@azure/msal-browser 5.11.0 → 5.13.0

package/src/cache/BrowserCacheManager.ts

@@ -77,6 +77,23 @@ import { EncryptedData, isEncrypted } from "./EncryptedData.js";
 
 type KmsiMap = { [homeAccountId: string]: boolean };
 
+/**
+ * Reason an old-schema cache entry was removed during migration.
+ */
+const MigrationRemovalReason = {
+    Invalid: "invalid",
+    TtlExpired: "ttlExpired",
+    DecryptFailed: "decryptFailed",
+    Expired: "expired",
+} as const;
+
+type MigrationRemovalReason =
+    (typeof MigrationRemovalReason)[keyof typeof MigrationRemovalReason];
+
+type UpdateOldEntryResult =
+    | { entry: CredentialEntity; removalReason?: undefined }
+    | { entry: null; removalReason: MigrationRemovalReason };
+
 /**
  * This class implements the cache storage interface for MSAL through browser local or session storage.
  */
@@ -198,7 +215,7 @@ export class BrowserCacheManager extends CacheManager {
     async updateOldEntry(
         key: string,
         correlationId: string
-    ): Promise<CredentialEntity | null> {
+    ): Promise<UpdateOldEntryResult> {
         const rawValue = this.browserStorage.getItem(key);
         const parsedValue = this.validateAndParseJson(rawValue || "") as
             | CredentialEntity
@@ -207,7 +224,10 @@ export class BrowserCacheManager extends CacheManager {
 
         if (!parsedValue) {
             this.browserStorage.removeItem(key);
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
 
         if (!parsedValue.lastUpdatedAt) {
@@ -221,26 +241,38 @@ export class BrowserCacheManager extends CacheManager {
             )
         ) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields(
-                { expiredCacheRemovedCount: 1 },
-                correlationId
-            );
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.TtlExpired,
+            };
         }
 
-        const decryptedData = isEncrypted(parsedValue)
+        const wasEncrypted = isEncrypted(parsedValue);
+        const decryptedData = wasEncrypted
             ? await this.browserStorage.decryptData(
                   key,
                   parsedValue,
                   correlationId
               )
             : parsedValue;
-        if (!decryptedData || !CacheHelpers.isCredentialEntity(decryptedData)) {
-            this.performanceClient.incrementFields(
-                { invalidCacheCount: 1 },
-                correlationId
-            );
-            return null;
+
+        if (!decryptedData) {
+            this.browserStorage.removeItem(key);
+
+            return {
+                entry: null,
+                removalReason: wasEncrypted
+                    ? MigrationRemovalReason.DecryptFailed
+                    : MigrationRemovalReason.Invalid,
+            };
+        }
+
+        if (!CacheHelpers.isCredentialEntity(decryptedData)) {
+            this.browserStorage.removeItem(key);
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Invalid,
+            };
         }
 
         if (
@@ -253,14 +285,13 @@ export class BrowserCacheManager extends CacheManager {
             )
         ) {
             this.browserStorage.removeItem(key);
-            this.performanceClient.incrementFields(
-                { expiredCacheRemovedCount: 1 },
-                correlationId
-            );
-            return null;
+            return {
+                entry: null,
+                removalReason: MigrationRemovalReason.Expired,
+            };
         }
 
-        return decryptedData;
+        return { entry: decryptedData };
     }
 
     /**
@@ -295,6 +326,11 @@ export class BrowserCacheManager extends CacheManager {
                 | null;
 
             if (!parsedValue) {
+                this.browserStorage.removeItem(accountKey);
+                this.performanceClient.incrementFields(
+                    { invalidAcntCount: 1 },
+                    correlationId
+                );
                 removeElementFromArray(accountKeysToCheck, accountKey);
                 continue;
             }
@@ -321,7 +357,28 @@ export class BrowserCacheManager extends CacheManager {
                     credentialSchema,
                     correlationId
                 );
+                this.performanceClient.incrementFields(
+                    { ttlExpiredAcntCount: 1 },
+                    correlationId
+                );
                 removeElementFromArray(accountKeysToCheck, accountKey);
+            } else if (isEncrypted(parsedValue)) {
+                // Remove accounts encrypted with a different key (session cookie expired/changed)
+                const decrypted = await this.browserStorage.decryptData(
+                    accountKey,
+                    parsedValue,
+                    correlationId
+                );
+                if (!decrypted) {
+                    this.browserStorage.removeItem(accountKey);
+                    this.performanceClient.incrementFields(
+                        {
+                            decryptFailedAcntCount: 1,
+                        },
+                        correlationId
+                    );
+                    removeElementFromArray(accountKeysToCheck, accountKey);
+                }
             }
         }
 
