@azure/msal-browser 5.11.0 → 5.13.0

package/src/interaction_client/RedirectClient.ts

@@ -197,7 +197,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkceCodes = await invokeAsync(
@@ -409,12 +411,17 @@ export class RedirectClient extends StandardInteractionClient {
         parentMeasurement: InProgressPerformanceEvent,
         options?: HandleRedirectPromiseOptions
     ): Promise<AuthenticationResult | null> {
+        const originalTitle = document.title;
+        document.title = "Microsoft Authentication";
+
         const serverTelemetryManager = initializeServerTelemetryManager(
             ApiId.handleRedirectPromise,
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const navigateToLoginRequestUrl =
@@ -452,9 +459,15 @@ export class RedirectClient extends StandardInteractionClient {
                     true
                 ) || "";
             const loginRequestUrlNormalized =
-                UrlUtils.normalizeUrlForComparison(loginRequestUrl);
+                UrlUtils.normalizeUrlForComparison(
+                    loginRequestUrl,
+                    this.logger,
+                    this.correlationId
+                );
             const currentUrlNormalized = UrlUtils.normalizeUrlForComparison(
-                window.location.href
+                window.location.href,
+                this.logger,
+                this.correlationId
             );
 
             if (
@@ -515,8 +528,8 @@ export class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect: boolean = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
                     const homepage = BrowserUtils.getHomepage();
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(
@@ -564,6 +577,8 @@ export class RedirectClient extends StandardInteractionClient {
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
+        } finally {
+            document.title = originalTitle;
         }
     }
 
@@ -815,7 +830,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -969,9 +986,16 @@ export class RedirectClient extends StandardInteractionClient {
      */
     protected getRedirectStartPage(requestStartPage?: string): string {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(
             redirectStartPage,
             BrowserUtils.getCurrentUri()
         );
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        UrlUtils.validateUrl(
+            absoluteRedirectStartPage,
+            this.logger,
+            this.correlationId
+        );
+        return absoluteRedirectStartPage;
     }
 }

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -104,7 +104,9 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

package/src/interaction_client/SilentCacheClient.ts

@@ -36,7 +36,9 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const clientConfig = await invokeAsync(

package/src/interaction_client/SilentIframeClient.ts

@@ -37,6 +37,7 @@ import {
     BrowserConstants,
 } from "../utils/BrowserConstants.js";
 import {
+    createHiddenIframe,
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
@@ -56,9 +57,35 @@ import {
     initializeServerTelemetryManager,
 } from "./BaseInteractionClient.js";
 
+import type { WaitForBridgeRequest } from "../utils/BrowserUtils.js";
+
+/**
+ * Minimal request shape accepted by the iframe-response hook.
+ * Intentionally narrow so subclasses can override without needing
+ * access to internal resolved-request types.
+ *
+ * @internal
+ */
+export type WaitForIframeRequest = WaitForBridgeRequest;
+
+/**
+ * Signature of the iframe-response handler supplied by
+ * {@link PublicClientApplication} to {@link SilentIframeClient} via the
+ * operating context.
+ *
+ * @internal
+ */
+export type WaitForIframeResponseFn = (
+    iframe: HTMLIFrameElement,
+    request: WaitForIframeRequest
+) => Promise<string>;
+
 export class SilentIframeClient extends StandardInteractionClient {
     protected apiId: ApiId;
     protected nativeStorage: BrowserCacheManager;
+    private readonly waitForIframeResponseHook:
+        | WaitForIframeResponseFn
+        | undefined;
 
     constructor(
         config: BrowserConfiguration,
@@ -71,7 +98,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         performanceClient: IPerformanceClient,
         nativeStorageImpl: BrowserCacheManager,
         correlationId: string,
-        platformAuthProvider?: IPlatformAuthHandler
+        platformAuthProvider?: IPlatformAuthHandler,
+        waitForIframeResponseHook?: WaitForIframeResponseFn
     ) {
         super(
             config,
@@ -86,6 +114,7 @@ export class SilentIframeClient extends StandardInteractionClient {
         );
         this.apiId = apiId;
         this.nativeStorage = nativeStorageImpl;
+        this.waitForIframeResponseHook = waitForIframeResponseHook;
     }
 
