@azure/msal-browser 5.0.0-alpha.0 → 5.0.0-beta.0

package/src/interaction_handler/SilentHandler.ts

@@ -7,7 +7,6 @@ import {
     Logger,
     IPerformanceClient,
     invoke,
-    Constants,
     Authority,
     CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
@@ -16,11 +15,8 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError.js";
-import {
-    BrowserConfiguration,
-    DEFAULT_IFRAME_TIMEOUT_MS,
-} from "../config/Configuration.js";
-import { getEARForm } from "../protocol/Authorize.js";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { getCodeForm, getEARForm } from "../protocol/Authorize.js";
 
 /**
  * Creates a hidden iframe to given URL using user-requested scopes as an id.
@@ -48,7 +44,7 @@ export async function initiateCodeRequest(
     )(requestUrl);
 }
 
-export async function initiateEarRequest(
+export async function initiateCodeFlowWithPost(
     config: BrowserConfiguration,
     authority: Authority,
     request: CommonAuthorizationUrlRequest,
@@ -59,7 +55,7 @@ export async function initiateEarRequest(
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
-    const form = await getEARForm(
+    const form = await getCodeForm(
         frame.contentDocument,
         config,
         authority,
@@ -71,78 +67,27 @@ export async function initiateEarRequest(
     return frame;
 }
 
-/**
- * Monitors an iframe content window until it loads a url with a known hash, or hits a specified timeout.
- * @param iframe
- * @param timeout
- */
-export async function monitorIframeForHash(
-    iframe: HTMLIFrameElement,
-    timeout: number,
-    pollIntervalMilliseconds: number,
-    performanceClient: IPerformanceClient,
+export async function initiateEarRequest(
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
     logger: Logger,
-    correlationId: string,
-    responseType: Constants.ResponseMode
-): Promise<string> {
-    return new Promise<string>((resolve, reject) => {
-        if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
-            logger.warning(
-                `system.loadFrameTimeout or system.iframeHashTimeout set to lower (${timeout}ms) than the default (${DEFAULT_IFRAME_TIMEOUT_MS}ms). This may result in timeouts.`,
-                correlationId
-            );
-        }
-
-        /*
-         * Polling for iframes can be purely timing based,
-         * since we don't need to account for interaction.
-         */
-        const timeoutId = window.setTimeout(() => {
-            window.clearInterval(intervalId);
-            reject(
-                createBrowserAuthError(
-                    BrowserAuthErrorCodes.monitorWindowTimeout
-                )
-            );
-        }, timeout);
-
-        const intervalId = window.setInterval(() => {
-            let href: string = "";
-            const contentWindow = iframe.contentWindow;
-            try {
-                /*
-                 * Will throw if cross origin,
-                 * which should be caught and ignored
-                 * since we need the interval to keep running while on STS UI.
-                 */
-                href = contentWindow ? contentWindow.location.href : "";
-            } catch (e) {}
-
-            if (!href || href === "about:blank") {
-                return;
-            }
-
-            let responseString = "";
-            if (contentWindow) {
-                if (responseType === Constants.ResponseMode.QUERY) {
-                    responseString = contentWindow.location.search;
-                } else {
-                    responseString = contentWindow.location.hash;
-                }
-            }
-            window.clearTimeout(timeoutId);
-            window.clearInterval(intervalId);
-            resolve(responseString);
-        }, pollIntervalMilliseconds);
-    }).finally(() => {
-        invoke(
-            removeHiddenIframe,
-            BrowserPerformanceEvents.RemoveHiddenIframe,
-            logger,
-            performanceClient,
-            correlationId
-        )(iframe);
-    });
+    performanceClient: IPerformanceClient
+): Promise<HTMLIFrameElement> {
+    const frame = createHiddenIframe();
+    if (!frame.contentDocument) {
+        throw "No document associated with iframe!";
+    }
+    const form = await getEARForm(
+        frame.contentDocument,
+        config,
+        authority,
+        request,
+        logger,
+        performanceClient
+    );
+    form.submit();
+    return frame;
 }
 
 /**
@@ -177,18 +122,8 @@ function createHiddenIframe(): HTMLIFrameElement {
         "sandbox",
         "allow-scripts allow-same-origin allow-forms"
     );
+    authFrame.setAttribute("allow", "local-network-access *");
     document.body.appendChild(authFrame);
 
     return authFrame;
 }
-
-/**
- * @hidden
- * Removes a hidden iframe from the page.
- * @ignore
- */
-function removeHiddenIframe(iframe: HTMLIFrameElement): void {
-    if (document.body === iframe.parentNode) {
-        document.body.removeChild(iframe);
-    }
-}

