@azure/msal-common 14.10.0 → 14.12.0

package/src/client/AuthorizationCodeClient.ts

@@ -390,15 +390,22 @@ export class AuthorizationCodeClient extends BaseClient {
                 this.performanceClient
             );
 
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
                 parameterBuilder.addSshJwk(request.sshJwk);
@@ -682,15 +689,22 @@ export class AuthorizationCodeClient extends BaseClient {
                 const popTokenGenerator = new PopTokenGenerator(
                     this.cryptoUtils
                 );
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(
-                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                    PerformanceEvents.PopTokenGenerateCnf,
-                    this.logger,
-                    this.performanceClient,
-                    request.correlationId
-                )(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(
+                        popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                        PerformanceEvents.PopTokenGenerateCnf,
+                        this.logger,
+                        this.performanceClient,
+                        request.correlationId
+                    )(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                } else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
 

package/src/client/RefreshTokenClient.ts

@@ -407,15 +407,24 @@ export class RefreshTokenClient extends BaseClient {
                 this.cryptoUtils,
                 this.performanceClient
             );
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
                 parameterBuilder.addSshJwk(request.sshJwk);

package/src/crypto/ICrypto.ts

@@ -49,6 +49,16 @@ export interface ICrypto {
      * @param input
      */
     base64Decode(input: string): string;
+    /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
     /**
      * Generates an JWK RSA S256 Thumbprint
      * @param request
@@ -92,6 +102,12 @@ export const DEFAULT_CRYPTO_IMPLEMENTATION: ICrypto = {
     base64Encode: (): string => {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },
+    base64UrlEncode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    encodeKid: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
     async getPublicKeyThumbprint(): Promise<string> {
         throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
     },

package/src/crypto/PopTokenGenerator.ts

@@ -26,7 +26,6 @@ type ReqCnf = {
 export type ReqCnfData = {
     kid: string;
     reqCnfString: string;
-    reqCnfHash: string;
 };
 
 const KeyLocation = {
@@ -67,14 +66,13 @@ export class PopTokenGenerator {
             this.performanceClient,
             request.correlationId
         )(request);
-        const reqCnfString: string = this.cryptoUtils.base64Encode(
+        const reqCnfString: string = this.cryptoUtils.base64UrlEncode(
             JSON.stringify(reqCnf)
         );
 
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
 

package/src/index.ts

@@ -8,6 +8,13 @@
  * @module @azure/msal-common
  */
 
+import * as AuthToken from "./account/AuthToken";
+import * as AuthorityFactory from "./authority/AuthorityFactory";
+import * as CacheHelpers from "./cache/utils/CacheHelpers";
+import * as TimeUtils from "./utils/TimeUtils";
+import * as UrlUtils from "./utils/UrlUtils";
+import * as ClientAssertionUtils from "./utils/ClientAssertionUtils";
+import * as AADServerParamKeys from "./constants/AADServerParamKeys";
 export { AuthorizationCodeClient } from "./client/AuthorizationCodeClient";
 export { RefreshTokenClient } from "./client/RefreshTokenClient";
 export { SilentFlowClient } from "./client/SilentFlowClient";
@@ -36,7 +43,7 @@ export {
     tenantIdMatchesHomeTenant,
     buildTenantProfileFromIdTokenClaims,
 } from "./account/AccountInfo";
-export * as AuthToken from "./account/AuthToken";
+export { AuthToken };
 export {
     TokenClaims,
     getTenantIdFromIdTokenClaims,
@@ -59,7 +66,7 @@ export {
     AzureCloudInstance,
     StaticAuthorityOptions,
 } from "./authority/AuthorityOptions";
-export * as AuthorityFactory from "./authority/AuthorityFactory";
+export { AuthorityFactory };
 export { AuthorityType } from "./authority/AuthorityType";
 export { ProtocolMode } from "./authority/ProtocolMode";
 export { OIDCOptions } from "./authority/OIDCOptions";
@@ -81,7 +88,7 @@ export {
 } from "./cache/utils/CacheTypes";
 export { CacheRecord } from "./cache/entities/CacheRecord";
 export { CredentialEntity } from "./cache/entities/CredentialEntity";
-export * as CacheHelpers from "./cache/utils/CacheHelpers";
+export { CacheHelpers };
 export { AppMetadataEntity } from "./cache/entities/AppMetadataEntity";
 export { AccountEntity } from "./cache/entities/AccountEntity";
 export { IdTokenEntity } from "./cache/entities/IdTokenEntity";
@@ -213,7 +220,7 @@ export {
     DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     JsonWebTokenTypes,
 } from "./utils/Constants";
-export * as AADServerParamKeys from "./constants/AADServerParamKeys";
+export { AADServerParamKeys };
 export { StringUtils } from "./utils/StringUtils";
 export { StringDict } from "./utils/MsalTypes";
 export {
@@ -221,9 +228,7 @@ export {
     RequestStateObject,
     LibraryStateObject,
 } from "./utils/ProtocolUtils";
-export * as TimeUtils from "./utils/TimeUtils";
-export * as UrlUtils from "./utils/UrlUtils";
-export * as ClientAssertionUtils from "./utils/ClientAssertionUtils";
+export { TimeUtils, UrlUtils, ClientAssertionUtils };
 export * from "./utils/FunctionWrappers";
 // Server Telemetry
 export { ServerTelemetryManager } from "./telemetry/server/ServerTelemetryManager";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.10.0";
+export const version = "14.12.0";

package/src/request/BaseAuthRequest.ts

@@ -28,6 +28,7 @@ import { ShrOptions } from "../crypto/SignedHttpRequest";
  * - tokenQueryParameters    - String to string map of custom query parameters added to the /token call
  * - storeInCache            - Object containing boolean values indicating whether to store tokens in the cache or not (default is true)
  * - scenarioId              - Scenario id to track custom user prompts
+ * - popKid                  - Key ID to identify the public key for PoP token request
  */
 export type BaseAuthRequest = {
     authority: string;
@@ -48,4 +49,5 @@ export type BaseAuthRequest = {
     tokenQueryParameters?: StringDict;
     storeInCache?: StoreInCache;
     scenarioId?: string;
+    popKid?: string;
 };

package/src/response/ResponseHandler.ts

@@ -591,8 +591,14 @@ export class ResponseHandler {
         let familyId: string = Constants.EMPTY_STRING;
 
         if (cacheRecord.accessToken) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
             if (
-                cacheRecord.accessToken.tokenType === AuthenticationScheme.POP
+                cacheRecord.accessToken.tokenType ===
+                    AuthenticationScheme.POP &&
+                !request.popKid
             ) {
                 const popTokenGenerator: PopTokenGenerator =
                     new PopTokenGenerator(cryptoObj);

package/src/telemetry/performance/PerformanceEvent.ts

@@ -40,9 +40,17 @@ export const PerformanceEvents = {
      */
     AcquireTokenPopup: "acquireTokenPopup",
 
+    /**
+     * acquireTokenPreRedirect (msal-browser).
+     * First part of the redirect flow.
+     * Used to acquire a new access token interactively through redirects.
+     */
+    AcquireTokenPreRedirect: "acquireTokenPreRedirect",
+
     /**
      * acquireTokenRedirect (msal-browser).
-     * Used to acquire a new access token interactively through redirects
+     * Second part of the redirect flow.
+     * Used to acquire a new access token interactively through redirects.
      */
     AcquireTokenRedirect: "acquireTokenRedirect",