@azure/msal-browser 4.27.0 → 5.0.0-beta.0

package/src/telemetry/BrowserRootPerformanceEvents.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * acquireTokenSilent API (msal-browser and msal-node).
+ * Used to silently acquire a new access token (from the cache or the network).
+ */
+export const AcquireTokenSilent = "acquireTokenSilent";
+/**
+ * acquireTokenByCode API (msal-browser and msal-node).
+ * Used to acquire tokens by trading an authorization code against the token endpoint.
+ */
+export const AcquireTokenByCode = "acquireTokenByCode";
+/**
+ * acquireTokenPopup (msal-browser).
+ * Used to acquire a new access token interactively through pop ups
+ */
+export const AcquireTokenPopup = "acquireTokenPopup";
+/**
+ * acquireTokenPreRedirect (msal-browser).
+ * First part of the redirect flow.
+ * Used to acquire a new access token interactively through redirects.
+ */
+export const AcquireTokenPreRedirect = "acquireTokenPreRedirect";
+/**
+ * acquireTokenRedirect (msal-browser).
+ * Second part of the redirect flow.
+ * Used to acquire a new access token interactively through redirects.
+ */
+export const AcquireTokenRedirect = "acquireTokenRedirect";
+/**
+ * ssoSilent API (msal-browser).
+ * Used to silently acquire an authorization code and set of tokens using a hidden iframe.
+ */
+export const SsoSilent = "ssoSilent";
+// Initialize client application
+export const InitializeClientApplication = "initializeClientApplication";
+// Update cache storage
+export const LocalStorageUpdated = "localStorageUpdated";

package/src/utils/BrowserConstants.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { OIDC_DEFAULT_SCOPES } from "@azure/msal-common/browser";
+import { Constants } from "@azure/msal-common/browser";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { RedirectRequest } from "../request/RedirectRequest.js";
 
@@ -31,10 +31,6 @@ export const BrowserConstants = {
      * Name of the popup window starts with
      */
     POPUP_NAME_PREFIX: "msal",
-    /**
-     * Default popup monitor poll interval in milliseconds
-     */
-    DEFAULT_POLL_INTERVAL_MS: 30,
     /**
      * Msal-browser SKU
      */
@@ -148,10 +144,6 @@ export const InteractionStatus = {
      * Initial status before interaction occurs
      */
     Startup: "startup",
-    /**
-     * Status set when all login calls occuring
-     */
-    Login: "login",
     /**
      * Status set when logout call occuring
      */
@@ -160,10 +152,6 @@ export const InteractionStatus = {
      * Status set for acquireToken calls
      */
     AcquireToken: "acquireToken",
-    /**
-     * Status set for ssoSilent calls
-     */
-    SsoSilent: "ssoSilent",
     /**
      * Status set when handleRedirect in progress
      */
@@ -177,7 +165,7 @@ export type InteractionStatus =
     (typeof InteractionStatus)[keyof typeof InteractionStatus];
 
 export const DEFAULT_REQUEST: RedirectRequest | PopupRequest = {
-    scopes: OIDC_DEFAULT_SCOPES,
+    scopes: Constants.OIDC_DEFAULT_SCOPES,
 };
 
 /**

package/src/utils/BrowserProtocolUtils.ts

@@ -31,7 +31,7 @@ export function extractBrowserRequestState(
 
     try {
         const requestStateObj: RequestStateObject =
-            ProtocolUtils.parseRequestState(browserCrypto, state);
+            ProtocolUtils.parseRequestState(browserCrypto.base64Decode, state);
         return requestStateObj.libraryState.meta as BrowserStateObject;
     } catch (e) {
         throw createClientAuthError(ClientAuthErrorCodes.invalidState);

