@azure/msal-browser 4.5.1 → 4.8.0

package/src/controllers/StandardController.ts

@@ -20,7 +20,7 @@ import {
     BaseAuthRequest,
     PromptValue,
     InProgressPerformanceEvent,
-    RequestThumbprint,
+    getRequestThumbprint,
     AccountEntity,
     invokeAsync,
     createClientAuthError,
@@ -1960,30 +1960,71 @@ export class StandardController implements IController {
         }
         atsMeasurement.add({ accountType: getAccountType(account) });
 
-        const thumbprint: RequestThumbprint = {
-            clientId: this.config.auth.clientId,
-            authority: request.authority || Constants.EMPTY_STRING,
-            scopes: request.scopes,
-            homeAccountIdentifier: account.homeAccountId,
-            claims: request.claims,
-            authenticationScheme: request.authenticationScheme,
-            resourceRequestMethod: request.resourceRequestMethod,
-            resourceRequestUri: request.resourceRequestUri,
-            shrClaims: request.shrClaims,
-            sshKid: request.sshKid,
-            shrOptions: request.shrOptions,
-        };
+        return this.acquireTokenSilentDeduped(request, account, correlationId)
+            .then((result) => {
+                atsMeasurement.end({
+                    success: true,
+                    fromCache: result.fromCache,
+                    isNativeBroker: result.fromNativeBroker,
+                    accessTokenSize: result.accessToken.length,
+                    idTokenSize: result.idToken.length,
+                });
+                return {
+                    ...result,
+                    state: request.state,
+                    correlationId: correlationId, // Ensures PWB scenarios can correctly match request to response
+                };
+            })
+            .catch((error: Error) => {
+                if (error instanceof AuthError) {
+                    // Ensures PWB scenarios can correctly match request to response
+                    error.setCorrelationId(correlationId);
+                }
+
+                atsMeasurement.end(
+                    {
+                        success: false,
+                    },
+                    error
+                );
+                throw error;
+            });
+    }
+
+    /**
+     * Checks if identical request is already in flight and returns reference to the existing promise or fires off a new one if this is the first
+     * @param request
+     * @param account
+     * @param correlationId
+     * @returns
+     */
+    private async acquireTokenSilentDeduped(
+        request: SilentRequest,
+        account: AccountInfo,
+        correlationId: string
+    ): Promise<AuthenticationResult> {
+        const thumbprint = getRequestThumbprint(
+            this.config.auth.clientId,
+            {
+                ...request,
+                authority: request.authority || this.config.auth.authority,
+                correlationId: correlationId,
+            },
+            account.homeAccountId
+        );
         const silentRequestKey = JSON.stringify(thumbprint);
 
-        const cachedResponse =
+        const inProgressRequest =
             this.activeSilentTokenRequests.get(silentRequestKey);
-        if (typeof cachedResponse === "undefined") {
+
+        if (typeof inProgressRequest === "undefined") {
             this.logger.verbose(
                 "acquireTokenSilent called for the first time, storing active request",
                 correlationId
             );
+            this.performanceClient.addFields({ deduped: false }, correlationId);
 
-            const response = invokeAsync(
+            const activeRequest = invokeAsync(
                 this.acquireTokenSilentAsync.bind(this),
                 PerformanceEvents.AcquireTokenSilentAsync,
                 this.logger,
@@ -1995,45 +2036,19 @@ export class StandardController implements IController {
                     correlationId,
                 },
                 account
-            )
-                .then((result) => {
-                    this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end({
-                        success: true,
-                        fromCache: result.fromCache,
-                        isNativeBroker: result.fromNativeBroker,
-                        cacheLookupPolicy: request.cacheLookupPolicy,
-                        accessTokenSize: result.accessToken.length,
-                        idTokenSize: result.idToken.length,
-                    });
-                    return result;
-                })
-                .catch((error: Error) => {
-                    this.activeSilentTokenRequests.delete(silentRequestKey);
-                    atsMeasurement.end(
-                        {
-                            success: false,
-                        },
-                        error
-                    );
-                    throw error;
-                });
-            this.activeSilentTokenRequests.set(silentRequestKey, response);
-            return {
-                ...(await response),
-                state: request.state,
-            };
+            );
+            this.activeSilentTokenRequests.set(silentRequestKey, activeRequest);
+
+            return activeRequest.finally(() => {
+                this.activeSilentTokenRequests.delete(silentRequestKey);
+            });
         } else {
             this.logger.verbose(
                 "acquireTokenSilent has been called previously, returning the result from the first call",
                 correlationId
             );
-            // Discard measurements for memoized calls, as they are usually only a couple of ms and will artificially deflate metrics
-            atsMeasurement.discard();
-            return {
-                ...(await cachedResponse),
-                state: request.state,
-            };
+            this.performanceClient.addFields({ deduped: true }, correlationId);
+            return inProgressRequest;
         }
     }
 