@@ -373,11 +430,6 @@ export class BrowserCacheManager extends CacheManager {
             this.setTokenKeys(tokenKeys, correlationId, credentialSchema);
         }
 
-        this.performanceClient.incrementFields(
-            { expiredAcntRemovedCount: 1 },
-            correlationId
-        );
-
         this.browserStorage.removeItem(accountKey);
     }
 
@@ -442,11 +494,29 @@ export class BrowserCacheManager extends CacheManager {
                 correlationId
             );
 
-            const oldSchemaData = (await this.updateOldEntry(
-                idTokenKey,
-                correlationId
-            )) as IdTokenEntity | null;
+            const result = await this.updateOldEntry(idTokenKey, correlationId);
+            const oldSchemaData = result.entry as IdTokenEntity | null;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields(
+                            { ttlExpiredITCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields(
+                            { decryptFailedITCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields(
+                            { invalidITCount: 1 },
+                            correlationId
+                        );
+                        break;
+                }
                 removeElementFromArray(
                     credentialKeysToMigrate.idToken,
                     idTokenKey
@@ -611,11 +681,38 @@ export class BrowserCacheManager extends CacheManager {
                 correlationId
             );
 
-            const oldSchemaData = (await this.updateOldEntry(
+            const result = await this.updateOldEntry(
                 accessTokenKey,
                 correlationId
-            )) as AccessTokenEntity | null;
+            );
+            const oldSchemaData = result.entry as AccessTokenEntity | null;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields(
+                            { ttlExpiredATCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields(
+                            { decryptFailedATCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields(
+                            { expiredATCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields(
+                            { invalidATCount: 1 },
+                            correlationId
+                        );
+                        break;
+                }
                 removeElementFromArray(
                     credentialKeysToMigrate.accessToken,
                     accessTokenKey
@@ -715,11 +812,38 @@ export class BrowserCacheManager extends CacheManager {
                 correlationId
             );
 
-            const oldSchemaData = (await this.updateOldEntry(
+            const result = await this.updateOldEntry(
                 refreshTokenKey,
                 correlationId
-            )) as RefreshTokenEntity | null;
+            );
+            const oldSchemaData = result.entry as RefreshTokenEntity | null;
             if (!oldSchemaData) {
+                switch (result.removalReason) {
+                    case MigrationRemovalReason.TtlExpired:
+                        this.performanceClient.incrementFields(
+                            { ttlExpiredRTCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.DecryptFailed:
+                        this.performanceClient.incrementFields(
+                            { decryptFailedRTCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.Expired:
+                        this.performanceClient.incrementFields(
+                            { expiredRTCount: 1 },
+                            correlationId
+                        );
+                        break;
+                    case MigrationRemovalReason.Invalid:
+                        this.performanceClient.incrementFields(
+                            { invalidRTCount: 1 },
+                            correlationId
+                        );
+                        break;
+                }
                 removeElementFromArray(
                     credentialKeysToMigrate.refreshToken,
                     refreshTokenKey

package/src/config/Configuration.ts

@@ -167,6 +167,11 @@ export type BrowserSystemOptions = SystemOptions & {
      * Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
      */
     protocolMode?: ProtocolMode;
+    /**
+     * @deprecated This option will be removed in a future release.
+     * Flag to enable emitting telemetry to the STS. When disabled, failed requests are not cached to browser storage and x-client-current-telemetry, x-client-last-telemetry parameters are not sent to the STS. Defaults to false.
+     */
+    serverTelemetryEnabled?: boolean;
 };
 
 /** @internal */
@@ -315,6 +320,7 @@ export function buildConfiguration(
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
 
     const providedSystemOptions: Required<BrowserSystemOptions> = {

package/src/controllers/StandardController.ts

@@ -657,6 +657,12 @@ export class StandardController implements IController {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("acquireTokenRedirect called", correlationId);
 