     /**
@@ -171,7 +200,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -279,37 +310,45 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(
-            initiateEarRequest,
-            BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config,
-            discoveredAuthority,
-            silentRequest,
-            this.logger,
-            this.performanceClient
-        );
+
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString: string;
         try {
-            responseString = await invokeAsync(
-                BrowserUtils.waitForBridgeResponse,
+            const responsePromise = invokeAsync(
+                this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
-            )(
-                this.config.system.iframeBridgeTimeout,
+            )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+
+            await invokeAsync(
+                initiateEarRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
-                this.browserCrypto,
-                request,
                 this.performanceClient,
-                this.config.experimental
+                correlationId
+            )(
+                iframe,
+                this.config,
+                discoveredAuthority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
             );
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,
@@ -342,7 +381,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -436,7 +477,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             ),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
@@ -550,65 +593,72 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
-        let iframe: HTMLIFrameElement;
-        if (request.httpMethod === Constants.HttpMethod.POST) {
-            iframe = await invokeAsync(
-                initiateCodeFlowWithPost,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-        } else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(
-                initiateCodeRequest,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString: string;
         try {
-            responseString = await invokeAsync(
-                BrowserUtils.waitForBridgeResponse,
+            const responsePromise = invokeAsync(
+                this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
-            )(
-                this.config.system.iframeBridgeTimeout,
-                this.logger,
-                this.browserCrypto,
-                request,
-                this.performanceClient,
-                this.config.experimental
-            );
+            )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+
+            if (request.httpMethod === Constants.HttpMethod.POST) {
+                await invokeAsync(
+                    initiateCodeFlowWithPost,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    iframe,
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+            } else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(
+                    initiateCodeRequest,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(iframe, navigateUrl, this.logger, correlationId);
+            }
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,
@@ -629,4 +679,20 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         return { serverParams, pkceCodes, silentRequest };
     }
+
+    protected async waitForIframeResponse(
+        iframe: HTMLIFrameElement,
+        request: WaitForIframeRequest
+    ): Promise<string> {
+        if (this.waitForIframeResponseHook) {
+            return this.waitForIframeResponseHook(iframe, request);
+        }
+        return BrowserUtils.waitForBridgeResponse(
+            this.config.system.iframeBridgeTimeout,
+            this.logger,
+            request,
+            this.performanceClient,
+            this.config.experimental
+        );
+    }
 }

package/src/interaction_client/SilentRefreshClient.ts

@@ -68,7 +68,9 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const refreshTokenClient = await this.createRefreshTokenClient({

package/src/interaction_handler/SilentHandler.ts

@@ -6,11 +6,9 @@
 import {
     Logger,
     IPerformanceClient,
-    invoke,
     Authority,
     CommonAuthorizationUrlRequest,
 } from "@azure/msal-common/browser";
-import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -19,13 +17,13 @@ import { BrowserConfiguration } from "../config/Configuration.js";
 import { getCodeForm, getEARForm } from "../protocol/Authorize.js";
 
 /**
- * Creates a hidden iframe to given URL using user-requested scopes as an id.
- * @param urlNavigate
- * @param userRequestScopes
+ * Navigates the given hidden iframe to the provided URL.
+ * @param frame
+ * @param requestUrl
  */
 export async function initiateCodeRequest(
+    frame: HTMLIFrameElement,
     requestUrl: string,
-    performanceClient: IPerformanceClient,
     logger: Logger,
     correlationId: string
 ): Promise<HTMLIFrameElement> {
@@ -35,23 +33,18 @@ export async function initiateCodeRequest(
         throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
     }
 
-    return invoke(
-        loadFrameSync,
-        BrowserPerformanceEvents.SilentHandlerLoadFrameSync,
-        logger,
-        performanceClient,
-        correlationId
-    )(requestUrl);
+    frame.src = requestUrl;
+    return frame;
 }
 
 export async function initiateCodeFlowWithPost(
+    frame: HTMLIFrameElement,
     config: BrowserConfiguration,
     authority: Authority,
     request: CommonAuthorizationUrlRequest,
     logger: Logger,
     performanceClient: IPerformanceClient
 ): Promise<HTMLIFrameElement> {
-    const frame = createHiddenIframe();
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -68,13 +61,13 @@ export async function initiateCodeFlowWithPost(
 }
 
 export async function initiateEarRequest(
+    frame: HTMLIFrameElement,
     config: BrowserConfiguration,
     authority: Authority,
     request: CommonAuthorizationUrlRequest,
     logger: Logger,
     performanceClient: IPerformanceClient
 ): Promise<HTMLIFrameElement> {
-    const frame = createHiddenIframe();
     if (!frame.contentDocument) {
         throw "No document associated with iframe!";
     }
@@ -92,28 +85,15 @@ export async function initiateEarRequest(
 
