@azure/msal-browser 5.6.1 → 5.6.2

package/src/interaction_client/SilentIframeClient.ts

@@ -38,6 +38,7 @@ import {
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
+    removeHiddenIframe,
 } from "../interaction_handler/SilentHandler.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
@@ -276,7 +277,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        await invokeAsync(
+        const iframe = await invokeAsync(
             initiateEarRequest,
             BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
@@ -291,19 +292,30 @@ export class SilentIframeClient extends StandardInteractionClient {
         );
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
-            BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config.system.iframeBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
+                this.logger,
+                this.browserCrypto,
+                request,
+                this.performanceClient
+            );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
+        }
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -415,8 +427,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
+        let iframe: HTMLIFrameElement;
         if (request.httpMethod === Constants.HttpMethod.POST) {
-            await invokeAsync(
+            iframe = await invokeAsync(
                 initiateCodeFlowWithPost,
                 BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
@@ -446,7 +459,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
 
             // Get the frame handle for the silent request
-            await invokeAsync(
+            iframe = await invokeAsync(
                 initiateCodeRequest,
                 BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
@@ -457,19 +470,30 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
-            BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config.system.iframeBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
+                this.logger,
+                this.browserCrypto,
+                request,
+                this.performanceClient
+            );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
+        }
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,

package/src/interaction_handler/SilentHandler.ts

@@ -127,3 +127,14 @@ function createHiddenIframe(): HTMLIFrameElement {
 
     return authFrame;
 }
+
+/**
+ * @hidden
+ * Removes a hidden iframe from `document.body` if it is a direct child.
+ * @param iframe - The iframe element to remove.
+ */
+export function removeHiddenIframe(iframe: HTMLIFrameElement): void {
+    if (document.body === iframe.parentNode) {
+        document.body.removeChild(iframe);
+    }
+}

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.6.1";
+export const version = "5.6.2";

package/src/redirect_bridge/index.ts

@@ -66,39 +66,61 @@ export async function broadcastResponseToMainFrame(
         };
 
         let navigateToUrl = "";
+        let clientId = "";
         const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
+        /*
+         * Retrieve the clientId and original navigation URL from
+         * sessionStorage. If sessionStorage access or JSON.parse fails,
+         * we fall back to URL-based navigation below.
+         */
         try {
-            /*
-             * Retrieve the original navigation URL from sessionStorage
-             */
-            const { clientId } = JSON.parse(
-                window.sessionStorage.getItem(interactionKey) || ""
-            );
+            const rawInteractionStatus =
+                window.sessionStorage.getItem(interactionKey);
+            const interactionStatus = JSON.parse(rawInteractionStatus || "");
+            clientId = interactionStatus.clientId || "";
+
             if (clientId) {
-                const cacheKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
-                navigateToUrl = window.sessionStorage.getItem(cacheKey) || "";
+                const originKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
+                navigateToUrl = window.sessionStorage.getItem(originKey) || "";
             }
-        } catch (e) {
-            // SessionStorage access may fail in some contexts, use default
+        } catch {
+            // sessionStorage access or JSON.parse failed
         }
 
-        // Reconstruct full URL with auth response (preserve original format)
-        let fullUrlResponse = "";
-        if (hasResponseInHash && hasResponseInQuery) {
-            // Hybrid format
-            fullUrlResponse = `${urlQuery}${urlHash}`;
-        } else if (hasResponseInHash) {
-            // Hash only
-            fullUrlResponse = urlHash;
-        } else {
-            // Query only
-            fullUrlResponse = urlQuery;
+        /*
+         * Cache the auth response payload in sessionStorage under the URL_HASH
+         * key, then navigate directly to the origin URL. This replicates what
+         * RedirectClient.handleRedirectPromise does when the current page is
+         * not the loginRequestUrl: it caches the response and navigates.
+         *
+         * On the target page, handleRedirectPromise will find no response in
+         * the URL but will pick up the cached payload from sessionStorage.
+         * This avoids appending the auth response to the URL, which would
+         * create malformed URLs for hash-routed SPAs (e.g. /#/route#code=...).
+         *
+         * If caching fails (clientId unavailable, quota exceeded, storage
+         * disabled), we still navigate to the origin/homepage. The target
+         * page's handleRedirectPromise will return null and the app can
+         * handle re-authentication. Appending auth params to the URL would
+         * not help because handleRedirectPromise also relies on
+         * sessionStorage to persist tokens.
+         */
+        if (clientId) {
+            try {
+                window.sessionStorage.setItem(
+                    `${PREFIX}.${clientId}.${TemporaryCacheKeys.URL_HASH}`,
+                    payload
+                );
+            } catch {
+                // sessionStorage write failed — navigate anyway; handleRedirectPromise will return null
+            }
         }
 
-        const homepage = `${
-            navigateToUrl || BrowserUtils.getHomepage()
-        }${fullUrlResponse}`;
-        await navClient.navigateInternal(homepage, navigationOptions);
+        const url = navigateToUrl || BrowserUtils.getHomepage();
+        // Strip bare trailing "?" (empty query string) to match canonical URL form
+        const navigationUrl = url.endsWith("?") ? url.slice(0, -1) : url;
+
+        await navClient.navigateInternal(navigationUrl, navigationOptions);
 
         // Do NOT clear URL for redirect flow - we're navigating away anyway
         return;