@azure/msal-common 15.11.0 → 15.12.0

package/lib/types/utils/UrlUtils.d.ts

@@ -13,4 +13,12 @@ export declare function getDeserializedResponse(responseString: string): Authori
  * Utility to create a URL from the params map
  */
 export declare function mapToQueryString(parameters: Map<string, string>, encodeExtraParams?: boolean, extraQueryParameters?: StringDict): string;
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+export declare function normalizeUrlForComparison(url: string): string;
 //# sourceMappingURL=UrlUtils.d.ts.map

package/lib/types/utils/UrlUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UrlUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/UrlUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAKrE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAWtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACnC,cAAc,EAAE,MAAM,GACvB,iBAAiB,GAAG,IAAI,CA4B1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,iBAAiB,GAAE,OAAc,EACjC,oBAAoB,CAAC,EAAE,UAAU,GAClC,MAAM,CAgBR"}
+{"version":3,"file":"UrlUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/UrlUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAKrE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA6B5C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAWtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACnC,cAAc,EAAE,MAAM,GACvB,iBAAiB,GAAG,IAAI,CA4B1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,iBAAiB,GAAE,OAAc,EACjC,oBAAoB,CAAC,EAAE,UAAU,GAClC,MAAM,CAgBR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwB7D"}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "15.11.0",
+  "version": "15.12.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "15.11.0";
+export const version = "15.12.0";

package/src/request/ScopeSet.ts

@@ -12,7 +12,11 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
-import { Constants, OIDC_SCOPES } from "../utils/Constants.js";
+import {
+    Constants,
+    OIDC_SCOPES,
+    OIDC_DEFAULT_SCOPES,
+} from "../utils/Constants.js";
 
 /**
  * The ScopeSet class creates a set of scopes. Scopes are case-insensitive, unique values, so the Set object in JS makes
@@ -61,7 +65,13 @@ export class ScopeSet {
      * @returns
      */
     static createSearchScopes(inputScopeString: Array<string>): ScopeSet {
-        const scopeSet = new ScopeSet(inputScopeString);
+        // Handle empty scopes by using default OIDC scopes for cache lookup
+        const scopesToUse =
+            inputScopeString && inputScopeString.length > 0
+                ? inputScopeString
+                : [...OIDC_DEFAULT_SCOPES];
+
+        const scopeSet = new ScopeSet(scopesToUse);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         } else {

package/src/telemetry/performance/PerformanceEvent.ts

@@ -715,6 +715,14 @@ export type PerformanceEvent = {
      */
     isNativeBroker?: boolean;
 
+    /**
+     * Platform-specific fields, when calling STS and/or broker for token requests
+     */
+    isPlatformAuthorizeRequest?: boolean;
+    isPlatformBrokerRequest?: boolean;
+    brokerErrorName?: string;
+    brokerErrorCode?: string;
+
     /**
      * Request ID returned from the response
      *

package/src/utils/UrlUtils.ts

@@ -9,6 +9,33 @@ import {
     createClientAuthError,
 } from "../error/ClientAuthError.js";
 import { StringDict } from "./MsalTypes.js";
+import { StringUtils } from "./StringUtils.js";
+
+/**
+ * Canonicalizes a URL by making it lowercase and ensuring it ends with /
+ * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
+ * @param url - URL to canonicalize
+ * @returns Canonicalized URL
+ */
+function canonicalizeUrl(url: string): string {
+    if (!url) {
+        return url;
+    }
+
+    let lowerCaseUrl = url.toLowerCase();
+
+    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+    } else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+    }
+
+    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+        lowerCaseUrl += "/";
+    }
+
+    return lowerCaseUrl;
+}
 
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
@@ -86,3 +113,36 @@ export function mapToQueryString(
 
     return queryParameterArray.join("&");
 }
+
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+export function normalizeUrlForComparison(url: string): string {
+    if (!url) {
+        return url;
+    }
+
+    // Remove hash first
+    const urlWithoutHash = url.split("#")[0];
+
+    try {
+        // Parse the URL to handle encoding consistently
+        const urlObj = new URL(urlWithoutHash);
+
+        /*
+         * Reconstruct the URL with properly decoded query parameters
+         * This ensures that %27 and ' are treated as equivalent
+         */
+        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
+
+        // Apply canonicalization logic inline to avoid circular dependency
+        return canonicalizeUrl(normalizedUrl);
+    } catch (e) {
+        // Fallback to original logic if URL parsing fails
+        return canonicalizeUrl(urlWithoutHash);
+    }
+}