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.0.0-alpha.0";
+export const version = "5.0.0-beta.0";

package/src/protocol/Authorize.ts

@@ -160,10 +160,11 @@ export async function getAuthCodeRequestUrl(
         Constants.S256_CODE_CHALLENGE_METHOD
     );
 
-    RequestParameterBuilder.addExtraQueryParameters(
-        parameters,
-        request.extraQueryParameters || {}
-    );
+    // Merge extraQueryParameters and extraParameters to be appended to request URL
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraQueryParameters,
+        ...request.extraParameters,
+    });
 
     return AuthorizeProtocol.getAuthorizeUrl(authority, parameters);
 }
@@ -197,11 +198,69 @@ export async function getEARForm(
     );
     RequestParameterBuilder.addEARParameters(parameters, request.earJwk);
 
+    // Also add codeChallenge as backup in case EAR is not supported
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraParameters,
+    });
+
+    const queryParams = new Map<string, string>();
+    RequestParameterBuilder.addExtraParameters(
+        queryParams,
+        request.extraQueryParameters || {}
+    );
+    const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
+
+    return createForm(frame, url, parameters);
+}
+
+/**
+ * Gets the form that will be posted to /authorize with request parameters when using POST method
+ */
+export async function getCodeForm(
+    frame: Document,
+    config: BrowserConfiguration,
+    authority: Authority,
+    request: CommonAuthorizationUrlRequest,
+    logger: Logger,
+    performanceClient: IPerformanceClient
+): Promise<HTMLFormElement> {
+    const parameters = await getStandardParameters(
+        config,
+        authority,
+        request,
+        logger,
+        performanceClient
+    );
+
+    RequestParameterBuilder.addResponseType(
+        parameters,
+        Constants.OAuthResponseType.CODE
+    );
+
+    RequestParameterBuilder.addCodeChallengeParams(
+        parameters,
+        request.codeChallenge,
+        request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD
+    );
+
+    // Add extraParameters to the request body
+    RequestParameterBuilder.addExtraParameters(parameters, {
+        ...request.extraParameters,
+    });
+
+    // Add extraQueryParameters to be appended to request URL
     const queryParams = new Map<string, string>();
-    RequestParameterBuilder.addExtraQueryParameters(
+    RequestParameterBuilder.addExtraParameters(
         queryParams,
         request.extraQueryParameters || {}
     );
+
     const url = AuthorizeProtocol.getAuthorizeUrl(authority, queryParams);
 
     return createForm(frame, url, parameters);
@@ -288,7 +347,7 @@ export async function handleResponsePlatformBroker(
         request.correlationId
     );
     const { userRequestState } = ProtocolUtils.parseRequestState(
-        browserCrypto,
+        browserCrypto.base64Decode,
         request.state
     );
     return invokeAsync(

