@azure/msal-browser 4.7.0 → 4.9.0

package/src/controllers/StandardController.ts

@@ -41,7 +41,6 @@ import {
     ApiId,
     BrowserCacheLocation,
     WrapperSKU,
-    TemporaryCacheKeys,
     CacheLookupPolicy,
     DEFAULT_REQUEST,
     BrowserConstants,
@@ -437,11 +436,18 @@ export class StandardController implements IController {
     private async handleRedirectPromiseInternal(
         hash?: string
     ): Promise<AuthenticationResult | null> {
+        if (!this.browserStorage.isInteractionInProgress(true)) {
+            this.logger.info(
+                "handleRedirectPromise called but there is no interaction in progress, returning null."
+            );
+            return null;
+        }
+
         const loggedInAccounts = this.getAllAccounts();
-        const request: NativeTokenRequest | null =
+        const platformBrokerRequest: NativeTokenRequest | null =
             this.browserStorage.getCachedNativeRequest();
         const useNative =
-            request &&
+            platformBrokerRequest &&
             NativeMessageHandler.isPlatformBrokerAvailable(
                 this.config,
                 this.logger,
@@ -449,15 +455,9 @@ export class StandardController implements IController {
             ) &&
             this.nativeExtensionProvider &&
             !hash;
-        const correlationId = useNative
-            ? request?.correlationId
-            : this.browserStorage.getTemporaryCache(
-                  TemporaryCacheKeys.CORRELATION_ID,
-                  true
-              ) || "";
-        const rootMeasurement = this.performanceClient.startMeasurement(
+        let rootMeasurement = this.performanceClient.startMeasurement(
             PerformanceEvents.AcquireTokenRedirect,
-            correlationId
+            platformBrokerRequest?.correlationId || ""
         );
         this.eventHandler.emitEvent(
             EventType.HANDLE_REDIRECT_START,
@@ -479,9 +479,9 @@ export class StandardController implements IController {
                 ApiId.handleRedirectPromise,
                 this.performanceClient,
                 this.nativeExtensionProvider,
-                request.accountId,
+                platformBrokerRequest.accountId,
                 this.nativeInternalStorage,
-                request.correlationId
+                platformBrokerRequest.correlationId
             );
 
             redirectResponse = invokeAsync(
@@ -492,6 +492,15 @@ export class StandardController implements IController {
                 rootMeasurement.event.correlationId
             )(this.performanceClient, rootMeasurement.event.correlationId);
         } else {
+            const [standardRequest, codeVerifier] =
+                this.browserStorage.getCachedRequest();
+            const correlationId = standardRequest.correlationId;
+            // Reset rootMeasurement now that we have correlationId
+            rootMeasurement.discard();
+            rootMeasurement = this.performanceClient.startMeasurement(
+                PerformanceEvents.AcquireTokenRedirect,
+                correlationId
+            );
             this.logger.trace(
                 "handleRedirectPromise - acquiring token from web flow"
             );
@@ -502,14 +511,14 @@ export class StandardController implements IController {
                 this.logger,
                 this.performanceClient,
                 rootMeasurement.event.correlationId
-            )(hash, rootMeasurement);
+            )(hash, standardRequest, codeVerifier, rootMeasurement);
         }
 
         return redirectResponse
             .then((result: AuthenticationResult | null) => {
                 if (result) {
+                    this.browserStorage.resetRequestCache();
                     // Emit login event if number of accounts change
-
                     const isLoggingIn =
                         loggedInAccounts.length < this.getAllAccounts().length;
                     if (isLoggingIn) {
@@ -555,6 +564,7 @@ export class StandardController implements IController {
                 return result;
             })
             .catch((e) => {
+                this.browserStorage.resetRequestCache();
                 const eventError = e as EventError;
                 // Emit login event if there is an account
                 if (loggedInAccounts.length > 0) {
@@ -702,7 +712,6 @@ export class StandardController implements IController {
                                 this.createRedirectClient(correlationId);
                             return redirectClient.acquireToken(request);
                         }
-                        this.browserStorage.setInteractionInProgress(false);
                         throw e;
                     });
             } else {
@@ -712,6 +721,7 @@ export class StandardController implements IController {
 
             return await result;
         } catch (e) {
+            this.browserStorage.resetRequestCache();
             atrMeasurement.end({ success: false }, e);
             if (isLoggedIn) {
                 this.eventHandler.emitEvent(
@@ -792,7 +802,6 @@ export class StandardController implements IController {
                 ApiId.acquireTokenPopup
             )
                 .then((response) => {
-                    this.browserStorage.setInteractionInProgress(false);
                     atPopupMeasurement.end({
                         success: true,
                         isNativeBroker: true,
@@ -817,7 +826,6 @@ export class StandardController implements IController {
                             this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request, pkce);
                     }
-                    this.browserStorage.setInteractionInProgress(false);
                     throw e;
                 });
         } else {
@@ -881,11 +889,12 @@ export class StandardController implements IController {
                 // Since this function is syncronous we need to reject
                 return Promise.reject(e);
             })
-            .finally(
-                () =>
-                    this.config.system.asyncPopups &&
-                    this.preGeneratePkceCodes(correlationId)
-            );
+            .finally(async () => {
+                this.browserStorage.setInteractionInProgress(false);
+                if (this.config.system.asyncPopups) {
+                    await this.preGeneratePkceCodes(correlationId);
+                }
+            });
     }
 