+        BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(
+            true,
+            INTERACTION_TYPE.SIGNIN
+        );
+
         const atrMeasurement = this.performanceClient.startMeasurement(
             BrowserRootPerformanceEvents.AcquireTokenPreRedirect,
             correlationId
@@ -684,13 +690,7 @@ export class StandardController implements IController {
         };
 
         try {
-            BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
             enforceResourceParameter(this.config.auth.isMcp, request);
-            this.browserStorage.setInteractionInProgress(
-                true,
-                INTERACTION_TYPE.SIGNIN
-            );
-
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_START,
                 correlationId,
@@ -1912,7 +1912,8 @@ export class StandardController implements IController {
             this.performanceClient,
             this.nativeInternalStorage,
             correlationId,
-            this.platformAuthProvider
+            this.platformAuthProvider,
+            this.operatingContext.getResponseHandlers()?.waitForPopupResponse
         );
     }
 
@@ -1951,7 +1952,8 @@ export class StandardController implements IController {
             this.performanceClient,
             this.nativeInternalStorage,
             correlationId,
-            this.platformAuthProvider
+            this.platformAuthProvider,
+            this.operatingContext.getResponseHandlers()?.waitForIframeResponse
         );
     }
 

package/src/error/NativeAuthError.ts

@@ -99,9 +99,9 @@ export function createNativeAuthError(
                 return createBrowserAuthError(
                     BrowserAuthErrorCodes.noNetworkConnectivity
                 );
-            case NativeStatusCodes.UX_NOT_ALLOWED:
+            case NativeStatusCodes.UI_NOT_ALLOWED:
                 return createInteractionRequiredAuthError(
-                    InteractionRequiredAuthErrorCodes.uxNotAllowed
+                    InteractionRequiredAuthErrorCodes.uiNotAllowed
                 );
         }
     }

package/src/interaction_client/BaseInteractionClient.ts

@@ -10,6 +10,7 @@ import {
     AccountInfo,
     UrlString,
     ServerTelemetryManager,
+    StubServerTelemetryManager,
     ServerTelemetryRequest,
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
@@ -108,6 +109,7 @@ export function getRedirectUri(
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
 export function initializeServerTelemetryManager(
@@ -116,9 +118,18 @@ export function initializeServerTelemetryManager(
     correlationId: string,
     browserStorage: BrowserCacheManager,
     logger: Logger,
-    forceRefresh?: boolean
+    forceRefresh?: boolean,
+    enabled: boolean = true
 ): ServerTelemetryManager {
     logger.verbose("initializeServerTelemetryManager called", correlationId);
+    if (!enabled) {
+        logger.verbose(
+            "Server telemetry is disabled in configuration. Skipping telemetry manager initialization.",
+            correlationId
+        );
+        return new StubServerTelemetryManager();
+    }
+
     const telemetryPayload: ServerTelemetryRequest = {
         clientId: clientId,
         correlationId: correlationId,

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -72,6 +72,7 @@ import {
     PlatformAuthConstants,
     TemporaryCacheKeys,
 } from "../utils/BrowserConstants.js";
+import { getCurrentUri } from "../utils/BrowserUtils.js";
 import {
     BaseInteractionClient,
     getDiscoveredAuthority,
@@ -176,7 +177,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -368,7 +371,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                     this.config.auth.clientId,
                     this.correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 );
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
@@ -388,7 +393,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             noHistory: false,
         };
         const redirectUri = navigateToLoginRequestUrl
-            ? window.location.href
+            ? UrlString.getAbsoluteUrl(
+                  request.redirectStartPage || window.location.href,
+                  getCurrentUri()
+              )
             : getRedirectUri(
                   request.redirectUri,
                   this.config.auth.redirectUri,
@@ -468,7 +476,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             );
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields(

package/src/interaction_client/PopupClient.ts

@@ -59,6 +59,19 @@ import {
 } from "./BaseInteractionClient.js";
 import { validateRequestMethod } from "../request/RequestHelpers.js";
 
