@azure/msal-browser 5.12.0 → 5.14.0

package/src/cache/TokenCache.ts

@@ -43,6 +43,7 @@ import * as BrowserRootPerformanceEvents from "../telemetry/BrowserRootPerforman
 import { ApiId } from "../utils/BrowserConstants.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
 import { BrowserCacheManager } from "./BrowserCacheManager.js";
+import { name, version } from "../packageMetadata.js";
 
 export type LoadTokenOptions = {
     clientInfo?: string;
@@ -91,7 +92,11 @@ export async function loadExternalTokens(
             authorityMetadata: browserConfig.auth.authorityMetadata,
         };
 
-        const logger = new Logger(browserConfig.system.loggerOptions || {});
+        const logger = new Logger(
+            browserConfig.system.loggerOptions || {},
+            name,
+            version
+        );
         const cryptoOps = new CryptoOps(logger, browserConfig.telemetry.client);
         const storage = new BrowserCacheManager(
             browserConfig.auth.clientId,
@@ -102,6 +107,7 @@ export async function loadExternalTokens(
             new EventHandler(logger),
             buildStaticAuthorityOptions(browserConfig.auth)
         );
+        await storage.initialize(correlationId);
 
         const authorityString =
             request.authority || browserConfig.auth.authority;

package/src/config/Configuration.ts

@@ -26,6 +26,7 @@ import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { NavigationClient } from "../navigation/NavigationClient.js";
 import { FetchClient } from "../network/FetchClient.js";
+import { name, version } from "../packageMetadata.js";
 
 // Default timeout for popup windows and iframes in milliseconds
 export const DEFAULT_POPUP_TIMEOUT_MS = 60000;
@@ -167,9 +168,18 @@ export type BrowserSystemOptions = SystemOptions & {
      * Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
      */
     protocolMode?: ProtocolMode;
+    /**
+     * @deprecated This option will be removed in a future release.
+     * Flag to enable emitting telemetry to the STS. When disabled, failed requests are not cached to browser storage and x-client-current-telemetry, x-client-last-telemetry parameters are not sent to the STS. Defaults to false.
+     */
+    serverTelemetryEnabled?: boolean;
 };
 
-/** @internal */
+/**
+ * Options for configuring experimental features. These features do not follow
+ * semver and may be changed or removed without a major version bump. Use with caution.
+ * @public
+ */
 export type BrowserExperimentalOptions = {
     /**
      * Enables iframe timeout telemetry experiment for silent iframe bridge monitoring.
@@ -315,6 +325,7 @@ export function buildConfiguration(
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
 
     const providedSystemOptions: Required<BrowserSystemOptions> = {
@@ -341,7 +352,11 @@ export function buildConfiguration(
         userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
         userInputAuth?.OIDCOptions
     ) {
-        const logger = new Logger(providedSystemOptions.loggerOptions);
+        const logger = new Logger(
+            providedSystemOptions.loggerOptions,
+            name,
+            version
+        );
         logger.warning(
             JSON.stringify(
                 createClientConfigurationError(

package/src/controllers/StandardController.ts

@@ -657,6 +657,12 @@ export class StandardController implements IController {
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("acquireTokenRedirect called", correlationId);
 
+        BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
+        this.browserStorage.setInteractionInProgress(
+            true,
+            INTERACTION_TYPE.SIGNIN
+        );
+
         const atrMeasurement = this.performanceClient.startMeasurement(
             BrowserRootPerformanceEvents.AcquireTokenPreRedirect,
             correlationId
@@ -684,13 +690,7 @@ export class StandardController implements IController {
         };
 
         try {
-            BrowserUtils.redirectPreflightCheck(this.initialized, this.config);
             enforceResourceParameter(this.config.auth.isMcp, request);
-            this.browserStorage.setInteractionInProgress(
-                true,
-                INTERACTION_TYPE.SIGNIN
-            );
-
             this.eventHandler.emitEvent(
                 EventType.ACQUIRE_TOKEN_START,
                 correlationId,

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -59,6 +59,7 @@ import { SignUpCodeRequiredState } from "../sign_up/auth_flow/state/SignUpCodeRe
 import { SignUpPasswordRequiredState } from "../sign_up/auth_flow/state/SignUpPasswordRequiredState.js";
 import { ResetPasswordCodeRequiredState } from "../reset_password/auth_flow/state/ResetPasswordCodeRequiredState.js";
 import { StandardController } from "../../controllers/StandardController.js";
+import { name } from "../../packageMetadata.js";
 
