@azure/msal-browser 5.6.1 → 5.6.3

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -4,80 +4,80 @@
  */
 
 import {
-    Logger,
-    ICrypto,
-    AuthToken,
+    AADServerParamKeys,
+    AccessTokenEntity,
     AccountEntity,
+    AccountEntityUtils,
+    AccountInfo,
+    AuthError,
+    AuthToken,
     AuthorityType,
-    ScopeSet,
-    TimeUtils,
-    UrlString,
-    PopTokenGenerator,
-    SignedHttpRequestParameters,
+    CacheHelpers,
+    ClientAuthErrorCodes,
+    CommonSilentFlowRequest,
+    Constants,
+    ICrypto,
     IPerformanceClient,
     IdTokenEntity,
-    AccessTokenEntity,
-    AuthError,
-    CommonSilentFlowRequest,
-    AccountInfo,
-    AADServerParamKeys,
+    InProgressPerformanceEvent,
+    Logger,
+    PerformanceEvents,
+    PopTokenGenerator,
+    ScopeSet,
+    ServerTelemetryManager,
+    SignedHttpRequestParameters,
+    TimeUtils,
     TokenClaims,
+    UrlString,
+    buildAccountToCache,
     createClientAuthError,
-    ClientAuthErrorCodes,
     invokeAsync,
     updateAccountTenantProfileData,
-    CacheHelpers,
-    buildAccountToCache,
-    InProgressPerformanceEvent,
-    ServerTelemetryManager,
-    AccountEntityUtils,
-    Constants,
-    PerformanceEvents,
 } from "@azure/msal-common/browser";
-import {
-    BaseInteractionClient,
-    getDiscoveredAuthority,
-    getRedirectUri,
-    initializeServerTelemetryManager,
-} from "./BaseInteractionClient.js";
-import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
-import { BrowserConfiguration } from "../config/Configuration.js";
-import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
-import { EventHandler } from "../event/EventHandler.js";
-import { PopupRequest } from "../request/PopupRequest.js";
-import { SilentRequest } from "../request/SilentRequest.js";
-import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
-import {
-    ApiId,
-    TemporaryCacheKeys,
-    PlatformAuthConstants,
-    BrowserConstants,
-    CacheLookupPolicy,
-} from "../utils/BrowserConstants.js";
+import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 import { PlatformAuthRequest } from "../broker/nativeBroker/PlatformAuthRequest.js";
 import {
     MATS,
     PlatformAuthResponse,
 } from "../broker/nativeBroker/PlatformAuthResponse.js";
+import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
+import { BrowserConfiguration } from "../config/Configuration.js";
+import { base64Decode } from "../encode/Base64Decode.js";
+import {
+    BrowserAuthErrorCodes,
+    createBrowserAuthError,
+} from "../error/BrowserAuthError.js";
 import {
     NativeAuthError,
     NativeAuthErrorCodes,
     createNativeAuthError,
     isFatalNativeAuthError,
 } from "../error/NativeAuthError.js";
-import { RedirectRequest } from "../request/RedirectRequest.js";
-import { NavigationOptions } from "../navigation/NavigationOptions.js";
+import { EventHandler } from "../event/EventHandler.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
-import {
-    createBrowserAuthError,
-    BrowserAuthErrorCodes,
-} from "../error/BrowserAuthError.js";
-import { SilentCacheClient } from "./SilentCacheClient.js";
-import { AuthenticationResult } from "../response/AuthenticationResult.js";
-import { base64Decode } from "../encode/Base64Decode.js";
+import { NavigationOptions } from "../navigation/NavigationOptions.js";
 import { version } from "../packageMetadata.js";
-import { IPlatformAuthHandler } from "../broker/nativeBroker/IPlatformAuthHandler.js";
 import { HandleRedirectPromiseOptions } from "../request/HandleRedirectPromiseOptions.js";
+import { PopupRequest } from "../request/PopupRequest.js";
+import { RedirectRequest } from "../request/RedirectRequest.js";
+import { SilentRequest } from "../request/SilentRequest.js";
+import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
+import { AuthenticationResult } from "../response/AuthenticationResult.js";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
+import {
+    ApiId,
+    BrowserConstants,
+    CacheLookupPolicy,
+    PlatformAuthConstants,
+    TemporaryCacheKeys,
+} from "../utils/BrowserConstants.js";
+import {
+    BaseInteractionClient,
+    getDiscoveredAuthority,
+    getRedirectUri,
+    initializeServerTelemetryManager,
+} from "./BaseInteractionClient.js";
+import { SilentCacheClient } from "./SilentCacheClient.js";
 