     private trackPageVisibilityWithMeasurement(): void {
@@ -1357,7 +1366,9 @@ export class StandardController implements IController {
             this.browserStorage.setInteractionInProgress(true);
 
             const popupClient = this.createPopupClient(correlationId);
-            return popupClient.logout(logoutRequest);
+            return popupClient.logout(logoutRequest).finally(() => {
+                this.browserStorage.setInteractionInProgress(false);
+            });
         } catch (e) {
             // Since this function is syncronous we need to reject
             return Promise.reject(e);

package/src/controllers/UnknownOperatingContextController.ts

@@ -186,6 +186,7 @@ export class UnknownOperatingContextController implements IController {
                   Omit<
                       CommonAuthorizationUrlRequest,
                       | "responseMode"
+                      | "earJwk"
                       | "codeChallenge"
                       | "codeChallengeMethod"
                       | "requestedClaimsHash"
@@ -293,6 +294,7 @@ export class UnknownOperatingContextController implements IController {
             Omit<
                 CommonAuthorizationUrlRequest,
                 | "responseMode"
+                | "earJwk"
                 | "codeChallenge"
                 | "codeChallengeMethod"
                 | "requestedClaimsHash"

package/src/crypto/BrowserCrypto.ts

@@ -12,8 +12,8 @@ import {
     PerformanceEvents,
 } from "@azure/msal-common/browser";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants.js";
-import { urlEncodeArr } from "../encode/Base64Encode.js";
-import { base64DecToArr } from "../encode/Base64Decode.js";
+import { base64Encode, urlEncodeArr } from "../encode/Base64Encode.js";
+import { base64Decode, base64DecToArr } from "../encode/Base64Decode.js";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -226,6 +226,95 @@ export async function sign(
     ) as Promise<ArrayBuffer>;
 }
 
+/**
+ * Generates Base64 encoded jwk used in the Encrypted Authorize Response (EAR) flow
+ */
+export async function generateEarKey(): Promise<string> {
+    const key = await generateBaseKey();
+    const keyStr = urlEncodeArr(new Uint8Array(key));
+
+    const jwk = {
+        alg: "dir",
+        kty: "oct",
+        k: keyStr,
+    };
+
+    return base64Encode(JSON.stringify(jwk));
+}
+
+/**
+ * Parses earJwk for encryption key and returns CryptoKey object
+ * @param earJwk
+ * @returns
+ */
+async function importEarKey(earJwk: string): Promise<CryptoKey> {
+    const b64DecodedJwk = base64Decode(earJwk);
+    const jwkJson = JSON.parse(b64DecodedJwk);
+    const rawKey = jwkJson.k;
+    const keyBuffer = base64DecToArr(rawKey);
+
+    return window.crypto.subtle.importKey(RAW, keyBuffer, AES_GCM, false, [
+        DECRYPT,
+    ]);
+}
+
+/**
+ * Decrypt ear_jwe response returned in the Encrypted Authorize Response (EAR) flow
+ * @param earJwk
+ * @param earJwe
+ * @returns
+ */
+export async function decryptEarResponse(
+    earJwk: string,
+    earJwe: string
+): Promise<string> {
+    const earJweParts = earJwe.split(".");
+    if (earJweParts.length !== 5) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.failedToDecryptEarResponse,
+            "jwe_length"
+        );
+    }
+
+    const key = await importEarKey(earJwk).catch(() => {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.failedToDecryptEarResponse,
+            "import_key"
+        );
+    });
+
+    try {
+        const header = new TextEncoder().encode(earJweParts[0]);
+        const iv = base64DecToArr(earJweParts[2]);
+        const ciphertext = base64DecToArr(earJweParts[3]);
+        const tag = base64DecToArr(earJweParts[4]);
+        const tagLengthBits = tag.byteLength * 8;
+
+        // Concat ciphertext and tag
+        const encryptedData = new Uint8Array(ciphertext.length + tag.length);
+        encryptedData.set(ciphertext);
+        encryptedData.set(tag, ciphertext.length);
+
+        const decryptedData = await window.crypto.subtle.decrypt(
+            {
+                name: AES_GCM,
+                iv: iv,
+                tagLength: tagLengthBits,
+                additionalData: header,
+            },
+            key,
+            encryptedData
+        );
+
+        return new TextDecoder().decode(decryptedData);
+    } catch (e) {
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.failedToDecryptEarResponse,
+            "decrypt"
+        );
+    }
+}
+
 /**
  * Generates symmetric base encryption key. This may be stored as all encryption/decryption keys will be derived from this one.
  */