package/src/event/EventHandler.ts

@@ -23,12 +23,16 @@ export class EventHandler {
         [EventCallbackFunction, Array<EventType>]
     >;
     private logger: Logger;
-    private broadcastChannel: BroadcastChannel;
+    private broadcastChannel?: BroadcastChannel;
 
     constructor(logger?: Logger) {
         this.eventCallbacks = new Map();
         this.logger = logger || new Logger({});
-        this.broadcastChannel = new BroadcastChannel(BROADCAST_CHANNEL_NAME);
+        if (typeof BroadcastChannel !== "undefined") {
+            this.broadcastChannel = new BroadcastChannel(
+                BROADCAST_CHANNEL_NAME
+            );
+        }
         this.invokeCrossTabCallbacks = this.invokeCrossTabCallbacks.bind(this);
     }
 
@@ -95,7 +99,7 @@ export class EventHandler {
             case EventType.ACCOUNT_REMOVED:
             case EventType.ACTIVE_ACCOUNT_CHANGED:
                 // Send event to other open tabs / MSAL instances on same domain
-                this.broadcastChannel.postMessage(message);
+                this.broadcastChannel?.postMessage(message);
                 break;
             default:
                 // Emit event to callbacks registered in this instance
@@ -143,7 +147,7 @@ export class EventHandler {
      * Listen for events broadcasted from other tabs/instances
      */
     subscribeCrossTab(): void {
-        this.broadcastChannel.addEventListener(
+        this.broadcastChannel?.addEventListener(
             "message",
             this.invokeCrossTabCallbacks
         );
@@ -153,7 +157,7 @@ export class EventHandler {
      * Unsubscribe from broadcast events
      */
     unsubscribeCrossTab(): void {
-        this.broadcastChannel.removeEventListener(
+        this.broadcastChannel?.removeEventListener(
             "message",
             this.invokeCrossTabCallbacks
         );

package/src/interaction_client/NativeInteractionClient.ts

@@ -498,7 +498,15 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 nativeAccountId: request.accountId,
             })?.homeAccountId;
 
+        // add exception for double brokering, please note this is temporary and will be fortified in future
         if (
+            request.extraParameters?.child_client_id &&
+            response.account.id !== request.accountId
+        ) {
+            this.logger.info(
+                "handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch"
+            );
+        } else if (
             homeAccountIdentifier !== cachedhomeAccountId &&
             response.account.id !== request.accountId
         ) {
@@ -525,6 +533,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
             this.logger
         );
 
+        // Ensure expires_in is in number format
+        response.expires_in = Number(response.expires_in);
+
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(
             response,
@@ -713,8 +724,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
             idTokenClaims: idTokenClaims,
             accessToken: responseAccessToken,
             fromCache: mats ? this.isResponseFromCache(mats) : false,
-            expiresOn: new Date(
-                Number(reqTimestamp + response.expires_in) * 1000
+            // Request timestamp and NativeResponse expires_in are in seconds, converting to Date for AuthenticationResult
+            expiresOn: TimeUtils.toDateFromSeconds(
+                reqTimestamp + response.expires_in
             ),
             tokenType: tokenType,
             correlationId: this.correlationId,

package/src/interaction_client/PopupClient.ts

@@ -48,6 +48,8 @@ import { PopupWindowAttributes } from "../request/PopupWindowAttributes.js";
 import { EventError } from "../event/EventMessage.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import * as ResponseHandler from "../response/ResponseHandler.js";
+import { getAuthCodeRequestUrl } from "../protocol/Authorize.js";
+import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 
 export type PopupParams = {
     popup?: Window | null;
@@ -217,6 +219,17 @@ export class PopupClient extends StandardInteractionClient {
             this.correlationId
         )(request, InteractionType.Popup);
 