 export class PlatformAuthInteractionClient extends BaseInteractionClient {
     protected apiId: ApiId;
@@ -542,10 +542,12 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.correlationId,
             idTokenClaims,
             response.client_info,
-            undefined, // environment
+            authority.getPreferredCache(), // environment
             idTokenClaims.tid,
             undefined, // auth code payload
-            response.account.id
+            response.account.id,
+            this.logger,
+            this.performanceClient
         );
 
         // Ensure expires_in is in number format

package/src/interaction_client/SilentIframeClient.ts

@@ -38,6 +38,7 @@ import {
     initiateCodeRequest,
     initiateCodeFlowWithPost,
     initiateEarRequest,
+    removeHiddenIframe,
 } from "../interaction_handler/SilentHandler.js";
 import { SsoSilentRequest } from "../request/SsoSilentRequest.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
@@ -276,7 +277,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             earJwk: earJwk,
             codeChallenge: pkceCodes.challenge,
         };
-        await invokeAsync(
+        const iframe = await invokeAsync(
             initiateEarRequest,
             BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
             this.logger,
@@ -291,19 +292,31 @@ export class SilentIframeClient extends StandardInteractionClient {
         );
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
-        const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
-            BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config.system.iframeBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
+                this.logger,
+                this.browserCrypto,
+                request,
+                this.performanceClient,
+                this.config.experimental
+            );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
+        }
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -415,8 +428,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             codeChallenge: pkceCodes.challenge,
         };
 
+        let iframe: HTMLIFrameElement;
         if (request.httpMethod === Constants.HttpMethod.POST) {
-            await invokeAsync(
+            iframe = await invokeAsync(
                 initiateCodeFlowWithPost,
                 BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
@@ -446,7 +460,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
 
             // Get the frame handle for the silent request
-            await invokeAsync(
+            iframe = await invokeAsync(
                 initiateCodeRequest,
                 BrowserPerformanceEvents.SilentHandlerInitiateAuthRequest,
                 this.logger,
@@ -457,19 +471,31 @@ export class SilentIframeClient extends StandardInteractionClient {
 
         const responseType = this.config.auth.OIDCOptions.responseMode;
         // Wait for response from the redirect bridge.
-        const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
-            BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            this.config.system.iframeBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        let responseString: string;
+        try {
+            responseString = await invokeAsync(
+                BrowserUtils.waitForBridgeResponse,
+                BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                this.config.system.iframeBridgeTimeout,
+                this.logger,
+                this.browserCrypto,
+                request,
+                this.performanceClient,
+                this.config.experimental
+            );
+        } finally {
+            invoke(
+                removeHiddenIframe,
+                BrowserPerformanceEvents.RemoveHiddenIframe,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(iframe);
+        }
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,

package/src/interaction_handler/SilentHandler.ts

@@ -127,3 +127,14 @@ function createHiddenIframe(): HTMLIFrameElement {
 
     return authFrame;
 }
+
+/**
+ * @hidden
+ * Removes a hidden iframe from `document.body` if it is a direct child.
+ * @param iframe - The iframe element to remove.
+ */
+export function removeHiddenIframe(iframe: HTMLIFrameElement): void {
+    if (document.body === iframe.parentNode) {
+        document.body.removeChild(iframe);
+    }
+}