package/src/redirect_bridge/index.ts

@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { parseAuthResponseFromUrl } from "../utils/BrowserUtils.js";
+import * as BrowserUtils from "../utils/BrowserUtils.js";
+import {
+    ApiId,
+    InteractionType,
+    TemporaryCacheKeys,
+} from "../utils/BrowserConstants.js";
+import { NavigationOptions } from "../navigation/NavigationOptions.js";
+import { DEFAULT_REDIRECT_TIMEOUT_MS } from "../config/Configuration.js";
+import { NavigationClient } from "../navigation/NavigationClient.js";
+import { PREFIX } from "../cache/CacheKeys.js";
+
+/**
+ * Processes the authentication response from the redirect URL
+ * For SSO and popup scenarios broadcasts it to the main frame
+ * For redirect scenario navigates to the home page
+ *
+ * @param {NavigationClient} navigationClient - Optional navigation client for redirect scenario.
+ *
+ * @returns {Promise<void>} A promise that resolves when the response has been broadcast and cleanup is complete.
+ *
+ * @throws {AuthError} If no authentication payload is found in the URL (hash or query string).
+ * @throws {AuthError} If the state parameter is missing from the redirect URL.
+ * @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
+ */
+export async function broadcastResponseToMainFrame(
+    navigationClient?: NavigationClient
+): Promise<void> {
+    let parsedResponse;
+    try {
+        parsedResponse = parseAuthResponseFromUrl();
+    } catch (error) {
+        // Clear hash and query string before re-throwing parse errors
+        if (typeof window.history.replaceState === "function") {
+            window.history.replaceState(
+                null,
+                "",
+                `${window.location.origin}${window.location.pathname}`
+            );
+        }
+        throw error;
+    }
+
+    const {
+        payload,
+        urlHash,
+        urlQuery,
+        hasResponseInHash,
+        hasResponseInQuery,
+        libraryState,
+    } = parsedResponse;
+
+    const { id, meta } = libraryState;
+
+    if (meta["interactionType"] === InteractionType.Redirect) {
+        const navClient = navigationClient || new NavigationClient();
+        const navigationOptions: NavigationOptions = {
+            apiId: ApiId.handleRedirectPromise,
+            noHistory: true,
+            timeout: DEFAULT_REDIRECT_TIMEOUT_MS,
+        };
+
+        let navigateToUrl = "";
+        const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}}`;
+        try {
+            /*
+             * Retrieve the original navigation URL from sessionStorage
+             */
+            const { clientId } = JSON.parse(
+                window.sessionStorage.getItem(interactionKey) || ""
+            );
+            if (clientId) {
+                const cacheKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
+                navigateToUrl = window.sessionStorage.getItem(cacheKey) || "";
+            }
+        } catch (e) {
+            // SessionStorage access may fail in some contexts, use default
+        }
+
+        // Reconstruct full URL with auth response (preserve original format)
+        let fullUrlResponse = "";
+        if (hasResponseInHash && hasResponseInQuery) {
+            // Hybrid format
+            fullUrlResponse = `${urlQuery}${urlHash}`;
+        } else if (hasResponseInHash) {
+            // Hash only
+            fullUrlResponse = urlHash;
+        } else {
+            // Query only
+            fullUrlResponse = urlQuery;
+        }
+
+        const homepage = `${
+            navigateToUrl || BrowserUtils.getHomepage()
+        }${fullUrlResponse}`;
+        await navClient.navigateInternal(homepage, navigationOptions);
+
+        // Do NOT clear URL for redirect flow - we're navigating away anyway
+        return;
+    }
+
+    // Clear only the part(s) containing the auth response from redirect bridge URL
+    if (typeof window.history.replaceState === "function") {
+        let newUrl = `${window.location.origin}${window.location.pathname}`;
+        // Preserve hash if it didn't contain the response
+        if (!hasResponseInHash && urlHash) {
+            newUrl += urlHash;
+        }
+        // Preserve query if it didn't contain the response
+        if (!hasResponseInQuery && urlQuery) {
+            newUrl += urlQuery;
+        }
+        window.history.replaceState(null, "", newUrl);
+    }
+
+    // Send the raw URL payload to the main frame
+    const channel = new BroadcastChannel(id);
+    channel.postMessage({
+        v: 1,
+        payload,
+    });
+    channel.close();
+    try {
+        window.close();
+    } catch {}
+}

package/src/request/EndSessionPopupRequest.ts

@@ -18,9 +18,7 @@ import { PopupWindowAttributes } from "./PopupWindowAttributes.js";
  * - logoutHint             - A string that specifies the account that is being logged out in order to skip the server account picker on logout
  * - popupWindowParent      - Optional window object to use as the parent when opening popup windows. Uses global `window` if not given.
  */
-export type EndSessionPopupRequest = Partial<
-    Omit<CommonEndSessionRequest, "tokenQueryParameters">
-> & {
+export type EndSessionPopupRequest = Partial<CommonEndSessionRequest> & {
     authority?: string;
     mainWindowRedirectUri?: string;
     popupWindowAttributes?: PopupWindowAttributes;

package/src/request/EndSessionRequest.ts

@@ -12,12 +12,8 @@ import { CommonEndSessionRequest } from "@azure/msal-common/browser";
  * - authority              - Authority to send logout request to.
  * - correlationId          - Unique GUID set per request to trace a request end-to-end for telemetry purposes.
  * - idTokenHint            - ID Token used by B2C to validate logout if required by the policy
- * - onRedirectNavigate     - Callback that will be passed the url that MSAL will navigate to. Returning false in the callback will stop navigation.
  * - logoutHint             - A string that specifies the account that is being logged out in order to skip the server account picker on logout
  */
-export type EndSessionRequest = Partial<
-    Omit<CommonEndSessionRequest, "tokenQueryParameters">
-> & {
+export type EndSessionRequest = Partial<CommonEndSessionRequest> & {
     authority?: string;
-    onRedirectNavigate?: (url: string) => boolean | void;
 };

package/src/request/HandleRedirectPromiseOptions.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+export type HandleRedirectPromiseOptions = {
+    hash?: string;
+    navigateToLoginRequestUrl?: boolean;
+};