+        const pkce =
+            pkceCodes ||
+            (await invokeAsync(
+                generatePkceCodes,
+                PerformanceEvents.GeneratePkceCodes,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(this.performanceClient, this.logger, this.correlationId));
+        validRequest.codeChallenge = pkce.challenge;
+
         /*
          * Skip pre-connect for async popups to reduce time between user interaction and popup window creation to avoid
          * popup from being blocked by browsers with shorter popup timers
@@ -226,16 +239,6 @@ export class PopupClient extends StandardInteractionClient {
         }
 
         try {
-            // Create auth code request and generate PKCE params
-            const authCodeRequest: CommonAuthorizationCodeRequest =
-                await invokeAsync(
-                    this.initializeAuthorizationCodeRequest.bind(this),
-                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                    this.logger,
-                    this.performanceClient,
-                    this.correlationId
-                )(validRequest, pkceCodes);
-
             // Initialize the client
             const authClient: AuthorizationCodeClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
@@ -269,16 +272,19 @@ export class PopupClient extends StandardInteractionClient {
             }
 
             // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
-                ...validRequest,
-                platformBroker: isPlatformBroker,
-            });
-
-            // Create popup interaction handler.
-            const interactionHandler = new InteractionHandler(
-                authClient,
-                this.browserStorage,
-                authCodeRequest,
+            const navigateUrl = await invokeAsync(
+                getAuthCodeRequestUrl,
+                PerformanceEvents.GetAuthCodeUrl,
+                this.logger,
+                this.performanceClient,
+                validRequest.correlationId
+            )(
+                this.config,
+                authClient.authority,
+                {
+                    ...validRequest,
+                    platformBroker: isPlatformBroker,
+                },
                 this.logger,
                 this.performanceClient
             );
@@ -316,7 +322,7 @@ export class PopupClient extends StandardInteractionClient {
             ThrottlingUtils.removeThrottle(
                 this.browserStorage,
                 this.config.auth.clientId,
-                authCodeRequest
+                validRequest
             );
 
             if (serverParams.accountId) {
@@ -361,6 +367,19 @@ export class PopupClient extends StandardInteractionClient {
                 });
             }
 
+            const authCodeRequest: CommonAuthorizationCodeRequest = {
+                ...validRequest,
+                code: serverParams.code || "",
+                codeVerifier: pkce.verifier,
+            };
+            // Create popup interaction handler.
+            const interactionHandler = new InteractionHandler(
+                authClient,
+                this.browserStorage,
+                authCodeRequest,
+                this.logger,
+                this.performanceClient
+            );
             // Handle response from hash string.
             const result = await interactionHandler.handleCodeResponse(
                 serverParams,

package/src/interaction_client/RedirectClient.ts

@@ -11,7 +11,7 @@ import {
     ServerTelemetryManager,
     Constants,
     ProtocolUtils,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
     ThrottlingUtils,
     ICrypto,
     Logger,
@@ -48,6 +48,8 @@ import { INavigationClient } from "../navigation/INavigationClient.js";
 import { EventError } from "../event/EventMessage.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import * as ResponseHandler from "../response/ResponseHandler.js";
+import { getAuthCodeRequestUrl } from "../protocol/Authorize.js";
+import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 
 function getNavigationType(): NavigationTimingType | undefined {
     if (
@@ -107,6 +109,15 @@ export class RedirectClient extends StandardInteractionClient {
             this.correlationId
         )(request, InteractionType.Redirect);
 
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(this.performanceClient, this.logger, this.correlationId);
+        validRequest.codeChallenge = pkceCodes.challenge;
+
         this.browserStorage.updateCacheEntries(
             validRequest.state,
             validRequest.nonce,
@@ -133,16 +144,6 @@ export class RedirectClient extends StandardInteractionClient {
         };
 
         try {
-            // Create auth code request and generate PKCE params
-            const authCodeRequest: CommonAuthorizationCodeRequest =
-                await invokeAsync(
-                    this.initializeAuthorizationCodeRequest.bind(this),
-                    PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                    this.logger,
-                    this.performanceClient,
-                    this.correlationId
-                )(validRequest);
-
             // Initialize the client
             const authClient: AuthorizationCodeClient = await invokeAsync(
                 this.createAuthCodeClient.bind(this),
@@ -158,6 +159,11 @@ export class RedirectClient extends StandardInteractionClient {
                 account: validRequest.account,
             });
 
