Socket
Socket
Sign inDemoInstall

@azure/msal-common

Package Overview
Dependencies
Maintainers
3
Versions
121
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@azure/msal-common - npm Package Compare versions

Comparing version 1.0.0-alpha.0 to 1.0.0-beta.0

6

changelog.md

@@ -0,2 +1,8 @@

# 1.0.0-beta.0
- Fully functioning project completed
- Build and test pipelines in place
- Added bug fixes from unit testing
- Added docs and samples
# 0.0.1
- Created library with initial files for repo structure, build and package dependencies

3

dist/src/app/config/ModuleConfiguration.d.ts
import { ICacheStorage } from "../../cache/ICacheStorage";
import { INetworkModule } from "../../network/INetworkModule";
import { ICrypto } from "../../crypto/ICrypto";
import { ILoggerCallback } from "../../logger/Logger";
import { ILoggerCallback, LogLevel } from "../../logger/Logger";
/**

@@ -47,2 +47,3 @@ * Use the configuration object to configure MSAL Modules and initialize the base interfaces for MSAL.

piiLoggingEnabled?: boolean;
logLevel?: LogLevel;
};

@@ -49,0 +50,0 @@ /**

@@ -7,3 +7,2 @@ import { ModuleConfiguration } from "./ModuleConfiguration";

* - authority - You can configure a specific authority, defaults to " " or "https://login.microsoftonline.com/common"
* - validateAuthority - Used to turn authority validation on/off. When set to true (default), MSAL will compare the application's authority against well-known URLs templates representing well-formed authorities. It is useful when the authority is obtained at run time to prevent MSAL from displaying authentication prompts from malicious pages.
* - redirectUri - The redirect URI of the application, this should be same as the value in the application registration portal.Defaults to `window.location.href`.

@@ -14,5 +13,3 @@ * - postLogoutRedirectUri - Used to redirect the user to this location after logout. Defaults to `window.location.href`.

clientId: string;
tmp_clientSecret: string;
authority?: string;
validateAuthority?: boolean;
redirectUri?: string | (() => string);

@@ -19,0 +16,0 @@ postLogoutRedirectUri?: string | (() => string);

@@ -62,2 +62,6 @@ import { AuthModule } from "./AuthModule";

/**
* Clears cache of items related to current request.
*/
cancelRequest(): void;
/**
* Gets the token exchange parameters from the cache. Throws an error if nothing is found.

@@ -64,0 +68,0 @@ */

@@ -9,4 +9,2 @@ import { Authority } from "./Authority";

get authorityType(): AuthorityType;
get isValidationEnabled(): boolean;
private static readonly aadInstanceDiscoveryEndpoint;
private get aadInstanceDiscoveryEndpointUrl();

@@ -18,3 +16,3 @@ constructor(authority: string, networkInterface: INetworkModule);

*/
getOpenIdConfigurationAsync(): Promise<string>;
getOpenIdConfigurationEndpointAsync(): Promise<string>;
/**

@@ -24,3 +22,3 @@ * Checks to see if the host is in a list of trusted hosts

*/
isInTrustedHostList(host: string): boolean;
private isInTrustedHostList;
}

@@ -14,3 +14,2 @@ import { AuthorityType } from "./AuthorityType";

abstract get authorityType(): AuthorityType;
abstract get isValidationEnabled(): boolean;
/**

@@ -70,3 +69,3 @@ * A URL that is the authority set by the developer

*/
abstract getOpenIdConfigurationAsync(): Promise<string>;
abstract getOpenIdConfigurationEndpointAsync(): Promise<string>;
/**

@@ -73,0 +72,0 @@ * Perform endpoint discovery to discover the /authorize, /token and logout endpoints.

import { Authority } from "./Authority";
import { INetworkModule } from "../../network/INetworkModule";
export declare class AuthorityFactory {
static DEFAULT_AUTHORITY: string;
/**

@@ -6,0 +5,0 @@ * Parse the url and determine the type of authority

@@ -5,14 +5,15 @@ /**

export declare type IdTokenClaims = {
iss: string;
oid: string;
sub: string;
tid: string;
ver: string;
preferred_username: string;
name: string;
nonce: string;
exp: string;
home_oid: string;
sid: string;
cloud_instance_host_name: string;
iss?: string;
oid?: string;
sub?: string;
tid?: string;
ver?: string;
upn?: string;
preferred_username?: string;
name?: string;
nonce?: string;
exp?: string;
home_oid?: string;
sid?: string;
cloud_instance_host_name?: string;
};

