@azure/msal-browser
Version:
Microsoft Authentication Library for js
884 lines (813 loc) • 31.3 kB
text/typescript
/*
* Copyright (c) Microsoft Corporation. All rights reserved.
* Licensed under the MIT License.
*/
import {
AuthorizationCodeClient,
CommonEndSessionRequest,
UrlString,
AuthError,
OIDC_DEFAULT_SCOPES,
PerformanceEvents,
IPerformanceClient,
Logger,
ICrypto,
ProtocolMode,
ServerResponseType,
invokeAsync,
invoke,
PkceCodes,
CommonAuthorizationUrlRequest,
} from "@azure/msal-common/browser";
import { StandardInteractionClient } from "./StandardInteractionClient.js";
import { EventType } from "../event/EventType.js";
import {
InteractionType,
ApiId,
BrowserConstants,
} from "../utils/BrowserConstants.js";
import { EndSessionPopupRequest } from "../request/EndSessionPopupRequest.js";
import { NavigationOptions } from "../navigation/NavigationOptions.js";
import * as BrowserUtils from "../utils/BrowserUtils.js";
import { PopupRequest } from "../request/PopupRequest.js";
import { NativeMessageHandler } from "../broker/nativeBroker/NativeMessageHandler.js";
import {
createBrowserAuthError,
BrowserAuthErrorCodes,
} from "../error/BrowserAuthError.js";
import { INavigationClient } from "../navigation/INavigationClient.js";
import { EventHandler } from "../event/EventHandler.js";
import { BrowserCacheManager } from "../cache/BrowserCacheManager.js";
import { BrowserConfiguration } from "../config/Configuration.js";
import { PopupWindowAttributes } from "../request/PopupWindowAttributes.js";
import { EventError } from "../event/EventMessage.js";
import { AuthenticationResult } from "../response/AuthenticationResult.js";
import * as ResponseHandler from "../response/ResponseHandler.js";
import * as Authorize from "../protocol/Authorize.js";
import { generatePkceCodes } from "../crypto/PkceGenerator.js";
import { generateEarKey } from "../crypto/BrowserCrypto.js";
export type PopupParams = {
popup?: Window | null;
popupName: string;
popupWindowAttributes: PopupWindowAttributes;
popupWindowParent: Window;
};
export class PopupClient extends StandardInteractionClient {
private currentWindow: Window | undefined;
protected nativeStorage: BrowserCacheManager;
constructor(
config: BrowserConfiguration,
storageImpl: BrowserCacheManager,
browserCrypto: ICrypto,
logger: Logger,
eventHandler: EventHandler,
navigationClient: INavigationClient,
performanceClient: IPerformanceClient,
nativeStorageImpl: BrowserCacheManager,
nativeMessageHandler?: NativeMessageHandler,
correlationId?: string
) {
super(
config,
storageImpl,
browserCrypto,
logger,
eventHandler,
navigationClient,
performanceClient,
nativeMessageHandler,
correlationId
);
// Properly sets this reference for the unload event.
this.unloadWindow = this.unloadWindow.bind(this);
this.nativeStorage = nativeStorageImpl;
this.eventHandler = eventHandler;
}
/**
* Acquires tokens by opening a popup window to the /authorize endpoint of the authority
* @param request
* @param pkceCodes
*/
acquireToken(
request: PopupRequest,
pkceCodes?: PkceCodes
): Promise<AuthenticationResult> {
try {
const popupName = this.generatePopupName(
request.scopes || OIDC_DEFAULT_SCOPES,
request.authority || this.config.auth.authority
);
const popupParams: PopupParams = {
popupName,
popupWindowAttributes: request.popupWindowAttributes || {},
popupWindowParent: request.popupWindowParent ?? window,
};
this.performanceClient.addFields(
{ isAsyncPopup: this.config.system.asyncPopups },
this.correlationId
);
// asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
if (this.config.system.asyncPopups) {
this.logger.verbose("asyncPopups set to true, acquiring token");
// Passes on popup position and dimensions if in request
return this.acquireTokenPopupAsync(
request,
popupParams,
pkceCodes
);
} else {
// asyncPopups flag is set to false. Opens popup before acquiring token.