 /*
  * Controller for standard native auth operations.
@@ -95,10 +96,7 @@ export class CustomAuthStandardController
             throw new UnsupportedEnvironmentError();
         }
 
-        this.logger = this.logger.clone(
-            DefaultPackageInfo.SKU,
-            DefaultPackageInfo.VERSION
-        );
+        this.logger = this.logger.clone(name, DefaultPackageInfo.VERSION);
         this.customAuthConfig = operatingContext.getCustomAuthConfig();
 
         this.authority = new CustomAuthAuthority(

package/src/event/EventHandler.ts

@@ -13,6 +13,7 @@ import {
 } from "./EventMessage.js";
 import { EventType } from "./EventType.js";
 import { createGuid } from "../utils/BrowserUtils.js";
+import { version, name } from "../packageMetadata.js";
 
 const BROADCAST_CHANNEL_NAME = "msal.broadcast.event";
 
@@ -27,7 +28,7 @@ export class EventHandler {
 
     constructor(logger?: Logger) {
         this.eventCallbacks = new Map();
-        this.logger = logger || new Logger({});
+        this.logger = logger || new Logger({}, name, version);
         if (typeof BroadcastChannel !== "undefined") {
             this.broadcastChannel = new BroadcastChannel(
                 BROADCAST_CHANNEL_NAME

package/src/interaction_client/BaseInteractionClient.ts

@@ -10,6 +10,7 @@ import {
     AccountInfo,
     UrlString,
     ServerTelemetryManager,
+    StubServerTelemetryManager,
     ServerTelemetryRequest,
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
@@ -29,8 +30,7 @@ import { EndSessionRequest } from "../request/EndSessionRequest.js";
 import { RedirectRequest } from "../request/RedirectRequest.js";
 import { PopupRequest } from "../request/PopupRequest.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import { version } from "../packageMetadata.js";
-import { BrowserConstants } from "../utils/BrowserConstants.js";
+import { version, name } from "../packageMetadata.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
@@ -68,7 +68,7 @@ export abstract class BaseInteractionClient {
         this.navigationClient = navigationClient;
         this.platformAuthProvider = platformAuthProvider;
         this.correlationId = correlationId;
-        this.logger = logger.clone(BrowserConstants.MSAL_SKU, version);
+        this.logger = logger.clone(name, version);
         this.performanceClient = performanceClient;
     }
 
@@ -108,6 +108,7 @@ export function getRedirectUri(
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
 export function initializeServerTelemetryManager(
@@ -116,9 +117,18 @@ export function initializeServerTelemetryManager(
     correlationId: string,
     browserStorage: BrowserCacheManager,
     logger: Logger,
-    forceRefresh?: boolean
+    forceRefresh?: boolean,
+    enabled: boolean = true
 ): ServerTelemetryManager {
     logger.verbose("initializeServerTelemetryManager called", correlationId);
+    if (!enabled) {
+        logger.verbose(
+            "Server telemetry is disabled in configuration. Skipping telemetry manager initialization.",
+            correlationId
+        );
+        return new StubServerTelemetryManager();
+    }
+
     const telemetryPayload: ServerTelemetryRequest = {
         clientId: clientId,
         correlationId: correlationId,

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -177,7 +177,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -369,7 +371,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                     this.config.auth.clientId,
                     this.correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 );
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
@@ -472,7 +476,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             );
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields(

package/src/interaction_client/PopupClient.ts

@@ -316,7 +316,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkce =
@@ -543,7 +545,9 @@ export class PopupClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -703,7 +707,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

package/src/interaction_client/RedirectClient.ts

@@ -197,7 +197,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkceCodes = await invokeAsync(
@@ -417,7 +419,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const navigateToLoginRequestUrl =
@@ -455,9 +459,15 @@ export class RedirectClient extends StandardInteractionClient {
                     true
                 ) || "";
             const loginRequestUrlNormalized =
-                UrlUtils.normalizeUrlForComparison(loginRequestUrl);
+                UrlUtils.normalizeUrlForComparison(
+                    loginRequestUrl,
+                    this.logger,
+                    this.correlationId
+                );
             const currentUrlNormalized = UrlUtils.normalizeUrlForComparison(
-                window.location.href
+                window.location.href,
+                this.logger,
+                this.correlationId
             );
 
