@azure/msal-browser 4.28.2 → 4.29.1

package/src/interaction_client/SilentIframeClient.ts

@@ -16,6 +16,7 @@ import {
     ProtocolMode,
     CommonAuthorizationUrlRequest,
     HttpMethod,
+    AuthorizeProtocol,
 } from "@azure/msal-common/browser";
 import { StandardInteractionClient } from "./StandardInteractionClient.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
@@ -349,6 +350,141 @@ export class SilentIframeClient extends StandardInteractionClient {
         }
     }
 
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request: SsoSilentRequest): Promise<boolean> {
+        this.performanceClient.addQueueMeasurement(
+            PerformanceEvents.SilentIframeClientAcquireToken,
+            request.correlationId
+        );
+
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = PromptValue.NONE;
+        }
+
+        // Create silent request
+        const silentRequest: CommonAuthorizationUrlRequest = await invokeAsync(
+            this.initializeAuthorizationRequest.bind(this),
+            PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(inputRequest, InteractionType.Silent);
+
+        const authClient = await invokeAsync(
+            this.createAuthCodeClient.bind(this),
+            PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )({
+            serverTelemetryManager: this.initializeServerTelemetryManager(
+                this.apiId
+            ),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+
+        const correlationId = silentRequest.correlationId;
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
+
+        const requestWithPkce = {
+            ...silentRequest,
+            codeChallenge: pkceCodes.challenge,
+        };
+
+        // Create authorize request url
+        const navigateUrl = await invokeAsync(
+            Authorize.getAuthCodeRequestUrl,
+            PerformanceEvents.GetAuthCodeUrl,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            this.config,
+            authClient.authority,
+            requestWithPkce,
+            this.logger,
+            this.performanceClient
+        );
+
+        // Get the frame handle for the silent request - this triggers the SSO verification
+        const msalFrame = await invokeAsync(
+            initiateCodeRequest,
+            PerformanceEvents.SilentHandlerInitiateAuthRequest,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            navigateUrl,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            this.config.system.navigateFrameWait
+        );
+
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
+        // Monitor the iframe for the response
+        const responseString = await invokeAsync(
+            monitorIframeForHash,
+            PerformanceEvents.SilentHandlerMonitorIframeForHash,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            msalFrame,
+            this.config.system.iframeHashTimeout,
+            this.config.system.pollIntervalMilliseconds,
+            this.performanceClient,
+            this.logger,
+            correlationId,
+            responseType
+        );
+
+        // Deserialize the response
+        const serverParams = invoke(
+            ResponseHandler.deserializeResponse,
+            PerformanceEvents.DeserializeResponse,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(responseString, responseType, this.logger);
+
+        // Validate the response - this checks for errors and validates state
+        AuthorizeProtocol.validateAuthorizationResponse(
+            serverParams,
+            silentRequest.state
+        );
+
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning(
+                "SSO verification response did not contain an authorization code",
+                correlationId
+            );
+            return false;
+        }
+
+        this.logger.verbose(
+            "SSO verification completed successfully with valid authorization code - skipped token exchange",
+            correlationId
+        );
+        return true;
+    }
+
     /**
      * Currently Unsupported
      */

package/src/interaction_client/StandardInteractionClient.ts

@@ -305,6 +305,18 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         );
 
         const redirectUri = this.getRedirectUri(request.redirectUri);
+        if (
+            new URL(redirectUri).origin !== new URL(window.location.href).origin
+        ) {
+            this.logger.warning(
+                "The origin of the redirect URI does not match the origin of the current page. This is likely to cause issues with authentication.",
+                this.correlationId
+            );
+            this.performanceClient.addFields(
+                { isRedirectUriCrossOrigin: true },
+                this.correlationId
+            );
+        }
         const browserState: BrowserStateObject = {
             interactionType: interactionType,
         };

