@azure/msal-browser 5.6.3 → 5.8.0

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -23,6 +23,7 @@ import {
     Logger,
     PerformanceEvents,
     PopTokenGenerator,
+    RequestParameterBuilder,
     ScopeSet,
     ServerTelemetryManager,
     SignedHttpRequestParameters,
@@ -166,7 +167,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         // start the perf measurement
         const nativeATMeasurement = this.performanceClient.startMeasurement(
             BrowserPerformanceEvents.NativeInteractionClientAcquireToken,
-            request.correlationId
+            this.correlationId
         );
         const reqTimestamp = TimeUtils.nowSeconds();
 
@@ -180,7 +181,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
 
         try {
             // initialize native request
-            const nativeRequest = await this.initializeNativeRequest(request);
+            const nativeRequest = await this.initializePlatformRequest(request);
 
             // check if the tokens can be retrieved from internal cache
             try {
@@ -200,6 +201,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                         "MSAL internal Cache does not contain tokens, return error as per cache policy",
                         this.correlationId
                     );
+                    nativeATMeasurement.end({
+                        success: false,
+                        brokerErrorCode: "cache_request_failed",
+                    });
                     throw e;
                 }
                 // continue with a native call for any and all errors
@@ -231,7 +236,6 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                         success: false,
                         errorCode: error.errorCode,
                         subErrorCode: error.subError,
-                        isNativeBroker: true,
                     });
                     throw error;
                 });
@@ -239,6 +243,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             if (e instanceof NativeAuthError) {
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
             }
+            nativeATMeasurement.end({
+                success: false,
+            });
             throw e;
         }
     }
@@ -284,7 +291,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             {
                 nativeAccountId,
             },
-            request.correlationId
+            this.correlationId
         );
 
         if (!account) {
@@ -301,14 +308,29 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 silentRequest
             );
 
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims as TokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(
+                account,
+                this.correlationId,
+                this.browserStorage.getTokenKeys(),
+                account.tenantId
+            );
+
+            const idTokenClaims = AuthToken.extractTokenClaims(
+                idToken?.secret || "",
+                base64Decode
+            );
+
+            const fullAccount = updateAccountTenantProfileData(
+                account,
+                undefined, // tenantProfile optional
+                idTokenClaims,
+                idToken?.secret
+            );
 
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims as TokenClaims,
                 account: fullAccount,
             };
         } catch (e) {
@@ -332,7 +354,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.correlationId
         );
 
-        const nativeRequest = await this.initializeNativeRequest(request);
+        const nativeRequest = await this.initializePlatformRequest(request);
         const navigateToLoginRequestUrl =
             options?.navigateToLoginRequestUrl ?? true;
 
@@ -385,10 +407,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param performanceClient {IPerformanceClient?}
      * @param correlationId {string?} correlation identifier
      */
-    async handleRedirectPromise(
-        performanceClient?: IPerformanceClient,
-        correlationId?: string
-    ): Promise<AuthenticationResult | null> {
+    async handleRedirectPromise(): Promise<AuthenticationResult | null> {
         this.logger.trace(
             "NativeInteractionClient - handleRedirectPromise called.",
             this.correlationId
@@ -408,12 +427,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 "NativeInteractionClient - handleRedirectPromise called but there is no cached request, returning null.",
                 this.correlationId
             );
-            if (performanceClient && correlationId) {
-                performanceClient?.addFields(
-                    { errorCode: "no_cached_request" },
-                    correlationId
-                );
-            }
+            this.performanceClient?.addFields(
+                { errorCode: "no_cached_request" },
+                this.correlationId
+            );
             return null;
         }
 
@@ -454,6 +471,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 this.logger
             );
             serverTelemetryManager.clearNativeBrokerErrorCode();
+            this.performanceClient?.addFields(
+                { isNativeBroker: true },
+                this.correlationId
+            );
             return authResult;
         } catch (e) {
             throw e;
@@ -570,9 +591,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             request,
             homeAccountIdentifier,
             idTokenClaims,
-            response.access_token,
             result.tenantId,
-            reqTimestamp
+            reqTimestamp,
+            authority.getPreferredCache() // environment
         );
 
         return result;
@@ -788,19 +809,19 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(
+    async cacheNativeTokens(
         response: PlatformAuthResponse,
         request: PlatformAuthRequest,
         homeAccountIdentifier: string,
         idTokenClaims: TokenClaims,
-        responseAccessToken: string,
         tenantId: string,
-        reqTimestamp: number
+        reqTimestamp: number,
+        environment: string
     ): Promise<void> {
         const cachedIdToken: IdTokenEntity | null =
             CacheHelpers.createIdTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
+                environment,
                 response.id_token || "",
                 request.clientId,
                 idTokenClaims.tid || ""
@@ -822,8 +843,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedAccessToken: AccessTokenEntity | null =
             CacheHelpers.createAccessTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
-                responseAccessToken,
+                environment,
+                response.access_token,
                 request.clientId,
                 idTokenClaims.tid || tenantId,
                 responseScopes.printScopes(),
@@ -836,8 +857,17 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 request.keyId
             );
 