package/src/utils/BrowserUtils.ts

@@ -7,19 +7,132 @@ import {
     UrlString,
     invoke,
     invokeAsync,
+    UrlUtils,
     RequestParameterBuilder,
+    ICrypto,
+    Logger,
+    CommonAuthorizationUrlRequest,
+    CommonEndSessionRequest,
+    ProtocolUtils,
 } from "@azure/msal-common/browser";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
-import { BrowserConstants, BrowserCacheLocation } from "./BrowserConstants.js";
+import { BrowserCacheLocation, InteractionType } from "./BrowserConstants.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
 import {
     BrowserConfigurationAuthErrorCodes,
     createBrowserConfigurationAuthError,
 } from "../error/BrowserConfigurationAuthError.js";
-import type { BrowserConfiguration } from "../config/Configuration.js";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { redirectBridgeEmptyResponse } from "../error/BrowserAuthErrorCodes.js";
+import { base64Decode } from "../encode/Base64Decode.js";
+
+/**
+ * Extracts and parses the authentication response from URL (hash and/or query string).
+ * This is a shared utility used across multiple components in msal-browser.
+ *
+ * @returns {Object} An object containing the parsed state information and URL parameters.
+ * @returns {URLSearchParams} params - The parsed URL parameters from the payload.
+ * @returns {string} payload - The combined query string and hash content.
+ * @returns {string} urlHash - The original URL hash.
+ * @returns {string} urlQuery - The original URL query string.
+ * @returns {LibraryStateObject} libraryState - The decoded library state from the state parameter.
+ *
+ * @throws {AuthError} If no authentication payload is found in the URL.
+ * @throws {AuthError} If the state parameter is missing.
+ * @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
+ */
+export function parseAuthResponseFromUrl(): {
+    params: URLSearchParams;
+    payload: string;
+    urlHash: string;
+    urlQuery: string;
+    hasResponseInHash: boolean;
+    hasResponseInQuery: boolean;
+    libraryState: {
+        id: string;
+        meta: Record<string, string>;
+    };
+} {
+    // Extract both hash and query string to support hybrid response format
+    const urlHash = window.location.hash;
+    const urlQuery = window.location.search;
+
+    // Determine which part contains the auth response by checking for 'state' parameter
+    let hasResponseInHash = false;
+    let hasResponseInQuery = false;
+    let payload = "";
+    let params: URLSearchParams | undefined = undefined;
+
+    if (urlHash && urlHash.length > 1) {
+        const hashContent =
+            urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash;
+        const hashParams = new URLSearchParams(hashContent);
+        if (hashParams.has("state")) {
+            hasResponseInHash = true;
+            payload = hashContent;
+            params = hashParams;
+        }
+    }
+
+    if (urlQuery && urlQuery.length > 1) {
+        const queryContent =
+            urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery;
+        const queryParams = new URLSearchParams(queryContent);
+        if (queryParams.has("state")) {
+            hasResponseInQuery = true;
+            payload = queryContent;
+            params = queryParams;
+        }
+    }
+
+    // If response is in both, combine them (hybrid format)
+    if (hasResponseInHash && hasResponseInQuery) {
+        const queryContent =
+            urlQuery.charAt(0) === "?" ? urlQuery.substring(1) : urlQuery;
+        const hashContent =
+            urlHash.charAt(0) === "#" ? urlHash.substring(1) : urlHash;
+        payload = `${queryContent}${hashContent}`;
+        params = new URLSearchParams(payload);
+    }
+
+    if (!payload || !params) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.emptyResponse);
+    }
+
+    const state = params.get("state");
+    if (!state) {
+        throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+    }
+
+    const { libraryState } = ProtocolUtils.parseRequestState(
+        base64Decode,
+        state
+    );
+
+    const { id, meta } = libraryState;
+    if (!id || !meta) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.unableToParseState,
+            "missing_library_state"
+        );
+    }
+
+    return {
+        params,
+        payload,
+        urlHash,
+        urlQuery,
+        hasResponseInHash,
+        hasResponseInQuery,
+        libraryState: {
+            id,
+            meta,
+        },
+    };
+}
 