this.logger.verbose(
"asyncPopup set to false, opening popup before acquiring token"
);
popupParams.popup = this.openSizedPopup(
"about:blank",
popupParams
);
return this.acquireTokenPopupAsync(
request,
popupParams,
pkceCodes
);
}
} catch (e) {
return Promise.reject(e);
}
}
/**
* Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
* @param logoutRequest
*/
logout(logoutRequest?: EndSessionPopupRequest): Promise<void> {
try {
this.logger.verbose("logoutPopup called");
const validLogoutRequest =
this.initializeLogoutRequest(logoutRequest);
const popupParams: PopupParams = {
popupName: this.generateLogoutPopupName(validLogoutRequest),
popupWindowAttributes:
logoutRequest?.popupWindowAttributes || {},
popupWindowParent: logoutRequest?.popupWindowParent ?? window,
};
const authority = logoutRequest && logoutRequest.authority;
const mainWindowRedirectUri =
logoutRequest && logoutRequest.mainWindowRedirectUri;
// asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
if (this.config.system.asyncPopups) {
this.logger.verbose("asyncPopups set to true");
// Passes on popup position and dimensions if in request
return this.logoutPopupAsync(
validLogoutRequest,
popupParams,
authority,
mainWindowRedirectUri
);
} else {
// asyncPopups flag is set to false. Opens popup before logging out.
this.logger.verbose("asyncPopup set to false, opening popup");
popupParams.popup = this.openSizedPopup(
"about:blank",
popupParams
);
return this.logoutPopupAsync(
validLogoutRequest,
popupParams,
authority,
mainWindowRedirectUri
);
}
} catch (e) {
// Since this function is synchronous we need to reject
return Promise.reject(e);
}
}
/**
* Helper which obtains an access_token for your API via opening a popup window in the user's browser
* @param request
* @param popupParams
* @param pkceCodes
*
* @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
*/
protected async acquireTokenPopupAsync(
request: PopupRequest,
popupParams: PopupParams,
pkceCodes?: PkceCodes
): Promise<AuthenticationResult> {
this.logger.verbose("acquireTokenPopupAsync called");
const validRequest = await invokeAsync(
this.initializeAuthorizationRequest.bind(this),
PerformanceEvents.StandardInteractionClientInitializeAuthorizationRequest,
this.logger,
this.performanceClient,
this.correlationId
)(request, InteractionType.Popup);
/*
* Skip pre-connect for async popups to reduce time between user interaction and popup window creation to avoid
* popup from being blocked by browsers with shorter popup timers
*/
if (popupParams.popup) {
BrowserUtils.preconnect(validRequest.authority);
}
const isPlatformBroker = NativeMessageHandler.isPlatformBrokerAvailable(
this.config,
this.logger,
this.nativeMessageHandler,
request.authenticationScheme
);
validRequest.platformBroker = isPlatformBroker;
if (this.config.auth.protocolMode === ProtocolMode.EAR) {
return this.executeEarFlow(validRequest, popupParams);
} else {
return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
}
}
/**
* Executes auth code + PKCE flow
* @param request
* @param popupParams
* @param pkceCodes
* @returns
*/
async executeCodeFlow(
request: CommonAuthorizationUrlRequest,
popupParams: PopupParams,
pkceCodes?: PkceCodes
): Promise<AuthenticationResult> {
const correlationId = request.correlationId;
const serverTelemetryManager = this.initializeServerTelemetryManager(
ApiId.acquireTokenPopup
);
const pkce =
pkceCodes ||
(await invokeAsync(
generatePkceCodes,
PerformanceEvents.GeneratePkceCodes,
this.logger,
this.performanceClient,
correlationId
)(this.performanceClient, this.logger, correlationId));
const popupRequest = {
...request,
codeChallenge: pkce.challenge,
};
try {
// Initialize the client
const authClient: AuthorizationCodeClient = await invokeAsync(
this.createAuthCodeClient.bind(this),
PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
this.logger,
this.performanceClient,
correlationId
)({
serverTelemetryManager,
requestAuthority: popupRequest.authority,
requestAzureCloudOptions: popupRequest.azureCloudOptions,
requestExtraQueryParameters: popupRequest.extraQueryParameters,
account: popupRequest.account,
});
// Create acquire token url.
const navigateUrl = await invokeAsync(
Authorize.getAuthCodeRequestUrl,
PerformanceEvents.GetAuthCodeUrl,
this.logger,
this.performanceClient,
correlationId
)(
this.config,
authClient.authority,
popupRequest,
this.logger,
this.performanceClient
);
// Show the UI once the url has been created. Get the window handle for the popup.