package/src/request/PopupRequest.ts

@@ -26,13 +26,13 @@ import { PopupWindowAttributes } from "./PopupWindowAttributes.js";
  * - loginHint                  - Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the login_hint or preferred_username claim.
  * - sid                        - Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
  * - domainHint                 - Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- * - extraQueryParameters       - String to string map of custom query parameters added to the /authorize call
- * - tokenBodyParameters        - String to string map of custom token request body parameters added to the /token call. Only used when renewing access tokens.
- * - tokenQueryParameters       - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters       - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters            - String to string map of custom query parameters added to outgoing token service requests
  * - claims                     - In cases where Azure AD tenant admin has enabled conditional access policies, and the policy has not been met, exceptions will contain claims that need to be consented to.
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  * - popupWindowAttributes      - Optional popup window attributes. popupSize with height and width, and popupPosition with top and left can be set.
  * - popupWindowParent          - Optional window object to use as the parent when opening popup windows. Uses global `window` if not given.
+ * - overrideInteractionInProgress - Optional flag to allow overriding an existing interaction_in_progress state for popup flows. **WARNING**: Use with caution! For usage details and examples, see the [login-user.md](../../../docs/login-user.md#handling-interaction_in_progress-errors) documentation.
  */
 
 export type PopupRequest = Partial<
@@ -49,4 +49,5 @@ export type PopupRequest = Partial<
     scopes: Array<string>;
     popupWindowAttributes?: PopupWindowAttributes;
     popupWindowParent?: Window;
+    overrideInteractionInProgress?: boolean;
 };

package/src/request/RedirectRequest.ts

@@ -25,9 +25,8 @@ import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
  * - loginHint                  - Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the login_hint or preferred_username claim.
  * - sid                        - Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
  * - domainHint                 - Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- * - extraQueryParameters       - String to string map of custom query parameters added to the /authorize call
- * - tokenBodyParameters        - String to string map of custom token request body parameters added to the /token call. Only used when renewing access tokens.
- * - tokenQueryParameters       - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters       - String to string map of custom query parameters added to outgoing token service requests
+ * - extraParameters            - String to string map of custom query parameters added to outgoing token service requests
  * - claims                     - In cases where Azure AD tenant admin has enabled conditional access policies, and the policy has not been met, exceptions will contain claims that need to be consented to.
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  * - redirectStartPage          - The page that should be returned to after loginRedirect or acquireTokenRedirect. This should only be used if this is different from the redirectUri and will default to the page that initiates the request. When the navigateToLoginRequestUrl config option is set to false this parameter will be ignored.

package/src/request/RequestHelpers.ts

@@ -11,12 +11,15 @@ import {
     CommonSilentFlowRequest,
     IPerformanceClient,
     Logger,
+    ProtocolMode,
     createClientConfigurationError,
     invokeAsync,
 } from "@azure/msal-common/browser";
 import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import { BrowserConfiguration } from "../config/Configuration.js";
 import { SilentRequest } from "./SilentRequest.js";
+import { PopupRequest } from "./PopupRequest.js";
+import { RedirectRequest } from "./RedirectRequest.js";
 
 /**
  * Initializer function for all request APIs
@@ -98,3 +101,34 @@ export async function initializeSilentRequest(
         forceRefresh: request.forceRefresh || false,
     };
 }
+
+/**
+ * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
+ * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
+ * @param interactionRequest
+ * @param protocolMode
+ * @returns
+ */
+export function validateRequestMethod(
+    interactionRequest: BaseAuthRequest | PopupRequest | RedirectRequest,
+    protocolMode: ProtocolMode
+): Constants.HttpMethod {
+    let httpMethod: Constants.HttpMethod | undefined;
+    const requestMethod = interactionRequest.httpMethod;
+
+    if (protocolMode === ProtocolMode.EAR) {
+        // Validate that method can only be POST when protocol mode is EAR
+        if (requestMethod && requestMethod !== Constants.HttpMethod.POST) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.invalidRequestMethodForEAR
+            );
+        } else {
+            httpMethod = Constants.HttpMethod.POST;
+        }
+    } else {
+        // For non-EAR protocol modes, default to GET if httpMethod is not set
+        httpMethod = requestMethod || Constants.HttpMethod.GET;
+    }
+
+    return httpMethod;
+}