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(
+                cachedIdToken,
+                this.correlationId,
+                AuthToken.isKmsi(idTokenClaims)
+            );
+        }
+
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
 
@@ -936,23 +966,38 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * Translates developer provided request object into NativeRequest object
      * @param request
      */
-    protected async initializeNativeRequest(
+    protected async initializePlatformRequest(
         request: PopupRequest | SsoSilentRequest
     ): Promise<PlatformAuthRequest> {
         this.logger.trace(
-            "NativeInteractionClient - initializeNativeRequest called",
+            "NativeInteractionClient - initializePlatformRequest called",
             this.correlationId
         );
 
         const canonicalAuthority = await this.getCanonicalAuthority(request);
 
+        // ignore config claims if skipBrokerClaims is set to true and this is a brokered authentication flow
+        const configClaims =
+            request.skipBrokerClaims && !!request.embeddedClientId
+                ? undefined
+                : this.config.auth.clientCapabilities;
+
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
-        const { scopes, ...remainingProperties } = request;
+        const { scopes, claims, ...remainingProperties } = request;
         const scopeSet = new ScopeSet(scopes || []);
         scopeSet.appendScopes(Constants.OIDC_DEFAULT_SCOPES);
 
+        const mergedClaims =
+            configClaims && configClaims.length
+                ? RequestParameterBuilder.addClientCapabilitiesToClaims(
+                      claims,
+                      configClaims
+                  )
+                : claims;
+
         const validatedRequest: PlatformAuthRequest = {
             ...remainingProperties,
+            claims: mergedClaims,
             accountId: this.accountId,
             clientId: this.config.auth.clientId,
             authority: canonicalAuthority.urlString,
@@ -1066,7 +1111,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             case ApiId.ssoSilent:
             case ApiId.acquireTokenSilent_silentFlow:
                 this.logger.trace(
-                    "initializeNativeRequest: silent request sets prompt to none",
+                    "initializePlatformRequest: silent request sets prompt to none",
                     this.correlationId
                 );
                 return Constants.PromptValue.NONE;
@@ -1077,7 +1122,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         // Prompt not provided, request may proceed and native broker decides if it needs to prompt
         if (!prompt) {
             this.logger.trace(
-                "initializeNativeRequest: prompt was not provided",
+                "initializePlatformRequest: prompt was not provided",
                 this.correlationId
             );
             return undefined;
@@ -1089,13 +1134,13 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             case Constants.PromptValue.CONSENT:
             case Constants.PromptValue.LOGIN:
                 this.logger.trace(
-                    "initializeNativeRequest: prompt is compatible with native flow",
+                    "initializePlatformRequest: prompt is compatible with native flow",
                     this.correlationId
                 );
                 return prompt;
             default:
                 this.logger.trace(
-                    `initializeNativeRequest: prompt = '${prompt}' is not compatible with native flow`,
+                    `initializePlatformRequest: prompt = '${prompt}' is not compatible with native flow`,
                     this.correlationId
                 );
                 throw createBrowserAuthError(
@@ -1149,7 +1194,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 embeddedClientId: child_client_id,
                 embeddedRedirectUri: child_redirect_uri,
             },
-            request.correlationId
+            this.correlationId
         );
     }
 }

package/src/interaction_client/PopupClient.ts

@@ -18,6 +18,7 @@ import {
     invoke,
     PkceCodes,
     CommonAuthorizationUrlRequest,
+    ProtocolUtils,
 } from "@azure/msal-common/browser";
 import {
     initializeAuthorizationRequest,
@@ -762,6 +763,15 @@ export class PopupClient extends StandardInteractionClient {
                 }
             }
 
+            // Redirect bridge requires "state" param to work properly
+            validRequest.state = ProtocolUtils.setRequestState(
+                this.browserCrypto,
+                validRequest.state || "",
+                {
+                    interactionType: InteractionType.Popup,
+                }
+            );
+
             // Create logout string and navigate user window to logout.
             const logoutUri: string = authClient.getLogoutUri(validRequest);
 

package/src/interaction_client/RedirectClient.ts

@@ -19,6 +19,7 @@ import {
     UrlUtils,
     InProgressPerformanceEvent,
     CommonAuthorizationUrlRequest,
+    ProtocolUtils,
 } from "@azure/msal-common/browser";
 import {
     initializeAuthorizationRequest,
@@ -870,6 +871,15 @@ export class RedirectClient extends StandardInteractionClient {
                 }
             }
 
