@azure/msal-browser 5.0.0-alpha.0 → 5.0.0-beta.0

package/src/interaction_client/RedirectClient.ts

@@ -57,7 +57,7 @@ import {
     getDiscoveredAuthority,
     initializeServerTelemetryManager,
 } from "./BaseInteractionClient.js";
-import { HandleRedirectPromiseOptions } from "../controllers/IController.js";
+import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
 
 function getNavigationType(): NavigationTimingType | undefined {
     if (
@@ -218,38 +218,42 @@ export class RedirectClient extends StandardInteractionClient {
         );
 
         try {
-            // Initialize the client
-            const authClient: AuthorizationCodeClient = await invokeAsync(
-                this.createAuthCodeClient.bind(this),
-                BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
-                this.logger,
-                this.performanceClient,
-                this.correlationId
-            )({
-                serverTelemetryManager,
-                requestAuthority: redirectRequest.authority,
-                requestAzureCloudOptions: redirectRequest.azureCloudOptions,
-                requestExtraQueryParameters:
-                    redirectRequest.extraQueryParameters,
-                account: redirectRequest.account,
-            });
-
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(
-                this.config,
-                authClient.authority,
-                redirectRequest,
-                this.logger,
-                this.performanceClient
-            );
-            // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-            return await this.initiateAuthRequest(navigateUrl);
+            if (redirectRequest.httpMethod === Constants.HttpMethod.POST) {
+                return await this.executeCodeFlowWithPost(redirectRequest);
+            } else {
+                // Initialize the client
+                const authClient: AuthorizationCodeClient = await invokeAsync(
+                    this.createAuthCodeClient.bind(this),
+                    BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                    this.logger,
+                    this.performanceClient,
+                    this.correlationId
+                )({
+                    serverTelemetryManager,
+                    requestAuthority: redirectRequest.authority,
+                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                    requestExtraQueryParameters:
+                        redirectRequest.extraQueryParameters,
+                    account: redirectRequest.account,
+                });
+
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    redirectRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+                // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
+                return await this.initiateAuthRequest(navigateUrl);
+            }
         } catch (e) {
             if (e instanceof AuthError) {
                 e.setCorrelationId(this.correlationId);
@@ -299,13 +303,24 @@ export class RedirectClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            BrowserPerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
+
         const redirectRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
+
         this.browserStorage.cacheAuthorizeRequest(
             redirectRequest,
-            this.correlationId
+            this.correlationId,
+            pkceCodes.verifier
         );
 
         const form = await Authorize.getEARForm(
@@ -329,6 +344,53 @@ export class RedirectClient extends StandardInteractionClient {
         });
     }
 
+    /**
+     * Executes classic Authorization Code flow with a POST request.
+     * @param request
+     */
+    async executeCodeFlowWithPost(
+        request: CommonAuthorizationUrlRequest
+    ): Promise<void> {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(
+            getDiscoveredAuthority,
+            BrowserPerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(
+            this.config,
+            this.correlationId,
+            this.performanceClient,
+            this.browserStorage,
+            this.logger
+        );
+
+        this.browserStorage.cacheAuthorizeRequest(request, this.correlationId);
+
+        const form = await Authorize.getCodeForm(
+            document,
+            this.config,
+            discoveredAuthority,
+            request,
+            this.logger,
+            this.performanceClient
+        );
+
+        form.submit();
+        return new Promise<void>((resolve, reject) => {
+            setTimeout(() => {
+                reject(
+                    createBrowserAuthError(
+                        BrowserAuthErrorCodes.timedOut,
+                        "failed_to_redirect"
+                    )
+                );
+            }, this.config.system.redirectNavigationTimeout);
+        });
+    }
+
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate
@@ -790,36 +852,16 @@ export class RedirectClient extends StandardInteractionClient {
                 account: (logoutRequest && logoutRequest.account) || undefined,
             });
 
-            // Create a serializable version of the request for events
-            const {
-                // @ts-ignore
-                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                onRedirectNavigate,
-                ...serializableLogoutRequest
-            } = validLogoutRequest;
-
             if (authClient.authority.protocolMode === ProtocolMode.OIDC) {
                 try {
                     authClient.authority.endSessionEndpoint;
                 } catch {
                     if (validLogoutRequest.account?.homeAccountId) {
-                        if (
-                            // @ts-ignore
-                            typeof validLogoutRequest.onRedirectNavigate ===
-                            "function"
-                        ) {
-                            this.eventHandler.emitEvent(
-                                EventType.LOGOUT_SUCCESS,
-                                InteractionType.Redirect,
-                                serializableLogoutRequest
-                            );
-                        } else {
-                            this.eventHandler.emitEvent(
-                                EventType.LOGOUT_SUCCESS,
-                                InteractionType.Redirect,
-                                validLogoutRequest
-                            );
-                        }
+                        this.eventHandler.emitEvent(
+                            EventType.LOGOUT_SUCCESS,
+                            InteractionType.Redirect,
+                            validLogoutRequest
+                        );
                         return;
                     }
                 }
@@ -830,29 +872,16 @@ export class RedirectClient extends StandardInteractionClient {
                 authClient.getLogoutUri(validLogoutRequest);
 