@@ -12,3 +12,3 @@ /**

/**
* Factory method to create ScopeSet from string
* Factory method to create ScopeSet from space-delimited string
* @param inputScopeString

@@ -15,0 +15,0 @@ * @param appClientId

@@ -63,2 +63,11 @@ import { AccessTokenCacheItem } from "./AccessTokenCacheItem";

removeAllAccessTokens(clientId: string, authority: string, resource?: string, homeAccountIdentifier?: string): void;
/**
* Checks that any parameters are exact matches for key value, since key.match in the above functions only do contains checks, not exact matches.
* @param atKey
* @param clientId
* @param authority
* @param resource
* @param homeAccountIdentifier
*/
private checkForExactKeyMatch;
}
import { AuthError } from "./AuthError";
import { IdToken } from "../auth/IdToken";
import { ScopeSet } from "../auth/ScopeSet";
/**

@@ -79,2 +80,18 @@ * ClientAuthErrorMessage class containing string constants used by error codes and messages.

};
appendEmptyScopeError: {
code: string;
desc: string;
};
removeEmptyScopeError: {
code: string;
desc: string;
};
appendScopeSetError: {
code: string;
desc: string;
};
emptyInputScopeSetError: {
code: string;
desc: string;
};
};

@@ -163,2 +180,22 @@ /**

static createTokenRequestCannotBeMadeError(): ClientAuthError;
/**
* Throws error when attempting to append a null, undefined or empty scope to a set
* @param givenScope
*/
static createAppendEmptyScopeToSetError(givenScope: string): ClientAuthError;
/**
* Throws error when attempting to append a null, undefined or empty scope to a set
* @param givenScope
*/
static createRemoveEmptyScopeFromSetError(givenScope: string): ClientAuthError;
/**
* Throws error when attempting to append null or empty ScopeSet.
* @param appendError
*/
static createAppendScopeSetError(appendError: string): ClientAuthError;
/**
* Throws error if ScopeSet is null or undefined.
* @param givenScopeSet
*/
static createEmptyInputScopeSetError(givenScopeSet: ScopeSet): ClientAuthError;
}

@@ -30,6 +30,2 @@ import { ClientAuthError } from "./ClientAuthError";

};
scopesRequiredError: {
code: string;
desc: string;
};
emptyScopesError: {

@@ -89,7 +85,2 @@ code: string;

/**
* Error thrown when input scopes are required.
* @param inputScopes
*/
static createScopesRequiredError(inputScopes: Array<string>): ClientConfigurationError;
/**
* Error thrown when scopes are not an array

@@ -96,0 +87,0 @@ * @param inputScopes

@@ -5,2 +5,3 @@ export { AuthorizationCodeModule } from "./app/module/AuthorizationCodeModule";

export { Account } from "./auth/Account";
export { IdTokenClaims } from "./auth/IdTokenClaims";
export { Authority } from "./auth/authority/Authority";

@@ -21,2 +22,3 @@ export { AuthorityFactory } from "./auth/authority/AuthorityFactory";

export { AuthError, AuthErrorMessage } from "./error/AuthError";
export { ServerError } from "./error/ServerError";
export { ClientAuthError, ClientAuthErrorMessage } from "./error/ClientAuthError";

@@ -23,0 +25,0 @@ export { ClientConfigurationError, ClientConfigurationErrorMessage } from "./error/ClientConfigurationError";

@@ -36,2 +36,14 @@ import { IdToken } from "../auth/IdToken";

/**
* Function which validates server authorization code response.
* @param serverResponseHash
* @param cachedState
* @param cryptoObj
*/
private validateServerAuthorizationCodeResponse;
/**
* Function which validates server authorization token response.
* @param serverResponse
*/
validateServerAuthorizationTokenResponse(serverResponse: ServerAuthorizationTokenResponse): void;
/**
* Helper function which saves or updates the token in the cache and constructs the final token response to send back to the user.

@@ -38,0 +50,0 @@ * @param originalTokenResponse

@@ -1,2 +0,1 @@

import { ICrypto } from "../crypto/ICrypto";
/**

@@ -17,8 +16,1 @@ * Deserialized response object from server authorization code request.