+            const authCodeRequest: CommonAuthorizationCodeRequest = {
+                ...validRequest,
+                code: "", // Will get filled in after the redirect
+                codeVerifier: pkceCodes.verifier,
+            };
             // Create redirect interaction handler.
             const interactionHandler = new RedirectHandler(
                 authClient,
@@ -168,15 +174,28 @@ export class RedirectClient extends StandardInteractionClient {
             );
 
             // Create acquire token url.
-            const navigateUrl = await authClient.getAuthCodeUrl({
-                ...validRequest,
-                platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(
-                    this.config,
-                    this.logger,
-                    this.nativeMessageHandler,
-                    request.authenticationScheme
-                ),
-            });
+            const navigateUrl = await invokeAsync(
+                getAuthCodeRequestUrl,
+                PerformanceEvents.GetAuthCodeUrl,
+                this.logger,
+                this.performanceClient,
+                validRequest.correlationId
+            )(
+                this.config,
+                authClient.authority,
+                {
+                    ...validRequest,
+                    platformBroker:
+                        NativeMessageHandler.isPlatformBrokerAvailable(
+                            this.config,
+                            this.logger,
+                            this.nativeMessageHandler,
+                            request.authenticationScheme
+                        ),
+                },
+                this.logger,
+                this.performanceClient
+            );
 
             const redirectStartPage = this.getRedirectStartPage(
                 request.redirectStartPage
@@ -373,7 +392,7 @@ export class RedirectClient extends StandardInteractionClient {
      */
     protected getRedirectResponse(
         userProvidedResponse: string
-    ): [ServerAuthorizationCodeResponse | null, string] {
+    ): [AuthorizeResponse | null, string] {
         this.logger.verbose("getRedirectResponseHash called");
         // Get current location hash from window or cache.
         let responseString = userProvidedResponse;
@@ -439,7 +458,7 @@ export class RedirectClient extends StandardInteractionClient {
      * @param state
      */
     protected async handleResponse(
-        serverParams: ServerAuthorizationCodeResponse,
+        serverParams: AuthorizeResponse,
         serverTelemetryManager: ServerTelemetryManager
     ): Promise<AuthenticationResult> {
         const state = serverParams.state;

package/src/interaction_client/SilentIframeClient.ts

@@ -42,6 +42,8 @@ import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { InteractionHandler } from "../interaction_handler/InteractionHandler.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
 import * as ResponseHandler from "../response/ResponseHandler.js";
+import { getAuthCodeRequestUrl } from "../protocol/Authorize.js";
+import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
@@ -212,49 +214,47 @@ export class SilentIframeClient extends StandardInteractionClient {
      */
     protected async silentTokenHelper(
         authClient: AuthorizationCodeClient,
-        silentRequest: AuthorizationUrlRequest
+        request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
-        const correlationId = silentRequest.correlationId;
+        const correlationId = request.correlationId;
         this.performanceClient.addQueueMeasurement(
             PerformanceEvents.SilentIframeClientTokenHelper,
             correlationId
         );
-
-        // Create auth code request and generate PKCE params
-        const authCodeRequest: CommonAuthorizationCodeRequest =
-            await invokeAsync(
-                this.initializeAuthorizationCodeRequest.bind(this),
-                PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(silentRequest);
-
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(this.performanceClient, this.logger, this.correlationId);
+        const silentRequest = {
+            ...request,
+            codeChallenge: pkceCodes.challenge,
+        };
         // Create authorize request url
         const navigateUrl = await invokeAsync(
-            authClient.getAuthCodeUrl.bind(authClient),
+            getAuthCodeRequestUrl,
             PerformanceEvents.GetAuthCodeUrl,
             this.logger,
             this.performanceClient,
             correlationId
-        )({
-            ...silentRequest,
-            platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(
-                this.config,
-                this.logger,
-                this.nativeMessageHandler,
-                silentRequest.authenticationScheme
-            ),
-        });
-
-        // Create silent handler
-        const interactionHandler = new InteractionHandler(
-            authClient,
-            this.browserStorage,
-            authCodeRequest,
+        )(
+            this.config,
+            authClient.authority,
+            {
+                ...silentRequest,
+                platformBroker: NativeMessageHandler.isPlatformBrokerAvailable(
+                    this.config,
+                    this.logger,
+                    this.nativeMessageHandler,
+                    silentRequest.authenticationScheme
+                ),
+            },
             this.logger,
             this.performanceClient
         );
+
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(
             initiateAuthRequest,
@@ -335,6 +335,19 @@ export class SilentIframeClient extends StandardInteractionClient {
                 prompt: silentRequest.prompt || PromptValue.NONE,
             });
         }
+        const authCodeRequest: CommonAuthorizationCodeRequest = {
+            ...silentRequest,
+            code: serverParams.code || "",
+            codeVerifier: pkceCodes.verifier,
+        };
+        // Create silent handler
+        const interactionHandler = new InteractionHandler(
+            authClient,
+            this.browserStorage,
+            authCodeRequest,
+            this.logger,
+            this.performanceClient
+        );
 