package/src/interaction_handler/SilentHandler.ts

@@ -127,6 +127,16 @@ export async function monitorIframeForHash(
         PerformanceEvents.SilentHandlerMonitorIframeForHash,
         correlationId
     );
+    performanceClient.addFields(
+        {
+            iframePollIntervalMs: pollIntervalMilliseconds,
+            iframeTimeoutMs: timeout,
+        },
+        correlationId
+    );
+
+    let totalTickCount = 0;
+    let crossOriginTickCount = 0;
 
     return new Promise<string>((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
@@ -149,6 +159,7 @@ export async function monitorIframeForHash(
         }, timeout);
 
         const intervalId = window.setInterval(() => {
+            totalTickCount++;
             let href: string = "";
             const contentWindow = iframe.contentWindow;
             try {
@@ -158,7 +169,9 @@ export async function monitorIframeForHash(
                  * since we need the interval to keep running while on STS UI.
                  */
                 href = contentWindow ? contentWindow.location.href : "";
-            } catch (e) {}
+            } catch (e) {
+                crossOriginTickCount++;
+            }
 
             if (!href || href === "about:blank") {
                 return;
@@ -177,6 +190,13 @@ export async function monitorIframeForHash(
             resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
+        performanceClient.addFields(
+            {
+                iframeTickCount: totalTickCount,
+                crossOriginTickCount: crossOriginTickCount,
+            },
+            correlationId
+        );
         invoke(
             removeHiddenIframe,
             PerformanceEvents.RemoveHiddenIframe,

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "4.28.2";
+export const version = "4.29.1";

package/src/telemetry/BrowserPerformanceClient.ts

@@ -20,6 +20,7 @@ import { name, version } from "../packageMetadata.js";
 import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
 import { BROWSER_PERF_ENABLED_KEY } from "../cache/CacheKeys.js";
+import { getNetworkInfo } from "../utils/MsalFrameStatsUtils.js";
 
 /**
  * Returns browser performance measurement module if session flag is enabled. Returns undefined otherwise.
@@ -100,6 +101,10 @@ export class BrowserPerformanceClient
         return document.visibilityState?.toString() || null;
     }
 
+    private getOnlineStatus(): boolean | null {
+        return typeof navigator !== "undefined" ? navigator.onLine : null;
+    }
+
     private deleteIncompleteSubMeasurements(
         inProgressEvent: InProgressPerformanceEvent
     ): void {
@@ -140,6 +145,7 @@ export class BrowserPerformanceClient
     ): InProgressPerformanceEvent {
         // Capture page visibilityState and then invoke start/end measurement
         const startPageVisibility = this.getPageVisibility();
+        const startOnlineStatus = this.getOnlineStatus();
         const inProgressEvent = super.startMeasurement(
             measureName,
             correlationId
@@ -167,12 +173,16 @@ export class BrowserPerformanceClient
                 error?: unknown,
                 account?: AccountInfo
             ): PerformanceEvent | null => {
+                const networkInfo = getNetworkInfo();
                 const res = inProgressEvent.end(
                     {
                         ...event,
                         startPageVisibility,
+                        startOnlineStatus,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
+                        networkEffectiveType: networkInfo.effectiveType,
+                        networkRtt: networkInfo.rtt,
                     },
                     error,
                     account

package/src/utils/MsalFrameStatsUtils.ts

@@ -5,6 +5,33 @@
 
 import { InProgressPerformanceEvent, Logger } from "@azure/msal-common/browser";
 
+interface NetworkConnection {
+    effectiveType?: string;
+    rtt?: number;
+}
+
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+export function getNetworkInfo(): NetworkConnection {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection: NetworkConnection | undefined =
+        "connection" in window.navigator
+            ? (
+                  window.navigator as Navigator & {
+                      connection: NetworkConnection;
+                  }
+              ).connection
+            : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
+
 export function collectInstanceStats(
     currentClientId: string,
     performanceEvent: InProgressPerformanceEvent,