+            // Redirect bridge requires "state" param to work properly
+            validLogoutRequest.state = ProtocolUtils.setRequestState(
+                this.browserCrypto,
+                validLogoutRequest.state || "",
+                {
+                    interactionType: InteractionType.Redirect,
+                }
+            );
+
             // Create logout string and navigate user window to logout.
             const logoutUri: string =
                 authClient.getLogoutUri(validLogoutRequest);

package/src/interaction_client/SilentIframeClient.ts

@@ -15,6 +15,8 @@ import {
     invoke,
     ProtocolMode,
     CommonAuthorizationUrlRequest,
+    AuthorizeProtocol,
+    PkceCodes,
 } from "@azure/msal-common/browser";
 import {
     initializeAuthorizationRequest,
@@ -392,6 +394,85 @@ export class SilentIframeClient extends StandardInteractionClient {
         }
     }
 
+    /**
+     * Verifies SSO capability by making an iframe request to /authorize without exchanging the code for tokens.
+     * This is useful for verifying SSO capability in the background without the overhead of a full token exchange.
+     * @param request - The SSO silent request
+     * @returns true if SSO verification was successful with a valid authorization code, false otherwise
+     */
+    async verifySso(request: SsoSilentRequest): Promise<boolean> {
+        const inputRequest = { ...request };
+        if (!inputRequest.prompt) {
+            inputRequest.prompt = Constants.PromptValue.NONE;
+        }
+
+        // Create silent request
+        const silentRequest: CommonAuthorizationUrlRequest = await invokeAsync(
+            initializeAuthorizationRequest,
+            BrowserPerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
+            inputRequest,
+            InteractionType.Silent,
+            this.config,
+            this.browserCrypto,
+            this.browserStorage,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        );
+
+        const authClient: AuthorizationCodeClient = await invokeAsync(
+            this.createAuthCodeClient.bind(this),
+            BrowserPerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )({
+            serverTelemetryManager: initializeServerTelemetryManager(
+                this.apiId,
+                this.config.auth.clientId,
+                this.correlationId,
+                this.browserStorage,
+                this.logger
+            ),
+            requestAuthority: silentRequest.authority,
+            requestAzureCloudOptions: silentRequest.azureCloudOptions,
+            requestExtraQueryParameters: silentRequest.extraQueryParameters,
+            account: silentRequest.account,
+        });
+
+        const { serverParams } = await this.silentAuthorizeHelper(
+            authClient,
+            silentRequest
+        );
+
+        const correlationId = silentRequest.correlationId;
+
+        // Validate the response - this checks for errors and validates state
+        AuthorizeProtocol.validateAuthorizationResponse(
+            serverParams,
+            silentRequest.state
+        );
+
+        // Verify a valid authorization code is present
+        if (!serverParams.code) {
+            this.logger.warning(
+                "SSO verification response did not contain an authorization code",
+                correlationId
+            );
+            return false;
+        }
+
+        this.logger.verbose(
+            "SSO verification completed successfully with valid authorization code - skipped token exchange",
+            correlationId
+        );
+        return true;
+    }
+
     /**
      * Currently Unsupported
      */
@@ -414,6 +495,47 @@ export class SilentIframeClient extends StandardInteractionClient {
         authClient: AuthorizationCodeClient,
         request: CommonAuthorizationUrlRequest
     ): Promise<AuthenticationResult> {
+        const { serverParams, pkceCodes } = await this.silentAuthorizeHelper(
+            authClient,
+            request
+        );
+
+        return invokeAsync(
+            Authorize.handleResponseCode,
+            BrowserPerformanceEvents.HandleResponseCode,
+            this.logger,
+            this.performanceClient,
+            request.correlationId
+        )(
+            request,
+            serverParams,
+            pkceCodes.verifier,
+            this.apiId,
+            this.config,
+            authClient,
+            this.browserStorage,
+            this.nativeStorage,
+            this.eventHandler,
+            this.logger,
+            this.performanceClient,
+            this.platformAuthProvider
+        );
+    }
+
+    /**
+     * Shared helper that generates PKCE codes, builds the /authorize URL,
+     * loads it in a hidden iframe, waits for the redirect-bridge response,
+     * and returns the deserialized server parameters along with the PKCE codes
+     * and the request that was sent.
+     */
+    private async silentAuthorizeHelper(
+        authClient: AuthorizationCodeClient,
+        request: CommonAuthorizationUrlRequest
+    ): Promise<{
+        serverParams: ReturnType<typeof ResponseHandler.deserializeResponse>;
+        pkceCodes: PkceCodes;
+        silentRequest: CommonAuthorizationUrlRequest;
+    }> {
         const correlationId = request.correlationId;
         const pkceCodes = await invokeAsync(
             generatePkceCodes,
@@ -505,25 +627,6 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId
         )(responseString, responseType, this.logger, this.correlationId);
 
