {}
-    );
+    // Add extraParameters to the request body
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraParameters,
+    });
 
+    // Add extraQueryParameters to be appended to request URL
     const queryParams = new Map<string, string>();
-    RequestParameterBuilder.addExtraQueryParameters(
+    RequestParameterBuilder.addExtraParameters(
         queryParams,
         request.extraQueryParameters || {}
     );
 
-    const url = AuthorizeProtocol.getAuthorizeUrl(
-        authority,
-        queryParams,
-        config.auth.encodeExtraQueryParams,
-        request.extraQueryParameters
-    );
+    const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
 }
@@ -328,7 +321,10 @@ export async function handleResponsePlatformBroker(
     performanceClient: IPerformanceClient,
     platformAuthProvider?: IPlatformAuthHandler
 ): Promise<AuthenticationResult> {
-    logger.verbose("Account id found, calling WAM for token");
+    logger.verbose(
+        "Account id found, calling WAM for token",
+        request.correlationId
+    );
 
     if (!platformAuthProvider) {
         throw createBrowserAuthError(
@@ -351,12 +347,12 @@ export async function handleResponsePlatformBroker(
         request.correlationId
     );
     const { userRequestState } = ProtocolUtils.parseRequestState(
-        browserCrypto,
+        browserCrypto.base64Decode,
         request.state
     );
     return invokeAsync(
         nativeInteractionClient.acquireToken.bind(nativeInteractionClient),
-        PerformanceEvents.NativeInteractionClientAcquireToken,
+        BrowserPerformanceEvents.NativeInteractionClientAcquireToken,
         logger,
         performanceClient,
         request.correlationId
@@ -401,7 +397,7 @@ export async function handleResponseCode(
     if (response.accountId) {
         return invokeAsync(
             handleResponsePlatformBroker,
-            PerformanceEvents.HandleResponsePlatformBroker,
+            BrowserPerformanceEvents.HandleResponsePlatformBroker,
             logger,
             performanceClient,
             request.correlationId
@@ -434,7 +430,7 @@ export async function handleResponseCode(
     // Handle response from hash string.
     const result = await invokeAsync(
         interactionHandler.handleCodeResponse.bind(interactionHandler),
-        PerformanceEvents.HandleCodeResponse,
+        BrowserPerformanceEvents.HandleCodeResponse,
         logger,
         performanceClient,
         request.correlationId
@@ -492,7 +488,7 @@ export async function handleResponseEAR(
     const decryptedData = JSON.parse(
         await invokeAsync(
             decryptEarResponse,
-            PerformanceEvents.DecryptEarResponse,
+            BrowserPerformanceEvents.DecryptEarResponse,
             logger,
             performanceClient,
             request.correlationId
@@ -502,7 +498,7 @@ export async function handleResponseEAR(
     if (decryptedData.accountId) {
         return invokeAsync(
             handleResponsePlatformBroker,
-            PerformanceEvents.HandleResponsePlatformBroker,
+            BrowserPerformanceEvents.HandleResponsePlatformBroker,
             logger,
             performanceClient,
             request.correlationId
@@ -525,13 +521,13 @@ export async function handleResponseEAR(
         browserStorage,
         new CryptoOps(logger, performanceClient),
         logger,
+        performanceClient,
         null,
-        null,
-        performanceClient
+        null
     );
 
     // Validate response. This function throws a server error if an error is returned by the server.
-    responseHandler.validateTokenResponse(decryptedData);
+    responseHandler.validateTokenResponse(decryptedData, request.correlationId);
 