 /**
  * @hidden
- * Loads the iframe synchronously when the navigateTimeFrame is set to `0`
- * @param urlNavigate
- * @param frameName
- * @param logger
- */
-function loadFrameSync(urlNavigate: string): HTMLIFrameElement {
-    const frameHandle = createHiddenIframe();
-
-    frameHandle.src = urlNavigate;
-
-    return frameHandle;
-}
-
-/**
- * @hidden
- * Creates a new hidden iframe or gets an existing one for silent token renewal.
+ * Creates a new hidden iframe for silent token renewal. Callers navigate it
+ * (set `src` or submit a form) after registering the response listener.
  * @ignore
  */
-function createHiddenIframe(): HTMLIFrameElement {
+export function createHiddenIframe(): HTMLIFrameElement {
     const authFrame = document.createElement("iframe");
 
     authFrame.className = "msalSilentIframe";
+    authFrame.title = "Microsoft Authentication";
     authFrame.style.visibility = "hidden";
     authFrame.style.position = "absolute";
     authFrame.style.width = authFrame.style.height = "0";

package/src/operatingcontext/BaseOperatingContext.ts

@@ -9,6 +9,7 @@ import {
     buildConfiguration,
     Configuration,
 } from "../config/Configuration.js";
+import type { AuthResponseHandlers } from "../app/PublicClientApplication.js";
 import { version, name } from "../packageMetadata.js";
 import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import { LOG_LEVEL_CACHE_KEY, LOG_PII_CACHE_KEY } from "../cache/CacheKeys.js";
@@ -25,6 +26,7 @@ export abstract class BaseOperatingContext {
     protected config: BrowserConfiguration;
     protected available: boolean;
     protected browserEnvironment: boolean;
+    protected responseHandlers: AuthResponseHandlers | undefined;
 
     protected static loggerCallback(level: LogLevel, message: string): void {
         switch (level) {
@@ -51,7 +53,10 @@ export abstract class BaseOperatingContext {
         }
     }
 
-    constructor(config: Configuration) {
+    constructor(
+        config: Configuration,
+        responseHandlers?: AuthResponseHandlers
+    ) {
         /*
          * If loaded in an environment where window is not available,
          * set internal flag to false so that further requests fail.
@@ -59,6 +64,7 @@ export abstract class BaseOperatingContext {
          */
         this.browserEnvironment = typeof window !== "undefined";
         this.config = buildConfiguration(config, this.browserEnvironment);
+        this.responseHandlers = responseHandlers;
 
         let sessionStorage: Storage | undefined;
         try {
@@ -119,6 +125,14 @@ export abstract class BaseOperatingContext {
         return this.config;
     }
 
+    /**
+     * Returns the internal response handlers supplied by PublicClientApplication, if any.
+     * @returns AuthResponseHandlers | undefined
+     */
+    getResponseHandlers(): AuthResponseHandlers | undefined {
+        return this.responseHandlers;
+    }
+
     /**
      * Returns the MSAL Logger
      * @returns Logger

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.11.0";
+export const version = "5.13.0";

package/src/redirect_bridge/index.ts

@@ -32,18 +32,14 @@ import { PREFIX } from "../cache/CacheKeys.js";
 export async function broadcastResponseToMainFrame(
     navigationClient?: NavigationClient
 ): Promise<void> {
+    document.title = "Microsoft Authentication";
+
     let parsedResponse;
     try {
         parsedResponse = parseAuthResponseFromUrl();
     } catch (error) {
         // Clear hash and query string before re-throwing parse errors
-        if (typeof window.history.replaceState === "function") {
-            window.history.replaceState(
-                null,
-                "",
-                `${window.location.origin}${window.location.pathname}`
-            );
-        }
+        BrowserUtils.clearAuthResponseFromUrl(window);
         throw error;
     }
 

package/src/telemetry/BrowserPerformanceEvents.ts

@@ -121,7 +121,6 @@ export const SilentHandlerInitiateAuthRequest =
 export const SilentHandlerMonitorIframeForHash =
     "silentHandlerMonitorIframeForHash";
 export const SilentHandlerLoadFrame = "silentHandlerLoadFrame";
-export const SilentHandlerLoadFrameSync = "silentHandlerLoadFrameSync";
 
 /**
  * Helper functions in StandardInteractionClient class (msal-browser)