@azure/msal-browser 5.4.0 → 5.6.0

package/src/protocol/Authorize.ts

@@ -44,6 +44,99 @@ import { EventHandler } from "../event/EventHandler.js";
 import { decryptEarResponse } from "../crypto/BrowserCrypto.js";
 import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 
+/**
+ * Parsed representation of the clientdata response parameter from the /authorize endpoint.
+ *
+ * Format: urlencoded(account_type|error|sub_error|cloud_instance|caller_data_boundary)
+ */
+type ClientData = {
+    /** Account type: MSA, AAD */
+    accountType: string;
+    /** Error code string (e.g. "0x8004345C" for MSA) */
+    error: string;
+    /** Sub-error code string (e.g. "0x80043588" for MSA) */
+    subError: string;
+    /** Cloud instance hostname (e.g. "login.microsoftonline.com") */
+    cloudInstance: string;
+    /** Caller data boundary (e.g. "none" for MSA) */
+    callerDataBoundary: string;
+};
+
+const clientDataAccountTypeMapping = new Map([
+    ["e", "AAD"],
+    ["m", "MSA"],
+]);
+
+/**
+ * Parses the clientdata response parameter from the /authorize endpoint.
+ *
+ * Logically, the clientdata value is URL-encoded and pipe-delimited:
+ *   urlencoded(account_type | error | sub_error | cloud_instance | caller_data_boundary)
+ *
+ * In normal browser flows, this value may already have been URL-decoded
+ * (e.g. by URLSearchParams). This function will only apply decodeURIComponent
+ * when the string appears to contain percent-encoded sequences to avoid
+ * double-decoding.
+ *
+ * @param clientdata - The raw clientdata string from the authorize response
+ * @returns Parsed ClientData object, or null if the input is empty/invalid
+ */
+export function parseClientData(clientdata?: string): ClientData | null {
+    if (!clientdata) {
+        return null;
+    }
+
+    try {
+        // Only decode when the string appears to contain percent-encoded sequences
+        const shouldDecode = /%(?:[0-9A-Fa-f]{2})/.test(clientdata);
+        const decoded = shouldDecode
+            ? decodeURIComponent(clientdata)
+            : clientdata;
+        const parts = decoded.split("|");
+
+        if (parts.length < 5) {
+            return null;
+        }
+
+        return {
+            accountType:
+                clientDataAccountTypeMapping.get(parts[0]?.trim() || "") || "",
+            error: parts[1]?.trim() || "",
+            subError: parts[2]?.trim() || "",
+            cloudInstance: parts[3]?.trim() || "",
+            callerDataBoundary: parts[4]?.trim() || "",
+        };
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Instruments account type, error, and suberror from clientdata
+ */
+function instrumentClientData(
+    response: AuthorizeResponse,
+    correlationId: string,
+    performanceClient: IPerformanceClient
+): void {
+    const parsed = parseClientData(response.clientdata);
+    parsed?.accountType &&
+        performanceClient.addFields(
+            { accountType: parsed.accountType },
+            correlationId
+        );
+    parsed?.error &&
+        performanceClient.addFields(
+            { serverErrorNo: parsed.error },
+            correlationId
+        );
+    parsed?.subError &&
+        performanceClient.addFields(
+            { serverSubErrorNo: parsed.subError },
+            correlationId
+        );
+}
+
 /**
  * Returns map of parameters that are applicable to all calls to /authorize whether using PKCE or EAR
  * @param config
@@ -407,6 +500,10 @@ export async function handleResponseCode(
         config.auth.clientId,
         request
     );
+
+    // Instrument clientdata telemetry fields from the authorize response
+    instrumentClientData(response, request.correlationId, performanceClient);
+
     if (response.accountId) {
         return invokeAsync(
             handleResponsePlatformBroker,
@@ -487,6 +584,9 @@ export async function handleResponseEAR(
         request
     );
 