const popupWindow: Window = this.initiateAuthRequest(
navigateUrl,
popupParams
);
this.eventHandler.emitEvent(
EventType.POPUP_OPENED,
InteractionType.Popup,
{ popupWindow },
null
);
// Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
const responseString = await this.monitorPopupForHash(
popupWindow,
popupParams.popupWindowParent
);
const serverParams = invoke(
ResponseHandler.deserializeResponse,
PerformanceEvents.DeserializeResponse,
this.logger,
this.performanceClient,
this.correlationId
)(
responseString,
this.config.auth.OIDCOptions.serverResponseType,
this.logger
);
return await invokeAsync(
Authorize.handleResponseCode,
PerformanceEvents.HandleResponseCode,
this.logger,
this.performanceClient,
correlationId
)(
request,
serverParams,
pkce.verifier,
ApiId.acquireTokenPopup,
this.config,
authClient,
this.browserStorage,
this.nativeStorage,
this.eventHandler,
this.logger,
this.performanceClient,
this.nativeMessageHandler
);
} catch (e) {
// Close the synchronous popup if an error is thrown before the window unload event is registered
popupParams.popup?.close();
if (e instanceof AuthError) {
(e as AuthError).setCorrelationId(this.correlationId);
serverTelemetryManager.cacheFailedRequest(e);
}
throw e;
}
}
/**
* Executes EAR flow
* @param request
*/
async executeEarFlow(
request: CommonAuthorizationUrlRequest,
popupParams: PopupParams
): Promise<AuthenticationResult> {
const correlationId = request.correlationId;
// Get the frame handle for the silent request
const discoveredAuthority = await invokeAsync(
this.getDiscoveredAuthority.bind(this),
PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority,
this.logger,
this.performanceClient,
correlationId
)({
requestAuthority: request.authority,
requestAzureCloudOptions: request.azureCloudOptions,
requestExtraQueryParameters: request.extraQueryParameters,
account: request.account,
});
const earJwk = await invokeAsync(
generateEarKey,
PerformanceEvents.GenerateEarKey,
this.logger,
this.performanceClient,
correlationId
)();
const popupRequest = {
...request,
earJwk: earJwk,
};
const popupWindow =
popupParams.popup || this.openPopup("about:blank", popupParams);
const form = await Authorize.getEARForm(
popupWindow.document,
this.config,
discoveredAuthority,
popupRequest,
this.logger,
this.performanceClient
);
form.submit();
// Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
const responseString = await invokeAsync(
this.monitorPopupForHash.bind(this),
PerformanceEvents.SilentHandlerMonitorIframeForHash,
this.logger,
this.performanceClient,
correlationId
)(popupWindow, popupParams.popupWindowParent);
const serverParams = invoke(
ResponseHandler.deserializeResponse,
PerformanceEvents.DeserializeResponse,
this.logger,
this.performanceClient,
this.correlationId
)(
responseString,
this.config.auth.OIDCOptions.serverResponseType,
this.logger
);
return invokeAsync(
Authorize.handleResponseEAR,
PerformanceEvents.HandleResponseEar,
this.logger,
this.performanceClient,
correlationId
)(
popupRequest,
serverParams,
ApiId.acquireTokenPopup,
this.config,
discoveredAuthority,
this.browserStorage,
this.nativeStorage,
this.eventHandler,
this.logger,
this.performanceClient,
this.nativeMessageHandler
);
}
/**
*
* @param validRequest
* @param popupName
* @param requestAuthority
* @param popup
* @param mainWindowRedirectUri
* @param popupWindowAttributes
*/
protected async logoutPopupAsync(
validRequest: CommonEndSessionRequest,
popupParams: PopupParams,
requestAuthority?: string,
mainWindowRedirectUri?: string
): Promise<void> {
this.logger.verbose("logoutPopupAsync called");
this.eventHandler.emitEvent(
EventType.LOGOUT_START,
InteractionType.Popup,
validRequest
);
const serverTelemetryManager = this.initializeServerTelemetryManager(
ApiId.logoutPopup
);
try {
// Clear cache on logout
await this.clearCacheOnLogout(validRequest.account);
// Initialize the client
const authClient = await invokeAsync(
this.createAuthCodeClient.bind(this),
PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
this.logger,
this.performanceClient,
this.correlationId
)({
serverTelemetryManager,
requestAuthority: requestAuthority,
account: validRequest.account || undefined,
});
try {
authClient.authority.endSessionEndpoint;
} catch {
if (
validRequest.account?.homeAccountId &&
validRequest.postLogoutRedirectUri &&
authClient.authority.protocolMode === ProtocolMode.OIDC
) {
void this.browserStorage.removeAccount(
validRequest.account?.homeAccountId
);
this.eventHandler.emitEvent(
EventType.LOGOUT_SUCCESS,
InteractionType.Popup,
validRequest
);
if (mainWindowRedirectUri) {
const navigationOptions: NavigationOptions = {
apiId: ApiId.logoutPopup,
timeout:
this.config.system.redirectNavigationTimeout,
noHistory: false,
};
const absoluteUrl = UrlString.getAbsoluteUrl(
mainWindowRedirectUri,
BrowserUtils.getCurrentUri()
);
await this.navigationClient.navigateInternal(
absoluteUrl,
navigationOptions
);
}
popupParams.popup?.close();
return;
}
}
// Create logout string and navigate user window to logout.