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.6.1";
+export const version = "5.6.3";

package/src/redirect_bridge/index.ts

@@ -66,39 +66,61 @@ export async function broadcastResponseToMainFrame(
         };
 
         let navigateToUrl = "";
+        let clientId = "";
         const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
+        /*
+         * Retrieve the clientId and original navigation URL from
+         * sessionStorage. If sessionStorage access or JSON.parse fails,
+         * we fall back to URL-based navigation below.
+         */
         try {
-            /*
-             * Retrieve the original navigation URL from sessionStorage
-             */
-            const { clientId } = JSON.parse(
-                window.sessionStorage.getItem(interactionKey) || ""
-            );
+            const rawInteractionStatus =
+                window.sessionStorage.getItem(interactionKey);
+            const interactionStatus = JSON.parse(rawInteractionStatus || "");
+            clientId = interactionStatus.clientId || "";
+
             if (clientId) {
-                const cacheKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
-                navigateToUrl = window.sessionStorage.getItem(cacheKey) || "";
+                const originKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
+                navigateToUrl = window.sessionStorage.getItem(originKey) || "";
             }
-        } catch (e) {
-            // SessionStorage access may fail in some contexts, use default
+        } catch {
+            // sessionStorage access or JSON.parse failed
         }
 
-        // Reconstruct full URL with auth response (preserve original format)
-        let fullUrlResponse = "";
-        if (hasResponseInHash && hasResponseInQuery) {
-            // Hybrid format
-            fullUrlResponse = `${urlQuery}${urlHash}`;
-        } else if (hasResponseInHash) {
-            // Hash only
-            fullUrlResponse = urlHash;
-        } else {
-            // Query only
-            fullUrlResponse = urlQuery;
+        /*
+         * Cache the auth response payload in sessionStorage under the URL_HASH
+         * key, then navigate directly to the origin URL. This replicates what
+         * RedirectClient.handleRedirectPromise does when the current page is
+         * not the loginRequestUrl: it caches the response and navigates.
+         *
+         * On the target page, handleRedirectPromise will find no response in
+         * the URL but will pick up the cached payload from sessionStorage.
+         * This avoids appending the auth response to the URL, which would
+         * create malformed URLs for hash-routed SPAs (e.g. /#/route#code=...).
+         *
+         * If caching fails (clientId unavailable, quota exceeded, storage
+         * disabled), we still navigate to the origin/homepage. The target
+         * page's handleRedirectPromise will return null and the app can
+         * handle re-authentication. Appending auth params to the URL would
+         * not help because handleRedirectPromise also relies on
+         * sessionStorage to persist tokens.
+         */
+        if (clientId) {
+            try {
+                window.sessionStorage.setItem(
+                    `${PREFIX}.${clientId}.${TemporaryCacheKeys.URL_HASH}`,
+                    payload
+                );
+            } catch {
+                // sessionStorage write failed — navigate anyway; handleRedirectPromise will return null
+            }
         }
 
-        const homepage = `${
-            navigateToUrl || BrowserUtils.getHomepage()
-        }${fullUrlResponse}`;
-        await navClient.navigateInternal(homepage, navigationOptions);
+        const url = navigateToUrl || BrowserUtils.getHomepage();
+        // Strip bare trailing "?" (empty query string) to match canonical URL form
+        const navigationUrl = url.endsWith("?") ? url.slice(0, -1) : url;
+
+        await navClient.navigateInternal(navigationUrl, navigationOptions);
 
         // Do NOT clear URL for redirect flow - we're navigating away anyway
         return;

package/src/telemetry/BrowserPerformanceClient.ts

@@ -94,6 +94,10 @@ export class BrowserPerformanceClient
         return document.visibilityState?.toString() || null;
     }
 
+    private getOnlineStatus(): boolean | null {
+        return typeof navigator !== "undefined" ? navigator.onLine : null;
+    }
+
     private deleteIncompleteSubMeasurements(
         inProgressEvent: InProgressPerformanceEvent
     ): void {
@@ -134,6 +138,7 @@ export class BrowserPerformanceClient
     ): InProgressPerformanceEvent {
         // Capture page visibilityState and then invoke start/end measurement
         const startPageVisibility = this.getPageVisibility();
+        const startOnlineStatus = this.getOnlineStatus();
         const inProgressEvent = super.startMeasurement(
             measureName,
             correlationId
@@ -166,6 +171,7 @@ export class BrowserPerformanceClient
                     {
                         ...event,
                         startPageVisibility,
+                        startOnlineStatus,
                         endPageVisibility: this.getPageVisibility(),
                         durationMs: getPerfDurationMs(startTime),
                         networkEffectiveType: networkInfo.effectiveType,