         // Handle response from hash string
         return invokeAsync(

package/src/interaction_client/StandardInteractionClient.ts

@@ -5,7 +5,6 @@
 
 import {
     ServerTelemetryManager,
-    CommonAuthorizationCodeRequest,
     Constants,
     AuthorizationCodeClient,
     ClientConfiguration,
@@ -20,7 +19,6 @@ import {
     invokeAsync,
     BaseAuthRequest,
     StringDict,
-    PkceCodes,
 } from "@azure/msal-common/browser";
 import { BaseInteractionClient } from "./BaseInteractionClient.js";
 import { AuthorizationUrlRequest } from "../request/AuthorizationUrlRequest.js";
@@ -35,7 +33,6 @@ import * as BrowserUtils from "../utils/BrowserUtils.js";
 import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import { generatePkceCodes } from "../crypto/PkceGenerator.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
 import { initializeBaseRequest } from "../request/RequestHelpers.js";
 
@@ -43,43 +40,6 @@ import { initializeBaseRequest } from "../request/RequestHelpers.js";
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
  */
 export abstract class StandardInteractionClient extends BaseInteractionClient {
-    /**
-     * Generates an auth code request tied to the url request.
-     * @param request
-     * @param pkceCodes
-     */
-    protected async initializeAuthorizationCodeRequest(
-        request: AuthorizationUrlRequest,
-        pkceCodes?: PkceCodes
-    ): Promise<CommonAuthorizationCodeRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest,
-            this.correlationId
-        );
-
-        const generatedPkceParams: PkceCodes =
-            pkceCodes ||
-            (await invokeAsync(
-                generatePkceCodes,
-                PerformanceEvents.GeneratePkceCodes,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )(this.performanceClient, this.logger, this.correlationId));
-
-        const authCodeRequest: CommonAuthorizationCodeRequest = {
-            ...request,
-            redirectUri: request.redirectUri,
-            code: Constants.EMPTY_STRING,
-            codeVerifier: generatedPkceParams.verifier,
-        };
-
-        request.codeChallenge = generatedPkceParams.challenge;
-        request.codeChallengeMethod = Constants.S256_CODE_CHALLENGE_METHOD;
-
-        return authCodeRequest;
-    }
-
     /**
      * Initializer for the logout request.
      * @param logoutRequest

package/src/interaction_handler/InteractionHandler.ts

@@ -14,7 +14,8 @@ import {
     PerformanceEvents,
     invokeAsync,
     CcsCredentialType,
-    ServerAuthorizationCodeResponse,
+    AuthorizeResponse,
+    AuthorizeProtocol,
 } from "@azure/msal-common/browser";
 
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
@@ -54,7 +55,7 @@ export class InteractionHandler {
      * @param locationHash
      */
     async handleCodeResponse(
-        response: ServerAuthorizationCodeResponse,
+        response: AuthorizeResponse,
         request: AuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
         this.performanceClient.addQueueMeasurement(
@@ -64,7 +65,7 @@ export class InteractionHandler {
 
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(
+            authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
                 request.state
             );