     // Temporary until response handler is refactored to be more flow agnostic.
     const additionalData: AuthorizationCodePayload = {

package/src/redirect_bridge/index.ts

@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { parseAuthResponseFromUrl } from "../utils/BrowserUtils.js";
+import * as BrowserUtils from "../utils/BrowserUtils.js";
+import {
+    ApiId,
+    InteractionType,
+    TemporaryCacheKeys,
+} from "../utils/BrowserConstants.js";
+import { NavigationOptions } from "../navigation/NavigationOptions.js";
+import { DEFAULT_REDIRECT_TIMEOUT_MS } from "../config/Configuration.js";
+import { NavigationClient } from "../navigation/NavigationClient.js";
+import { PREFIX } from "../cache/CacheKeys.js";
+
+/**
+ * Processes the authentication response from the redirect URL
+ * For SSO and popup scenarios broadcasts it to the main frame
+ * For redirect scenario navigates to the home page
+ *
+ * @param {NavigationClient} navigationClient - Optional navigation client for redirect scenario.
+ *
+ * @returns {Promise<void>} A promise that resolves when the response has been broadcast and cleanup is complete.
+ *
+ * @throws {AuthError} If no authentication payload is found in the URL (hash or query string).
+ * @throws {AuthError} If the state parameter is missing from the redirect URL.
+ * @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
+ */
+export async function broadcastResponseToMainFrame(
+    navigationClient?: NavigationClient
+): Promise<void> {
+    let parsedResponse;
+    try {
+        parsedResponse = parseAuthResponseFromUrl();
+    } catch (error) {
+        // Clear hash and query string before re-throwing parse errors
+        if (typeof window.history.replaceState === "function") {
+            window.history.replaceState(
+                null,
+                "",
+                `${window.location.origin}${window.location.pathname}`
+            );
+        }
+        throw error;
+    }
+
+    const {
+        payload,
+        urlHash,
+        urlQuery,
+        hasResponseInHash,
+        hasResponseInQuery,
+        libraryState,
+    } = parsedResponse;
+
+    const { id, meta } = libraryState;
+
+    if (meta["interactionType"] === InteractionType.Redirect) {
+        const navClient = navigationClient || new NavigationClient();
+        const navigationOptions: NavigationOptions = {
+            apiId: ApiId.handleRedirectPromise,
+            noHistory: true,
+            timeout: DEFAULT_REDIRECT_TIMEOUT_MS,
+        };
+
+        let navigateToUrl = "";
+        const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}}`;
+        try {
+            /*
+             * Retrieve the original navigation URL from sessionStorage
+             */
+            const { clientId } = JSON.parse(
+                window.sessionStorage.getItem(interactionKey) || ""
+            );
+            if (clientId) {
+                const cacheKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
+                navigateToUrl = window.sessionStorage.getItem(cacheKey) || "";
+            }
+        } catch (e) {
+            // SessionStorage access may fail in some contexts, use default
+        }
+
+        // Reconstruct full URL with auth response (preserve original format)
+        let fullUrlResponse = "";
+        if (hasResponseInHash && hasResponseInQuery) {
+            // Hybrid format
+            fullUrlResponse = `${urlQuery}${urlHash}`;
+        } else if (hasResponseInHash) {
+            // Hash only
+            fullUrlResponse = urlHash;
+        } else {
+            // Query only
+            fullUrlResponse = urlQuery;
+        }
+
+        const homepage = `${
+            navigateToUrl || BrowserUtils.getHomepage()
+        }${fullUrlResponse}`;
+        await navClient.navigateInternal(homepage, navigationOptions);
+
+        // Do NOT clear URL for redirect flow - we're navigating away anyway
+        return;
+    }
+
+    // Clear only the part(s) containing the auth response from redirect bridge URL
+    if (typeof window.history.replaceState === "function") {
+        let newUrl = `${window.location.origin}${window.location.pathname}`;
+        // Preserve hash if it didn't contain the response
+        if (!hasResponseInHash && urlHash) {
+            newUrl += urlHash;
+        }
+        // Preserve query if it didn't contain the response
+        if (!hasResponseInQuery && urlQuery) {
+            newUrl += urlQuery;
+        }
+        window.history.replaceState(null, "", newUrl);
+    }
+
+    // Send the raw URL payload to the main frame
+    const channel = new BroadcastChannel(id);
+    channel.postMessage({
+        v: 1,
+        payload,
+    });
+    channel.close();
+    try {
+        window.close();
+    } catch {}
+}