@azure/msal-browser 5.7.0 → 5.9.0

package/src/cache/CookieStorage.ts

@@ -25,15 +25,21 @@ export class CookieStorage implements IWindowStorage<string> {
     }
 
     getItem(key: string): string | null {
-        const name = `${encodeURIComponent(key)}`;
+        const name = encodeURIComponent(key);
         const cookieList = document.cookie.split(";");
         for (let i = 0; i < cookieList.length; i++) {
-            const cookie = cookieList[i];
-            const [key, ...rest] = decodeURIComponent(cookie).trim().split("=");
-            const value = rest.join("=");
-
-            if (key === name) {
-                return value;
+            const cookie = cookieList[i].trim();
+            const eqIndex = cookie.indexOf("=");
+            const rawKey =
+                eqIndex === -1 ? cookie : cookie.substring(0, eqIndex);
+            if (rawKey === name) {
+                const rawValue =
+                    eqIndex === -1 ? "" : cookie.substring(eqIndex + 1);
+                try {
+                    return decodeURIComponent(rawValue);
+                } catch {
+                    return rawValue;
+                }
             }
         }
         return "";
@@ -82,8 +88,15 @@ export class CookieStorage implements IWindowStorage<string> {
         const cookieList = document.cookie.split(";");
         const keys: Array<string> = [];
         cookieList.forEach((cookie) => {
-            const cookieParts = decodeURIComponent(cookie).trim().split("=");
-            keys.push(cookieParts[0]);
+            const trimmed = cookie.trim();
+            const eqIndex = trimmed.indexOf("=");
+            const rawKey =
+                eqIndex === -1 ? trimmed : trimmed.substring(0, eqIndex);
+            try {
+                keys.push(decodeURIComponent(rawKey));
+            } catch {
+                // Skip cookies with malformed percent-encoded sequences in the key
+            }
         });
 
         return keys;

package/src/controllers/StandardController.ts

@@ -29,6 +29,8 @@ import {
     Constants,
     AuthToken,
     enforceResourceParameter,
+    CacheHelpers,
+    TimeUtils,
 } from "@azure/msal-common/browser";
 import * as BrowserPerformanceEvents from "../telemetry/BrowserPerformanceEvents.js";
 import * as BrowserRootPerformanceEvents from "../telemetry/BrowserRootPerformanceEvents.js";
@@ -60,6 +62,7 @@ import { EndSessionRequest } from "../request/EndSessionRequest.js";
 import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest.js";
 import { INavigationClient } from "../navigation/INavigationClient.js";
 import { EventHandler } from "../event/EventHandler.js";
+import { base64Decode } from "../encode/Base64Decode.js";
 import { PopupClient } from "../interaction_client/PopupClient.js";
 import { RedirectClient } from "../interaction_client/RedirectClient.js";
 import { SilentIframeClient } from "../interaction_client/SilentIframeClient.js";
@@ -1706,11 +1709,59 @@ export class StandardController implements IController {
 
         if (result.fromPlatformBroker) {
             this.logger.verbose(
-                "Response was from native broker, storing in-memory",
+                "Response was from native broker, storing ID Token in browser storage and Access Token in-memory",
                 result.correlationId
             );
-            // Tokens from native broker are stored in-memory
-            return this.nativeInternalStorage.hydrateCache(result, request);
+
+            // Create idToken entity and store in browser storage
+            const idTokenEntity = CacheHelpers.createIdTokenEntity(
+                result.account.homeAccountId,
+                result.account.environment,
+                result.idToken,
+                this.config.auth.clientId,
+                result.tenantId
+            );
+
+            // Create accessToken entity and store in native internal storage
+            const accessTokenEntity = CacheHelpers.createAccessTokenEntity(
+                result.account.homeAccountId,
+                result.account.environment,
+                result.accessToken,
+                this.config.auth.clientId,
+                result.tenantId,
+                result.scopes.join(" "),
+                result.expiresOn
+                    ? TimeUtils.toSecondsFromDate(result.expiresOn)
+                    : 0,
+                result.extExpiresOn
+                    ? TimeUtils.toSecondsFromDate(result.extExpiresOn)
+                    : 0,
+                base64Decode,
+                undefined, // refreshOn
+                result.tokenType as Constants.AuthenticationScheme,
+                undefined, // userAssertionHash
+                request.sshKid
+            );
+
+            if (request.resource) {
+                accessTokenEntity.resource = request.resource;
+            }
+
+            const kmsi = AuthToken.isKmsi(result.idTokenClaims);
+
+            // Store idToken in browser storage
+            await this.browserStorage.setIdTokenCredential(
+                idTokenEntity,
+                result.correlationId,
+                kmsi
+            );
+
+            // Store accessToken in native internal storage
+            await this.nativeInternalStorage.setAccessTokenCredential(
+                accessTokenEntity,
+                result.correlationId,
+                kmsi
+            );
         } else {
             return this.browserStorage.hydrateCache(result, request);
         }
@@ -1838,7 +1889,9 @@ export class StandardController implements IController {
                 loginHint: request.loginHint,
                 sid: request.sid,
             }) ||
-            this.getActiveAccount();
+            (!request.loginHint && !request.sid
+                ? this.getActiveAccount()
+                : null);
 