             if (
@@ -518,8 +528,8 @@ export class RedirectClient extends StandardInteractionClient {
                  * The start page is expected to also call handleRedirectPromise which will process the hash in one of the checks above.
                  */
                 let processHashOnRedirect: boolean = true;
-                if (!loginRequestUrl || loginRequestUrl === "null") {
-                    // Redirect to home page if login request url is null (real null or the string null)
+                if (!loginRequestUrl) {
+                    // Redirect to home page if login request url is empty
                     const homepage = BrowserUtils.getHomepage();
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(
@@ -820,7 +830,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -974,9 +986,16 @@ export class RedirectClient extends StandardInteractionClient {
      */
     protected getRedirectStartPage(requestStartPage?: string): string {
         const redirectStartPage = requestStartPage || window.location.href;
-        return UrlString.getAbsoluteUrl(
+        const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(
             redirectStartPage,
             BrowserUtils.getCurrentUri()
         );
+        // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
+        UrlUtils.validateUrl(
+            absoluteRedirectStartPage,
+            this.logger,
+            this.correlationId
+        );
+        return absoluteRedirectStartPage;
     }
 }

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -104,7 +104,9 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

package/src/interaction_client/SilentCacheClient.ts

@@ -36,7 +36,9 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const clientConfig = await invokeAsync(

package/src/interaction_client/SilentIframeClient.ts

@@ -37,6 +37,7 @@ import {
     BrowserConstants,
 } from "../utils/BrowserConstants.js";
 import {
+    createHiddenIframe,
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
@@ -199,7 +200,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -307,30 +310,45 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        const iframe = await invokeAsync(
-            initiateEarRequest,
-            BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config,
-            discoveredAuthority,
-            silentRequest,
-            this.logger,
-            this.performanceClient
-        );
+
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         let responseString: string;
         try {
-            responseString = await invokeAsync(
+            const responsePromise = invokeAsync(
                 this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
             )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If navigation below throws before responsePromise is awaited,
+                 * the listener still rejects on timeout. Swallow it here so it
+                 * does not surface as an unhandled rejection; the navigation
+                 * error is propagated instead.
+                 */
+            });
+
+            await invokeAsync(
+                initiateEarRequest,
+                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                iframe,
+                this.config,
+                discoveredAuthority,
+                silentRequest,
+                this.logger,
+                this.performanceClient
+            );
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,
@@ -363,7 +381,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -457,7 +477,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             ),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,
@@ -571,58 +593,72 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
-        let iframe: HTMLIFrameElement;
-        if (request.httpMethod === Constants.HttpMethod.POST) {
-            iframe = await invokeAsync(
-                initiateCodeFlowWithPost,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-        } else {
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(
-                Authorize.getAuthCodeRequestUrl,
-                PerformanceEvents.GetAuthCodeUrl,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(
-                this.config,
-                authClient.authority,
-                silentRequest,
-                this.logger,
-                this.performanceClient
-            );
-
-            // Get the frame handle for the silent request
-            iframe = await invokeAsync(
-                initiateCodeRequest,
-                BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
-                this.logger,
-                this.performanceClient,
-                correlationId
-            )(navigateUrl, this.performanceClient, this.logger, correlationId);
-        }
+        // Create the iframe, register the response listener, then navigate, so the listener is active before the iframe can respond.
+        const iframe = createHiddenIframe();
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
         let responseString: string;
         try {
-            responseString = await invokeAsync(
+            const responsePromise = invokeAsync(
                 this.waitForIframeResponse.bind(this),
                 BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
                 this.logger,
                 this.performanceClient,
                 correlationId
             )(iframe, request);
+            responsePromise.catch(() => {
+                /*
+                 * If URL creation or navigation below throws before
+                 * responsePromise is awaited, the listener still rejects on
+                 * timeout. Swallow it here so it does not surface as an
+                 * unhandled rejection; the navigation error is propagated
+                 * instead.
+                 */
+            });
+
+            if (request.httpMethod === Constants.HttpMethod.POST) {
+                await invokeAsync(
+                    initiateCodeFlowWithPost,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    iframe,
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+            } else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(
+                    Authorize.getAuthCodeRequestUrl,
+                    PerformanceEvents.GetAuthCodeUrl,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(
+                    this.config,
+                    authClient.authority,
+                    silentRequest,
+                    this.logger,
+                    this.performanceClient
+                );
+
+                // Navigate the iframe to the authorize request url
+                await invokeAsync(
+                    initiateCodeRequest,
+                    BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
+                    this.logger,
+                    this.performanceClient,
+                    correlationId
+                )(iframe, navigateUrl, this.logger, correlationId);
+            }
+
+            responseString = await responsePromise;
         } finally {
             invoke(
                 removeHiddenIframe,

package/src/interaction_client/SilentRefreshClient.ts

@@ -68,7 +68,9 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const refreshTokenClient = await this.createRefreshTokenClient({