const logoutUri: string = authClient.getLogoutUri(validRequest);
this.eventHandler.emitEvent(
EventType.LOGOUT_SUCCESS,
InteractionType.Popup,
validRequest
);
// Open the popup window to requestUrl.
const popupWindow = this.openPopup(logoutUri, popupParams);
this.eventHandler.emitEvent(
EventType.POPUP_OPENED,
InteractionType.Popup,
{ popupWindow },
null
);
await this.monitorPopupForHash(
popupWindow,
popupParams.popupWindowParent
).catch(() => {
// Swallow any errors related to monitoring the window. Server logout is best effort
});
if (mainWindowRedirectUri) {
const navigationOptions: NavigationOptions = {
apiId: ApiId.logoutPopup,
timeout: this.config.system.redirectNavigationTimeout,
noHistory: false,
};
const absoluteUrl = UrlString.getAbsoluteUrl(
mainWindowRedirectUri,
BrowserUtils.getCurrentUri()
);
this.logger.verbose(
"Redirecting main window to url specified in the request"
);
this.logger.verbosePii(
`Redirecting main window to: ${absoluteUrl}`
);
await this.navigationClient.navigateInternal(
absoluteUrl,
navigationOptions
);
} else {
this.logger.verbose("No main window navigation requested");
}
} catch (e) {
// Close the synchronous popup if an error is thrown before the window unload event is registered
popupParams.popup?.close();
if (e instanceof AuthError) {
(e as AuthError).setCorrelationId(this.correlationId);
serverTelemetryManager.cacheFailedRequest(e);
}
this.eventHandler.emitEvent(
EventType.LOGOUT_FAILURE,
InteractionType.Popup,
null,
e as EventError
);
this.eventHandler.emitEvent(
EventType.LOGOUT_END,
InteractionType.Popup
);
throw e;
}
this.eventHandler.emitEvent(
EventType.LOGOUT_END,
InteractionType.Popup
);
}
/**
* Opens a popup window with given request Url.
* @param requestUrl
*/
initiateAuthRequest(requestUrl: string, params: PopupParams): Window {
// Check that request url is not empty.
if (requestUrl) {
this.logger.infoPii(`Navigate to: ${requestUrl}`);
// Open the popup window to requestUrl.
return this.openPopup(requestUrl, params);
} else {
// Throw error if request URL is empty.
this.logger.error("Navigate url is empty");
throw createBrowserAuthError(
BrowserAuthErrorCodes.emptyNavigateUri
);
}
}
/**
* Monitors a window until it loads a url with the same origin.
* @param popupWindow - window that is being monitored
* @param timeout - timeout for processing hash once popup is redirected back to application
*/
monitorPopupForHash(
popupWindow: Window,
popupWindowParent: Window
): Promise<string> {
return new Promise<string>((resolve, reject) => {
this.logger.verbose(
"PopupHandler.monitorPopupForHash - polling started"
);
const intervalId = setInterval(() => {
// Window is closed
if (popupWindow.closed) {
this.logger.error(
"PopupHandler.monitorPopupForHash - window closed"
);
clearInterval(intervalId);
reject(
createBrowserAuthError(
BrowserAuthErrorCodes.userCancelled
)
);
return;
}
let href = "";
try {
/*
* Will throw if cross origin,
* which should be caught and ignored
* since we need the interval to keep running while on STS UI.
*/
href = popupWindow.location.href;
} catch (e) {}
// Don't process blank pages or cross domain
if (!href || href === "about:blank") {
return;
}
clearInterval(intervalId);
let responseString = "";
const responseType =
this.config.auth.OIDCOptions.serverResponseType;
if (popupWindow) {
if (responseType === ServerResponseType.QUERY) {
responseString = popupWindow.location.search;
} else {
responseString = popupWindow.location.hash;
}
}
this.logger.verbose(
"PopupHandler.monitorPopupForHash - popup window is on same origin as caller"
);
resolve(responseString);
}, this.config.system.pollIntervalMilliseconds);
}).finally(() => {
this.cleanPopup(popupWindow, popupWindowParent);
});
}
/**
* @hidden
*
* Configures popup window for login.