             if (validLogoutRequest.account?.homeAccountId) {
-                if (
-                    // @ts-ignore
-                    typeof validLogoutRequest.onRedirectNavigate === "function"
-                ) {
-                    this.eventHandler.emitEvent(
-                        EventType.LOGOUT_SUCCESS,
-                        InteractionType.Redirect,
-                        serializableLogoutRequest
-                    );
-                } else {
-                    this.eventHandler.emitEvent(
-                        EventType.LOGOUT_SUCCESS,
-                        InteractionType.Redirect,
-                        validLogoutRequest
-                    );
-                }
+                this.eventHandler.emitEvent(
+                    EventType.LOGOUT_SUCCESS,
+                    InteractionType.Redirect,
+                    validLogoutRequest
+                );
             }
             // Check if onRedirectNavigate is implemented, and invoke it if so
-            if (
-                logoutRequest &&
-                typeof logoutRequest.onRedirectNavigate === "function"
-            ) {
-                const navigate = logoutRequest.onRedirectNavigate(logoutUri);
+            const onRedirectNavigate = this.config.auth.onRedirectNavigate;
+            if (typeof onRedirectNavigate === "function") {
+                const navigate = onRedirectNavigate(logoutUri);
 
                 if (navigate !== false) {
                     this.logger.verbose(

package/src/interaction_client/SilentIframeClient.ts

@@ -36,8 +36,8 @@ import {
 } from "../utils/BrowserConstants.js";
 import {
     initiateCodeRequest,
+    initiateCodeFlowWithPost,
     initiateEarRequest,
-    monitorIframeForHash,
 } from "../interaction_handler/SilentHandler.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
@@ -264,11 +264,19 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            BrowserPerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
-        const msalFrame = await invokeAsync(
+        await invokeAsync(
             initiateEarRequest,
             BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
@@ -283,21 +291,17 @@ export class SilentIframeClient extends StandardInteractionClient {
         );
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
-            monitorIframeForHash,
+            BrowserUtils.waitForBridgeResponse,
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
         )(
-            msalFrame,
-            this.config.system.iframeHashTimeout,
-            this.config.system.pollIntervalMilliseconds,
-            this.performanceClient,
+            this.config.system.iframeBridgeTimeout,
             this.logger,
-            correlationId,
-            responseType
+            this.browserCrypto,
+            request
         );
 
         const serverParams = invoke(
@@ -308,25 +312,70 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId
         )(responseString, responseType, this.logger, this.correlationId);
 
-        return invokeAsync(
-            Authorize.handleResponseEAR,
-            BrowserPerformanceEvents.HandleResponseEar,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            silentRequest,
-            serverParams,
-            this.apiId,
-            this.config,
-            discoveredAuthority,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        if (!serverParams.ear_jwe && serverParams.code) {
+            // If server doesn't support EAR, they may fallback to auth code flow instead
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )({
+                serverTelemetryManager: initializeServerTelemetryManager(
+                    this.apiId,
+                    this.config.auth.clientId,
+                    correlationId,
+                    this.browserStorage,
+                    this.logger
+                ),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+
+            return invokeAsync(
+                Authorize.handleResponseCode,
+                BrowserPerformanceEvents.HandleResponseCode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                pkceCodes.verifier,
+                this.apiId,
+                this.config,
+                authClient,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        } else {
+            return invokeAsync(
+                Authorize.handleResponseEAR,
+                BrowserPerformanceEvents.HandleResponseEar,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                this.apiId,
+                this.config,
+                discoveredAuthority,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        }
     }
 
     /**
@@ -364,47 +413,62 @@ export class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        // Create authorize request url
-        const navigateUrl = await invokeAsync(
-            Authorize.getAuthCodeRequestUrl,
-            PerformanceEvents.GetAuthCodeUrl,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config,
-            authClient.authority,
-            silentRequest,
-            this.logger,
-            this.performanceClient
-        );
 