         return (account && account.nativeAccountId) || "";
     }

package/src/custom_auth/UserAccountAttributes.ts

@@ -7,6 +7,7 @@ export type UserAccountAttributes = Record<string, string> & {
     city?: string;
     country?: string;
     displayName?: string;
+    flatusername?: string;
     givenName?: string;
     jobTitle?: string;
     postalCode?: string;

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -146,7 +146,6 @@ export class SignInApiClient extends BaseApiClient {
                 continuation_token: params.continuation_token,
                 scope: params.scope,
                 grant_type: GrantType.CONTINUATION_TOKEN,
-                client_info: true,
                 ...(params.claims && { claims: params.claims }),
                 ...(params.username && { username: params.username }),
             },
@@ -180,12 +179,12 @@ export class SignInApiClient extends BaseApiClient {
     }
 
     private async requestTokens(
-        requestData: Record<string, string | boolean>,
+        requestData: Record<string, string>,
         telemetryManager: ServerTelemetryManager,
         correlationId: string
     ): Promise<SignInTokenResponse> {
         // The client_info parameter is required for MSAL to return the uid and utid in the response.
-        requestData.client_info = true;
+        requestData.client_info = "1";
 
         const result = await this.request<SignInTokenResponse>(
             CustomAuthApiEndpoint.SIGNIN_TOKEN,

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -308,14 +308,29 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 silentRequest
             );
 
-            const fullAccount = {
-                ...account,
-                idTokenClaims: result?.idTokenClaims as TokenClaims,
-                idToken: result?.idToken,
-            };
+            const idToken = this.browserStorage.getIdToken(
+                account,
+                this.correlationId,
+                this.browserStorage.getTokenKeys(),
+                account.tenantId
+            );
+
+            const idTokenClaims = AuthToken.extractTokenClaims(
+                idToken?.secret || "",
+                base64Decode
+            );
+
+            const fullAccount = updateAccountTenantProfileData(
+                account,
+                undefined, // tenantProfile optional
+                idTokenClaims,
+                idToken?.secret
+            );
 
             return {
                 ...result,
+                idToken: idToken?.secret || "",
+                idTokenClaims: idTokenClaims as TokenClaims,
                 account: fullAccount,
             };
         } catch (e) {
@@ -576,9 +591,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             request,
             homeAccountIdentifier,
             idTokenClaims,
-            response.access_token,
             result.tenantId,
-            reqTimestamp
+            reqTimestamp,
+            authority.getPreferredCache() // environment
         );
 
         return result;
@@ -794,19 +809,19 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      * @param tenantId
      * @param reqTimestamp
      */
-    cacheNativeTokens(
+    async cacheNativeTokens(
         response: PlatformAuthResponse,
         request: PlatformAuthRequest,
         homeAccountIdentifier: string,
         idTokenClaims: TokenClaims,
-        responseAccessToken: string,
         tenantId: string,
-        reqTimestamp: number
+        reqTimestamp: number,
+        environment: string
     ): Promise<void> {
         const cachedIdToken: IdTokenEntity | null =
             CacheHelpers.createIdTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
+                environment,
                 response.id_token || "",
                 request.clientId,
                 idTokenClaims.tid || ""
@@ -828,8 +843,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const cachedAccessToken: AccessTokenEntity | null =
             CacheHelpers.createAccessTokenEntity(
                 homeAccountIdentifier,
-                request.authority,
-                responseAccessToken,
+                environment,
+                response.access_token,
                 request.clientId,
                 idTokenClaims.tid || tenantId,
                 responseScopes.printScopes(),
@@ -842,8 +857,17 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 request.keyId
             );
 
+        // save idtoken credential in configured browser storage
+        if (!!cachedIdToken && request.storeInCache?.idToken !== false) {
+            await this.browserStorage.setIdTokenCredential(
+                cachedIdToken,
+                this.correlationId,
+                AuthToken.isKmsi(idTokenClaims)
+            );
+        }
+
+        // save access token credential in memory storage
         const nativeCacheRecord = {
-            idToken: cachedIdToken,
             accessToken: cachedAccessToken,
         };
 

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "5.7.0";
+export const version = "5.9.0";