package/src/telemetry/BrowserPerformanceEvents.ts

@@ -184,3 +184,9 @@ export const LoadAccount = "loadAccount";
 export const LoadIdToken = "loadIdToken";
 export const LoadAccessToken = "loadAccessToken";
 export const LoadRefreshToken = "loadRefreshToken";
+
+/**
+ * Background telemetry measurement that tracks whether a late bridge response
+ * arrives after the iframe timeout has already fired.
+ */
+export const WaitForBridgeLateResponse = "waitForBridgeLateResponse";

package/src/utils/BrowserUtils.ts

@@ -11,11 +11,13 @@ import {
     RequestParameterBuilder,
     ICrypto,
     IPerformanceClient,
+    InProgressPerformanceEvent,
     Logger,
     CommonAuthorizationUrlRequest,
     CommonEndSessionRequest,
     ProtocolUtils,
 } from "@azure/msal-common/browser";
+import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
@@ -26,7 +28,10 @@ import {
     BrowserConfigurationAuthErrorCodes,
     createBrowserConfigurationAuthError,
 } from "../error/BrowserConfigurationAuthError.js";
-import { BrowserConfiguration } from "../config/Configuration.js";
+import {
+    BrowserConfiguration,
+    BrowserExperimentalOptions,
+} from "../config/Configuration.js";
 import { redirectBridgeEmptyResponse } from "../error/BrowserAuthErrorCodes.js";
 import { base64Decode } from "../encode/Base64Decode.js";
 
@@ -236,7 +241,8 @@ export async function waitForBridgeResponse(
     logger: Logger,
     browserCrypto: ICrypto,
     request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
-    performanceClient: IPerformanceClient
+    performanceClient: IPerformanceClient,
+    experimentalConfig?: BrowserExperimentalOptions
 ): Promise<string> {
     return new Promise<string>((resolve, reject) => {
         logger.verbose(
@@ -249,6 +255,8 @@ export async function waitForBridgeResponse(
         performanceClient.addFields(
             {
                 redirectBridgeTimeoutMs: timeoutMs,
+                lateResponseExperimentEnabled:
+                    experimentalConfig?.iframeTimeoutTelemetry || false,
             },
             correlationId
         );
@@ -259,12 +267,27 @@ export async function waitForBridgeResponse(
         );
         const channel = new BroadcastChannel(libraryState.id);
         let responseString: string | undefined = undefined;
+        let timedOut = false;
+        let lateTimeoutId: number | undefined;
+        let lateMeasurement: InProgressPerformanceEvent | undefined;
 
         const timeoutId = window.setTimeout(() => {
             // Clear the active monitor
             activeBridgeMonitor = null;
-
-            channel.close();
+            if (experimentalConfig?.iframeTimeoutTelemetry) {
+                lateMeasurement = performanceClient.startMeasurement(
+                    BrowserPerformanceEvents.WaitForBridgeLateResponse,
+                    correlationId
+                );
+                timedOut = true;
+                lateTimeoutId = window.setTimeout(() => {
+                    lateMeasurement?.end({ success: false });
+                    clearTimeout(lateTimeoutId);
+                    channel.close();
+                }, 60000); // 60s late response timeout to allow for telemetry of late responses
+            } else {
+                channel.close();
+            }
             reject(
                 createBrowserAuthError(
                     BrowserAuthErrorCodes.timedOut,
@@ -288,6 +311,15 @@ export async function waitForBridgeResponse(
                     ? event.data.v
                     : undefined;
 
+            if (timedOut) {
+                lateMeasurement?.end({
+                    success: responseString ? true : false,
+                });
+                clearTimeout(lateTimeoutId);
+                channel.close();
+                return;
+            }
+
             performanceClient.addFields(
                 {
                     redirectBridgeMessageVersion: messageVersion,