+    // Instrument clientdata telemetry fields from the authorize response
+    instrumentClientData(response, request.correlationId, performanceClient);
+
     // Validate state & check response for errors
     AuthorizeProtocol.validateAuthorizationResponse(response, request.state);
 

package/src/telemetry/BrowserPerformanceClient.ts

@@ -18,6 +18,7 @@ import { name, version } from "../packageMetadata.js";
 import { BrowserCacheLocation } from "../utils/BrowserConstants.js";
 import * as BrowserCrypto from "../crypto/BrowserCrypto.js";
 import { BROWSER_PERF_ENABLED_KEY } from "../cache/CacheKeys.js";
+import { getNetworkInfo } from "../utils/MsalFrameStatsUtils.js";
 
 /**
  * Returns browser performance measurement module if session flag is enabled. Returns undefined otherwise.
@@ -160,12 +161,15 @@ export class BrowserPerformanceClient
                 error?: unknown,
                 account?: AccountInfo
             ): PerformanceEvent | null => {
+                const networkInfo = getNetworkInfo();
                 const res = inProgressEvent.end(
                     {
                         ...event,
                         startPageVisibility,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
+                        networkEffectiveType: networkInfo.effectiveType,
+                        networkRtt: networkInfo.rtt,
                     },
                     error,
                     account

package/src/utils/BrowserUtils.ts

@@ -10,6 +10,7 @@ import {
     UrlUtils,
     RequestParameterBuilder,
     ICrypto,
+    IPerformanceClient,
     Logger,
     CommonAuthorizationUrlRequest,
     CommonEndSessionRequest,
@@ -234,7 +235,8 @@ export async function waitForBridgeResponse(
     timeoutMs: number,
     logger: Logger,
     browserCrypto: ICrypto,
-    request: CommonAuthorizationUrlRequest | CommonEndSessionRequest
+    request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
+    performanceClient: IPerformanceClient
 ): Promise<string> {
     return new Promise<string>((resolve, reject) => {
         logger.verbose(
@@ -242,6 +244,15 @@ export async function waitForBridgeResponse(
             request.correlationId
         );
 
+        const correlationId = request.correlationId;
+
+        performanceClient.addFields(
+            {
+                redirectBridgeTimeoutMs: timeoutMs,
+            },
+            correlationId
+        );
+
         const { libraryState } = ProtocolUtils.parseRequestState(
             browserCrypto.base64Decode,
             request.state || ""
@@ -272,6 +283,18 @@ export async function waitForBridgeResponse(
         channel.onmessage = (event) => {
             responseString = event.data.payload;
 
+            const messageVersion =
+                event?.data && typeof event.data.v === "number"
+                    ? event.data.v
+                    : undefined;
+
+            performanceClient.addFields(
+                {
+                    redirectBridgeMessageVersion: messageVersion,
+                },
+                correlationId
+            );
+
             // Clear the active monitor
             activeBridgeMonitor = null;
 

package/src/utils/MsalFrameStatsUtils.ts

@@ -5,6 +5,33 @@
 
 import { InProgressPerformanceEvent, Logger } from "@azure/msal-common/browser";
 
+interface NetworkConnection {
+    effectiveType?: string;
+    rtt?: number;
+}
+
+/**
+ * Get network information for telemetry purposes. This is only supported in Chromium-based browsers.
+ * @returns Network connection information, or an empty object if not available.
+ */
+export function getNetworkInfo(): NetworkConnection {
+    if (typeof window === "undefined" || !window.navigator) {
+        return {};
+    }
+    const connection: NetworkConnection | undefined =
+        "connection" in window.navigator
+            ? (
+                  window.navigator as Navigator & {
+                      connection: NetworkConnection;
+                  }
+              ).connection
+            : undefined;
+    return {
+        effectiveType: connection?.effectiveType,
+        rtt: connection?.rtt,
+    };
+}
+
 export function collectInstanceStats(
     currentClientId: string,
     performanceEvent: InProgressPerformanceEvent,