package/src/request/SilentRequest.ts

@@ -20,9 +20,8 @@ import { CacheLookupPolicy } from "../utils/BrowserConstants.js";
  * - correlationId          - Unique GUID set per request to trace a request end-to-end for telemetry purposes.
  * - account                - Account entity to lookup the credentials.
  * - forceRefresh           - Forces silent requests to make network calls if true.
- * - extraQueryParameters   - String to string map of custom query parameters added to the /authorize call. Only used when renewing the refresh token.
- * - tokenBodyParameters    - String to string map of custom token request body parameters added to the /token call. Only used when renewing access tokens.
- * - tokenQueryParameters   - String to string map of custom query parameters added to the /token call. Only used when renewing access tokens.
+ * - extraQueryParameters   - String to string map of custom query parameters added to outgoing token service requests. Only used when renewing access tokens.
+ * - extraParameters        - String to string map of custom query parameters added to outgoing token service requests. only used when renewing access tokens.
  * - redirectUri            - The redirect URI where authentication responses can be received by your application. It must exactly match one of the redirect URIs registered in the Azure portal. Only used for cases where refresh token is expired.
  * - cacheLookupPolicy      - Enum of different ways the silent token can be retrieved.
  * - prompt                 - Indicates the type of user interaction that is required.

package/src/request/SsoSilentRequest.ts

@@ -25,9 +25,8 @@ import { CommonAuthorizationUrlRequest } from "@azure/msal-common/browser";
  * - loginHint                  - Can be used to pre-fill the username/email address field of the sign-in page for the user, if you know the username/email address ahead of time. Often apps use this parameter during re-authentication, having already extracted the username from a previous sign-in using the login_hint or preferred_username claim.
  * - sid                        - Session ID, unique identifier for the session. Available as an optional claim on ID tokens.
  * - domainHint                 - Provides a hint about the tenant or domain that the user should use to sign in. The value of the domain hint is a registered domain for the tenant.
- * - extraQueryParameters       - String to string map of custom query parameters added to the /authorize call
- * - tokenBodyParameters        - String to string map of custom token request body parameters added to the /token call. Only used when renewing access tokens.
- * - tokenQueryParameters       - String to string map of custom query parameters added to the /token call
+ * - extraQueryParameters       - String to string map of custom query parameters added to outgoing token service requests. Only used when renewing access tokens.
+ * - extraParameters            - String to string map of custom query parameters added to outgoing token service requests. Only used when renewing access tokens.
  * - nonce                      - A value included in the request that is returned in the id token. A randomly generated unique value is typically used to mitigate replay attacks.
  */
 export type SsoSilentRequest = Partial<

package/src/telemetry/BrowserPerformanceClient.ts

@@ -4,6 +4,7 @@
  */
 
 import {
+    AccountInfo,
     Constants,
     InProgressPerformanceEvent,
     IPerformanceClient,
@@ -156,7 +157,8 @@ export class BrowserPerformanceClient
             ...inProgressEvent,
             end: (
                 event?: Partial<PerformanceEvent>,
-                error?: unknown
+                error?: unknown,
+                account?: AccountInfo
             ): PerformanceEvent | null => {
                 const res = inProgressEvent.end(
                     {
@@ -165,7 +167,8 @@ export class BrowserPerformanceClient
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                     },
-                    error
+                    error,
+                    account
                 );
                 void browserMeasurement?.then((measurement) =>
                     measurement.endMeasurement()

package/src/telemetry/BrowserPerformanceEvents.ts

@@ -139,7 +139,6 @@ export const HandleCodeResponse = "handleCodeResponse";
 export const HandleResponseEar = "handleResponseEar";
 export const HandleResponsePlatformBroker = "handleResponsePlatformBroker";
 export const HandleResponseCode = "handleResponseCode";
-export const UpdateTokenEndpointAuthority = "updateTokenEndpointAuthority";
 
 export const AuthClientAcquireToken = "authClientAcquireToken";
 

package/src/utils/BrowserConstants.ts

@@ -31,10 +31,6 @@ export const BrowserConstants = {
      * Name of the popup window starts with
      */
     POPUP_NAME_PREFIX: "msal",
-    /**
-     * Default popup monitor poll interval in milliseconds
-     */
-    DEFAULT_POLL_INTERVAL_MS: 30,
     /**
      * Msal-browser SKU
      */

package/src/utils/BrowserProtocolUtils.ts

@@ -31,7 +31,7 @@ export function extractBrowserRequestState(
 
     try {
         const requestStateObj: RequestStateObject =
-            ProtocolUtils.parseRequestState(browserCrypto, state);
+            ProtocolUtils.parseRequestState(browserCrypto.base64Decode, state);
         return requestStateObj.libraryState.meta as BrowserStateObject;
     } catch (e) {
         throw createClientAuthError(ClientAuthErrorCodes.invalidState);