-        // Get the frame handle for the silent request
-        const msalFrame = await invokeAsync(
-            initiateCodeRequest,
-            BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(navigateUrl, this.performanceClient, this.logger, correlationId);
+        if (request.httpMethod === Constants.HttpMethod.POST) {
+            await invokeAsync(
+                initiateCodeFlowWithPost,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config,
+                authClient.authority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+        } else {
+            // Create authorize request url
+            const navigateUrl = await invokeAsync(
+                Authorize.getAuthCodeRequestUrl,
+                PerformanceEvents.GetAuthCodeUrl,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config,
+                authClient.authority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+
+            // Get the frame handle for the silent request
+            await invokeAsync(
+                initiateCodeRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(navigateUrl, this.performanceClient, this.logger, correlationId);
+        }
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        // Wait for response from the redirect bridge.
         const responseString = await invokeAsync(
-            monitorIframeForHash,
+            BrowserUtils.waitForBridgeResponse,
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
         )(
-            msalFrame,
-            this.config.system.iframeHashTimeout,
-            this.config.system.pollIntervalMilliseconds,
-            this.performanceClient,
+            this.config.system.iframeBridgeTimeout,
             this.logger,
-            correlationId,
-            responseType
+            this.browserCrypto,
+            request
         );
+
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
             BrowserPerformanceEvents.DeserializeResponse,

package/src/interaction_client/StandardInteractionClient.ts

@@ -20,6 +20,7 @@ import {
     ICrypto,
     Logger,
     IPerformanceClient,
+    Authority,
 } from "@azure/msal-common/browser";
 import {
     BaseInteractionClient,
@@ -39,9 +40,12 @@ import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { createNewGuid } from "../crypto/BrowserCrypto.js";
-import { initializeBaseRequest } from "../request/RequestHelpers.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
+import {
+    initializeBaseRequest,
+    validateRequestMethod,
+} from "../request/RequestHelpers.js";
 
 /**
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
@@ -196,6 +200,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         requestAzureCloudOptions?: AzureCloudOptions;
         requestExtraQueryParameters?: StringDict;
         account?: AccountInfo;
+        authority?: Authority;
     }): Promise<AuthorizationCodeClient> {
         // Create auth module.
         const clientConfig = await invokeAsync(
@@ -228,6 +233,7 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         requestAzureCloudOptions?: AzureCloudOptions;
         requestExtraQueryParameters?: StringDict;
         account?: AccountInfo;
+        authority?: Authority;
     }): Promise<ClientConfiguration> {
         const {
             serverTelemetryManager,
@@ -237,23 +243,25 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
             account,
         } = params;
 
-        const discoveredAuthority = await invokeAsync(
-            getDiscoveredAuthority,
-            BrowserPerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(
-            this.config,
-            this.correlationId,
-            this.performanceClient,
-            this.browserStorage,
-            this.logger,
-            requestAuthority,
-            requestAzureCloudOptions,
-            requestExtraQueryParameters,
-            account
-        );
+        const discoveredAuthority =
+            params.authority ||
+            (await invokeAsync(
+                getDiscoveredAuthority,
+                BrowserPerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
+                this.logger,
+                this.performanceClient,
+                this.correlationId
+            )(
+                this.config,
+                this.correlationId,
+                this.performanceClient,
+                this.browserStorage,
+                this.logger,
+                requestAuthority,
+                requestAzureCloudOptions,
+                requestExtraQueryParameters,
+                account
+            ));
         const logger = this.config.system.loggerOptions;
 
         return {
@@ -341,7 +349,7 @@ export async function initializeAuthorizationRequest(
         correlationId
     );
 
-    const validatedRequest: CommonAuthorizationUrlRequest = {
+    const interactionRequest: CommonAuthorizationUrlRequest = {
         ...baseRequest,
         redirectUri: redirectUri,
         state: state,
@@ -349,6 +357,14 @@ export async function initializeAuthorizationRequest(
         responseMode: config.auth.OIDCOptions.responseMode,
     };
 
+    const validatedRequest = {
+        ...interactionRequest,
+        httpMethod: validateRequestMethod(
+            interactionRequest,
+            config.system.protocolMode
+        ),
+    };
+
     // Skip active account lookup if either login hint or session id is set
     if (request.loginHint || request.sid) {
         return validatedRequest;

package/src/interaction_handler/InteractionHandler.ts

@@ -107,17 +107,6 @@ export class InteractionHandler {
         // Assign code to request
         this.authCodeRequest.code = authCodeResponse.code;
 
-        // Check for new cloud instance
-        if (authCodeResponse.cloud_instance_host_name) {
-            await invokeAsync(
-                this.authModule.updateAuthority.bind(this.authModule),
-                BrowserPerformanceEvents.UpdateTokenEndpointAuthority,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(authCodeResponse.cloud_instance_host_name, request.correlationId);
-        }
-
         // Nonce validation not needed when redirect not involved (e.g. hybrid spa, renewing token via rt)
         if (validateNonce) {
             // TODO: Assigning "response nonce" to "request nonce" is confusing. Refactor the function doing validation to accept request nonce directly