+/**
+ * Signature of the popup-response handler supplied by
+ * {@link PublicClientApplication} to {@link PopupClient} via the operating
+ * context.
+ *
+ * @internal
+ */
+export type WaitForPopupResponseFn = (
+    request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
+    popupWindow: Window,
+    popupWindowParent: Window
+) => Promise<string>;
+
 export type PopupParams = {
     popup?: Window | null;
     popupName: string;
@@ -69,6 +82,9 @@ export type PopupParams = {
 export class PopupClient extends StandardInteractionClient {
     private currentWindow: Window | undefined;
     protected nativeStorage: BrowserCacheManager;
+    private readonly waitForPopupResponseHook:
+        | WaitForPopupResponseFn
+        | undefined;
 
     constructor(
         config: BrowserConfiguration,
@@ -80,7 +96,8 @@ export class PopupClient extends StandardInteractionClient {
         performanceClient: IPerformanceClient,
         nativeStorageImpl: BrowserCacheManager,
         correlationId: string,
-        platformAuthHandler?: IPlatformAuthHandler
+        platformAuthHandler?: IPlatformAuthHandler,
+        waitForPopupResponseHook?: WaitForPopupResponseFn
     ) {
         super(
             config,
@@ -95,6 +112,7 @@ export class PopupClient extends StandardInteractionClient {
         );
         this.nativeStorage = nativeStorageImpl;
         this.eventHandler = eventHandler;
+        this.waitForPopupResponseHook = waitForPopupResponseHook;
     }
 
     /**
@@ -298,7 +316,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkce =
@@ -369,12 +389,10 @@ export class PopupClient extends StandardInteractionClient {
                 );
 
                 // Wait for the redirect bridge response
-                const responseString = await BrowserUtils.waitForBridgeResponse(
-                    this.config.system.popupBridgeTimeout,
-                    this.logger,
-                    this.browserCrypto,
+                const responseString = await this.waitForPopupResponse(
                     request,
-                    this.performanceClient
+                    popupWindow,
+                    popupParams.popupWindowParent
                 );
 
                 const serverParams = invoke(
@@ -494,18 +512,12 @@ export class PopupClient extends StandardInteractionClient {
 
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
+            this.waitForPopupResponse.bind(this),
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
-        )(
-            this.config.system.popupBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            popupRequest,
-            this.performanceClient
-        );
+        )(popupRequest, popupWindow, popupParams.popupWindowParent);
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -533,7 +545,9 @@ export class PopupClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -623,18 +637,12 @@ export class PopupClient extends StandardInteractionClient {
 
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
+            this.waitForPopupResponse.bind(this),
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
-        )(
-            this.config.system.popupBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        )(request, popupWindow, popupParams.popupWindowParent);
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -699,7 +707,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -792,12 +802,10 @@ export class PopupClient extends StandardInteractionClient {
                 null
             );
 
-            await BrowserUtils.waitForBridgeResponse(
-                this.config.system.popupBridgeTimeout,
-                this.logger,
-                this.browserCrypto,
+            await this.waitForPopupResponse(
                 validRequest,
-                this.performanceClient
+                popupWindow,
+                popupParams.popupWindowParent
             ).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
@@ -922,6 +930,22 @@ export class PopupClient extends StandardInteractionClient {
                     BrowserAuthErrorCodes.emptyWindowError
                 );
             }
+            try {
+                popupWindow.document.title = "Microsoft Authentication";
+            } catch (e) {
+                if (
+                    typeof DOMException !== "undefined" &&
+                    e instanceof DOMException &&
+                    e.name === "SecurityError"
+                ) {
+                    // Cross-origin - title cannot be set
+                } else {
+                    this.logger.verbose(
+                        "Could not set document.title on popup window",
+                        this.correlationId
+                    );
+                }
+            }
             if (popupWindow.focus) {
                 popupWindow.focus();
             }
@@ -1043,4 +1067,24 @@ export class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
+
+    protected async waitForPopupResponse(
+        request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
+        popupWindow: Window,
+        popupWindowParent: Window
+    ): Promise<string> {
+        if (this.waitForPopupResponseHook) {
+            return this.waitForPopupResponseHook(
+                request,
+                popupWindow,
+                popupWindowParent
+            );
+        }
+        return BrowserUtils.waitForBridgeResponse(
+            this.config.system.popupBridgeTimeout,
+            this.logger,
+            request,
+            this.performanceClient
+        );
+    }
 }