*
* @param urlNavigate
* @param title
* @param popUpWidth
* @param popUpHeight
* @param popupWindowAttributes
* @ignore
* @hidden
*/
openPopup(urlNavigate: string, popupParams: PopupParams): Window {
try {
let popupWindow;
// Popup window passed in, setting url to navigate to
if (popupParams.popup) {
popupWindow = popupParams.popup;
this.logger.verbosePii(
`Navigating popup window to: ${urlNavigate}`
);
popupWindow.location.assign(urlNavigate);
} else if (typeof popupParams.popup === "undefined") {
// Popup will be undefined if it was not passed in
this.logger.verbosePii(
`Opening popup window to: ${urlNavigate}`
);
popupWindow = this.openSizedPopup(urlNavigate, popupParams);
}
// Popup will be null if popups are blocked
if (!popupWindow) {
throw createBrowserAuthError(
BrowserAuthErrorCodes.emptyWindowError
);
}
if (popupWindow.focus) {
popupWindow.focus();
}
this.currentWindow = popupWindow;
popupParams.popupWindowParent.addEventListener(
"beforeunload",
this.unloadWindow
);
return popupWindow;
} catch (e) {
this.logger.error(
"error opening popup " + (e as AuthError).message
);
throw createBrowserAuthError(
BrowserAuthErrorCodes.popupWindowError
);
}
}
/**
* Helper function to set popup window dimensions and position
* @param urlNavigate
* @param popupName
* @param popupWindowAttributes
* @returns
*/
openSizedPopup(
urlNavigate: string,
{ popupName, popupWindowAttributes, popupWindowParent }: PopupParams
): Window | null {
/**
* adding winLeft and winTop to account for dual monitor
* using screenLeft and screenTop for IE8 and earlier
*/
const winLeft = popupWindowParent.screenLeft
? popupWindowParent.screenLeft
: popupWindowParent.screenX;
const winTop = popupWindowParent.screenTop
? popupWindowParent.screenTop
: popupWindowParent.screenY;
/**
* window.innerWidth displays browser window"s height and width excluding toolbars
* using document.documentElement.clientWidth for IE8 and earlier
*/
const winWidth =
popupWindowParent.innerWidth ||
document.documentElement.clientWidth ||
document.body.clientWidth;
const winHeight =
popupWindowParent.innerHeight ||
document.documentElement.clientHeight ||
document.body.clientHeight;
let width = popupWindowAttributes.popupSize?.width;
let height = popupWindowAttributes.popupSize?.height;
let top = popupWindowAttributes.popupPosition?.top;
let left = popupWindowAttributes.popupPosition?.left;
if (!width || width < 0 || width > winWidth) {
this.logger.verbose(
"Default popup window width used. Window width not configured or invalid."
);
width = BrowserConstants.POPUP_WIDTH;
}
if (!height || height < 0 || height > winHeight) {
this.logger.verbose(
"Default popup window height used. Window height not configured or invalid."
);
height = BrowserConstants.POPUP_HEIGHT;
}
if (!top || top < 0 || top > winHeight) {
this.logger.verbose(
"Default popup window top position used. Window top not configured or invalid."
);
top = Math.max(
0,
winHeight / 2 - BrowserConstants.POPUP_HEIGHT / 2 + winTop
);
}
if (!left || left < 0 || left > winWidth) {
this.logger.verbose(
"Default popup window left position used. Window left not configured or invalid."
);
left = Math.max(
0,
winWidth / 2 - BrowserConstants.POPUP_WIDTH / 2 + winLeft
);
}
return popupWindowParent.open(
urlNavigate,
popupName,
`width=${width}, height=${height}, top=${top}, left=${left}, scrollbars=yes`
);
}
/**
* Event callback to unload main window.
*/
unloadWindow(e: Event): void {
if (this.currentWindow) {
this.currentWindow.close();
}
// Guarantees browser unload will happen, so no other errors will be thrown.
e.preventDefault();
}
/**
* Closes popup, removes any state vars created during popup calls.
* @param popupWindow
*/
cleanPopup(popupWindow: Window, popupWindowParent: Window): void {
// Close window.
popupWindow.close();
// Remove window unload function
popupWindowParent.removeEventListener(
"beforeunload",
this.unloadWindow
);
}
/**
* Generates the name for the popup based on the client id and request
* @param clientId
* @param request
*/
generatePopupName(scopes: Array<string>, authority: string): string {
return `${BrowserConstants.POPUP_NAME_PREFIX}.${
this.config.auth.clientId
}.${scopes.join("-")}.${authority}.${this.correlationId}`;
}
/**
* Generates the name for the popup based on the client id and request for logouts
* @param clientId
* @param request
*/
generateLogoutPopupName(request: CommonEndSessionRequest): string {
const homeAccountId = request.account && request.account.homeAccountId;
return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
}
}