 /**
  * Clears hash from window url.
@@ -57,13 +170,120 @@ export function isInIframe(): boolean {
  * Returns boolean of whether or not the current window is a popup opened by msal
  */
 export function isInPopup(): boolean {
-    return (
-        typeof window !== "undefined" &&
-        !!window.opener &&
-        window.opener !== window &&
-        typeof window.name === "string" &&
-        window.name.indexOf(`${BrowserConstants.POPUP_NAME_PREFIX}.`) === 0
-    );
+    if (isInIframe()) {
+        return false;
+    }
+
+    try {
+        const { libraryState } = parseAuthResponseFromUrl();
+        const { meta } = libraryState;
+        return meta["interactionType"] === InteractionType.Popup;
+    } catch (e) {
+        // If parsing fails (no state, invalid URL, etc.), we're not in a popup
+        return false;
+    }
+}
+
+/**
+ * Await a response from a redirect bridge using BroadcastChannel.
+ * This unified function works for both popup and iframe scenarios by listening on a
+ * BroadcastChannel for the server payload.
+ *
+ * @param timeoutMs - Timeout in milliseconds.
+ * @param logger - Logger instance for logging monitoring events.
+ * @param browserCrypto - Browser crypto instance for decoding state.
+ * @param request - The authorization or end session request.
+ * @returns Promise<string> - Resolves with the response string (query or hash) from the window.
+ */
+
+// Track the active bridge monitor to allow cancellation when overriding interactions
+let activeBridgeMonitor: {
+    timeoutId: number;
+    channel: BroadcastChannel;
+    reject: (reason?: unknown) => void;
+} | null = null;
+
+/**
+ * Cancels the pending bridge response monitor if one exists.
+ * This is called when overrideInteractionInProgress is used to cancel
+ * any pending popup interaction before starting a new one.
+ */
+export function cancelPendingBridgeResponse(
+    logger: Logger,
+    correlationId: string
+): void {
+    if (activeBridgeMonitor) {
+        logger.verbose(
+            "BrowserUtils.cancelPendingBridgeResponse - Cancelling pending bridge monitor",
+            correlationId
+        );
+
+        clearTimeout(activeBridgeMonitor.timeoutId);
+        activeBridgeMonitor.channel.close();
+        activeBridgeMonitor.reject(
+            createBrowserAuthError(
+                BrowserAuthErrorCodes.interactionInProgressCancelled
+            )
+        );
+
+        activeBridgeMonitor = null;
+    }
+}
+
+export async function waitForBridgeResponse(
+    timeoutMs: number,
+    logger: Logger,
+    browserCrypto: ICrypto,
+    request: CommonAuthorizationUrlRequest | CommonEndSessionRequest
+): Promise<string> {
+    return new Promise<string>((resolve, reject) => {
+        logger.verbose(
+            "BrowserUtils.waitForBridgeResponse - started",
+            request.correlationId
+        );
+
+        const { libraryState } = ProtocolUtils.parseRequestState(
+            browserCrypto.base64Decode,
+            request.state || ""
+        );
+        const channel = new BroadcastChannel(libraryState.id);
+        let responseString: string | undefined = undefined;
+
+        const timeoutId = window.setTimeout(() => {
+            // Clear the active monitor
+            activeBridgeMonitor = null;
+
+            channel.close();
+            reject(
+                createBrowserAuthError(
+                    BrowserAuthErrorCodes.timedOut,
+                    "redirect_bridge_timeout"
+                )
+            );
+        }, timeoutMs);
+
+        // Track this monitor so it can be cancelled if needed
+        activeBridgeMonitor = {
+            timeoutId,
+            channel,
+            reject,
+        };
+
+        channel.onmessage = (event) => {
+            responseString = event.data.payload;
+
+            // Clear the active monitor
+            activeBridgeMonitor = null;
+
+            clearTimeout(timeoutId);
+            channel.close();
+            if (responseString) {
+                resolve(responseString);
+            } else {
+                reject(createBrowserAuthError(redirectBridgeEmptyResponse));
+            }
+        };
+    });
 }
 