-        return invokeAsync(
-            Authorize.handleResponseCode,
-            BrowserPerformanceEvents.HandleResponseCode,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            request,
-            serverParams,
-            pkceCodes.verifier,
-            this.apiId,
-            this.config,
-            authClient,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        return { serverParams, pkceCodes, silentRequest };
     }
 }

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.6.3";
+export const version = "5.8.0";

package/src/protocol/Authorize.ts

@@ -176,6 +176,14 @@ async function getStandardParameters(
         // signal ests that this is a WAM call
         RequestParameterBuilder.addNativeBroker(parameters);
 
+        // instrument JS-platform bridge specific fields
+        performanceClient.addFields(
+            {
+                isPlatformAuthorizeRequest: true,
+            },
+            request.correlationId
+        );
+
         // pass the req_cnf for POP
         if (
             request.authenticationScheme === Constants.AuthenticationScheme.POP

package/src/redirect_bridge/index.ts

@@ -7,6 +7,7 @@ import { parseAuthResponseFromUrl } from "../utils/BrowserUtils.js";
 import * as BrowserUtils from "../utils/BrowserUtils.js";
 import {
     ApiId,
+    INTERACTION_TYPE,
     InteractionType,
     TemporaryCacheKeys,
 } from "../utils/BrowserConstants.js";
@@ -59,14 +60,10 @@ export async function broadcastResponseToMainFrame(
 
     if (meta["interactionType"] === InteractionType.Redirect) {
         const navClient = navigationClient || new NavigationClient();
-        const navigationOptions: NavigationOptions = {
-            apiId: ApiId.handleRedirectPromise,
-            noHistory: true,
-            timeout: DEFAULT_REDIRECT_TIMEOUT_MS,
-        };
 
         let navigateToUrl = "";
         let clientId = "";
+        let interactionType = "";
         const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
         /*
          * Retrieve the clientId and original navigation URL from
@@ -78,6 +75,7 @@ export async function broadcastResponseToMainFrame(
                 window.sessionStorage.getItem(interactionKey);
             const interactionStatus = JSON.parse(rawInteractionStatus || "");
             clientId = interactionStatus.clientId || "";
+            interactionType = interactionStatus.type;
 
             if (clientId) {
                 const originKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
@@ -87,6 +85,15 @@ export async function broadcastResponseToMainFrame(
             // sessionStorage access or JSON.parse failed
         }
 
+        const navigationOptions: NavigationOptions = {
+            apiId:
+                interactionType === INTERACTION_TYPE.SIGNOUT
+                    ? ApiId.logout
+                    : ApiId.handleRedirectPromise,
+            noHistory: true,
+            timeout: DEFAULT_REDIRECT_TIMEOUT_MS,
+        };
+
         /*
          * Cache the auth response payload in sessionStorage under the URL_HASH
          * key, then navigate directly to the origin URL. This replicates what

package/src/telemetry/BrowserPerformanceEvents.ts

@@ -75,6 +75,9 @@ export const FetchAccountIdWithNativeBroker = "fetchAccountIdWithNativeBroker";
 export const NativeInteractionClientAcquireToken =
     "nativeInteractionClientAcquireToken";
 
+export const NativeInteractionClientAcquireTokenRedirect =
+    "nativeInteractionClientAcquireToken";
+
 /**
  * Time spent creating default headers for requests to token endpoint
  */

package/src/telemetry/BrowserRootPerformanceEvents.ts

@@ -41,3 +41,10 @@ export const InitializeClientApplication = "initializeClientApplication";
 export const LocalStorageUpdated = "localStorageUpdated";
 // Load external tokens
 export const LoadExternalTokens = "loadExternalTokens";
+/**
+ * SSO capability verification call (msal-browser).
+ * Fire-and-forget SSO verification call made after interactive authentication completes.
+ */
+export const SsoCapable = "ssoCapable";
+// Wait for late response from bridge after timeout has already occurred
+export const WaitForBridgeLateResponse = "waitForBridgeLateResponse";