package/src/error/BrowserAuthError.ts

@@ -15,6 +15,10 @@ const ErrorLink = "For more visit: aka.ms/msaljs/browser-errors";
 export const BrowserAuthErrorMessages = {
     [BrowserAuthErrorCodes.pkceNotCreated]:
         "The PKCE code challenge and verifier could not be generated.",
+    [BrowserAuthErrorCodes.earJwkEmpty]:
+        "No EAR encryption key provided. This is unexpected.",
+    [BrowserAuthErrorCodes.earJweEmpty]:
+        "Server response does not contain ear_jwe property. This is unexpected.",
     [BrowserAuthErrorCodes.cryptoNonExistent]:
         "The crypto object or function is not available.",
     [BrowserAuthErrorCodes.emptyNavigateUri]:
@@ -52,8 +56,6 @@ export const BrowserAuthErrorMessages = {
         "No token request found in cache.",
     [BrowserAuthErrorCodes.unableToParseTokenRequestCacheError]:
         "The cached token request could not be parsed.",
-    [BrowserAuthErrorCodes.noCachedAuthorityError]:
-        "No cached authority found.",
     [BrowserAuthErrorCodes.authRequestNotSetError]:
         "Auth Request not set. Please ensure initiateAuthRequest was called from the InteractionHandler",
     [BrowserAuthErrorCodes.invalidCacheType]: "Invalid cache type",
@@ -96,6 +98,8 @@ export const BrowserAuthErrorMessages = {
         "Failed to build request headers object.",
     [BrowserAuthErrorCodes.failedToParseHeaders]:
         "Failed to parse response headers",
+    [BrowserAuthErrorCodes.failedToDecryptEarResponse]:
+        "Failed to decrypt ear response",
 };
 
 /**
@@ -221,12 +225,6 @@ export const BrowserAuthErrorMessage = {
             BrowserAuthErrorCodes.unableToParseTokenRequestCacheError
         ],
     },
-    noCachedAuthorityError: {
-        code: BrowserAuthErrorCodes.noCachedAuthorityError,
-        desc: BrowserAuthErrorMessages[
-            BrowserAuthErrorCodes.noCachedAuthorityError
-        ],
-    },
     authRequestNotSet: {
         code: BrowserAuthErrorCodes.authRequestNotSetError,
         desc: BrowserAuthErrorMessages[

package/src/error/BrowserAuthErrorCodes.ts

@@ -4,6 +4,8 @@
  */
 
 export const pkceNotCreated = "pkce_not_created";
+export const earJwkEmpty = "ear_jwk_empty";
+export const earJweEmpty = "ear_jwe_empty";
 export const cryptoNonExistent = "crypto_nonexistent";
 export const emptyNavigateUri = "empty_navigate_uri";
 export const hashEmptyError = "hash_empty_error";
@@ -28,7 +30,6 @@ export const silentPromptValueError = "silent_prompt_value_error";
 export const noTokenRequestCacheError = "no_token_request_cache_error";
 export const unableToParseTokenRequestCacheError =
     "unable_to_parse_token_request_cache_error";
-export const noCachedAuthorityError = "no_cached_authority_error";
 export const authRequestNotSetError = "auth_request_not_set_error";
 export const invalidCacheType = "invalid_cache_type";
 export const nonBrowserEnvironment = "non_browser_environment";
@@ -58,3 +59,4 @@ export const invalidBase64String = "invalid_base64_string";
 export const invalidPopTokenRequest = "invalid_pop_token_request";
 export const failedToBuildHeaders = "failed_to_build_headers";
 export const failedToParseHeaders = "failed_to_parse_headers";
+export const failedToDecryptEarResponse = "failed_to_decrypt_ear_response";

package/src/interaction_client/NativeInteractionClient.ts

@@ -446,14 +446,12 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 request,
                 reqTimestamp
             );
-            this.browserStorage.setInteractionInProgress(false);
             const res = await result;
             const serverTelemetryManager =
                 this.initializeServerTelemetryManager(this.apiId);
             serverTelemetryManager.clearNativeBrokerErrorCode();
             return res;
         } catch (e) {
-            this.browserStorage.setInteractionInProgress(false);
             throw e;
         }
     }
@@ -498,7 +496,15 @@ export class NativeInteractionClient extends BaseInteractionClient {
                 nativeAccountId: request.accountId,
             })?.homeAccountId;
 
+        // add exception for double brokering, please note this is temporary and will be fortified in future
         if (
+            request.extraParameters?.child_client_id &&
+            response.account.id !== request.accountId
+        ) {
+            this.logger.info(
+                "handleNativeServerResponse: Double broker flow detected, ignoring accountId mismatch"
+            );
+        } else if (
             homeAccountIdentifier !== cachedhomeAccountId &&
             response.account.id !== request.accountId
         ) {
@@ -525,6 +531,9 @@ export class NativeInteractionClient extends BaseInteractionClient {
             this.logger
         );
 
+        // Ensure expires_in is in number format
+        response.expires_in = Number(response.expires_in);
+
         // generate authenticationResult
         const result = await this.generateAuthenticationResult(
             response,