 // #endregion
@@ -91,7 +311,7 @@ export function getHomepage(): string {
  * attempting another auth request inside an iframe.
  */
 export function blockReloadInHiddenIframes(): void {
-    const isResponseHash = UrlString.hashContainsKnownProperties(
+    const isResponseHash = UrlUtils.getDeserializedResponse(
         window.location.hash
     );
     // return an error if called from the hidden iframe created by the msal js silent calls
@@ -175,11 +395,8 @@ export function redirectPreflightCheck(
 ): void {
     preflightCheck(initialized);
     blockRedirectInIframe(config.system.allowRedirectInIframe);
-    // Block redirects if memory storage is enabled but storeAuthStateInCookie is not
-    if (
-        config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage &&
-        !config.cache.storeAuthStateInCookie
-    ) {
+    // Block redirects if memory storage is enabled
+    if (config.cache.cacheLocation === BrowserCacheLocation.MemoryStorage) {
         throw createBrowserConfigurationAuthError(
             BrowserConfigurationAuthErrorCodes.inMemRedirectUnavailable
         );

package/src/utils/MsalFrameStatsUtils.ts

@@ -8,7 +8,8 @@ import { InProgressPerformanceEvent, Logger } from "@azure/msal-common/browser";
 export function collectInstanceStats(
     currentClientId: string,
     performanceEvent: InProgressPerformanceEvent,
-    logger: Logger
+    logger: Logger,
+    correlationId: string
 ): void {
     const frameInstances: string[] =
         // @ts-ignore
@@ -22,7 +23,8 @@ export function collectInstanceStats(
 
     if (sameClientIdInstanceCount > 1) {
         logger.warning(
-            "There is already an instance of MSAL.js in the window with the same client id."
+            "There is already an instance of MSAL.js in the window with the same client id.",
+            correlationId
         );
     }
     performanceEvent.add({

package/dist/app/PublicClientNext.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PublicClientNext.d.ts","sourceRoot":"","sources":["../../src/app/PublicClientNext.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EACH,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,MAAM,EACT,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EACH,oBAAoB,EACpB,aAAa,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,wBAAwB;IAK7D,SAAS,CAAC,UAAU,EAAG,WAAW,CAAC;IACnC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;WAEnB,6BAA6B,CAC7C,aAAa,EAAE,aAAa,GAC7B,OAAO,CAAC,wBAAwB,CAAC;IAapC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO;IAeP;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAajC;;;;;;OAMG;IACG,iBAAiB,CACnB,OAAO,EAAE,YAAY,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;OAKG;IACH,kBAAkB,CACd,aAAa,EAAE,aAAa,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;;;;;;OASG;IACH,kBAAkB,CACd,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;OAGG;IACH,gBAAgB,CACZ,QAAQ,EAAE,qBAAqB,EAC/B,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,GAC9B,MAAM,GAAG,IAAI;IAIhB;;;OAGG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI7C;;;;;OAKG;IACH,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM;IAIrE;;;;;OAKG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAItD;;OAEG;IACH,0BAA0B,IAAI,IAAI;IAIlC;;OAEG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,UAAU,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,GAAG,IAAI;IAI5D;;;;;;;OAOG;IACH,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAI7D;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAIxD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAI1D;;;;OAIG;IACH,cAAc,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,WAAW,EAAE;IAI5D;;;;;;OAMG;IACH,qBAAqB,CACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAIvC;;;;;;OAMG;IACH,UAAU,CACN,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;;;;;OAQG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD;;;;OAIG;IACH,cAAc,CAAC,aAAa,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE;;;OAGG;IACH,WAAW,CAAC,aAAa,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAInE;;OAEG;IACH,aAAa,IAAI,WAAW;IAI5B;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/B;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI;IAInD;;OAEG;IACH,gBAAgB,IAAI,WAAW,GAAG,IAAI;IAItC;;;;OAIG;IACH,wBAAwB,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAIhE;;;OAGG;IACH,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,IAAI;IAI9D;;;OAGG;IACH,gBAAgB,IAAI,oBAAoB;IAIxC;;;;;OAKG;IACG,YAAY,CACd,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EACD,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;OAGG;IACH,UAAU,CAAC,aAAa,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/D"}