};
/**
* Function which validates server authorization code response.
* @param serverResponseHash
* @param cachedState
* @param cryptoObj
*/
export declare function validateServerAuthorizationCodeResponse(serverResponseHash: ServerAuthorizationCodeResponse, cachedState: string, cryptoObj: ICrypto): void;

@@ -34,6 +34,1 @@ /**

};
/**
* Function which validates server authorization token response.
* @param serverResponse
*/
export declare function validateServerAuthorizationTokenResponse(serverResponse: ServerAuthorizationTokenResponse): void;

@@ -1,5 +0,5 @@

import { ServerRequestParameters } from "./ServerRequestParameters";
import { Authority } from "../auth/authority/Authority";
import { Account } from "../auth/Account";
import { ICrypto, PkceCodes } from "../crypto/ICrypto";
import { ScopeSet } from "../auth/ScopeSet";
import { IdToken } from "../auth/IdToken";

@@ -10,3 +10,10 @@ import { AuthenticationParameters } from "../request/AuthenticationParameters";

*/
export declare class ServerCodeRequestParameters extends ServerRequestParameters {
export declare class ServerCodeRequestParameters {
private cryptoObj;
xClientVer: string;
xClientSku: string;
correlationId: string;
clientId: string;
scopes: ScopeSet;
redirectUri: string;
authorityInstance: Authority;

@@ -18,2 +25,3 @@ responseType: string;

generatedPkce: PkceCodes;
state: string;
nonce: string;

@@ -32,2 +40,13 @@ account: Account;

/**
* Adds SSO parameter to query parameters:
* - sid of the account object used to identify the session of the user on the service
* - login_hint to authorization URL which is used to pre-fill the username field of sign in page for the user if known ahead of time
* Also does a sanity check for extraQueryParameters passed by the user to ensure no repeat queryParameters
*
* @param {@link Account} account - Account for which the token is requested
* @param queryparams
* @param {@link ServerRequestParameters}
*/
private addSSOQueryParameters;
/**
* Utility to populate QueryParameters and ExtraQueryParameters to ServerRequestParamerers

@@ -44,3 +63,3 @@ * @param adalIdTokenObject

*/
protected createParamString(): Promise<Array<string>>;
private createParamString;
/**

@@ -52,28 +71,2 @@ * Utility to test if valid prompt value is passed in the request

/**
* Constructs extraQueryParameters to be sent to the server for the AuthenticationParameters set by the developer
* in any login() or acquireToken() calls
* @param idTokenObject
* @param extraQueryParameters
* @param sid
* @param loginHint
*/
private constructUnifiedCacheQueryParameter;
/**
* Adds login_hint to authorization URL which is used to pre-fill the username field of sign in page for the user if known ahead of time
* domain_hint can be one of users/organizations which when added skips the email based discovery process of the user
* domain_req utid received as part of the clientInfo
* login_req uid received as part of clientInfo
* Also does a sanity check for extraQueryParameters passed by the user to ensure no repeat queryParameters
*
* @param {@link Account} account - Account for which the token is requested
* @param queryparams
* @param {@link ServerRequestParameters}
*/
private addHintParameters;
/**
* Add SID to extraQueryParameters
* @param sid
*/
private addSSOParameter;
/**
* Removes unnecessary or duplicate query parameters from extraQueryParameters

@@ -80,0 +73,0 @@ * @param request

@@ -1,2 +0,2 @@

import { ServerRequestParameters } from "./ServerRequestParameters";
import { ScopeSet } from "../auth/ScopeSet";
import { TokenExchangeParameters } from "../request/TokenExchangeParameters";

@@ -8,8 +8,14 @@ import { CodeResponse } from "../response/CodeResponse";

*/
export declare class ServerTokenRequestParameters extends ServerRequestParameters {
clientSecret: string;
export declare class ServerTokenRequestParameters {
private cryptoObj;
xClientVer: string;
xClientSku: string;
correlationId: string;
clientId: string;
scopes: ScopeSet;
redirectUri: string;
tokenRequest: TokenExchangeParameters;
codeResponse: CodeResponse;
refreshToken: string;
constructor(clientId: string, clientSecret: string, tokenRequest: TokenExchangeParameters, codeResponse: CodeResponse, redirectUri: string, cryptoImpl: ICrypto, refreshToken?: string);
constructor(clientId: string, tokenRequest: TokenExchangeParameters, codeResponse: CodeResponse, redirectUri: string, cryptoImpl: ICrypto, refreshToken?: string);
/**

@@ -16,0 +22,0 @@ * Creates headers required for token request.

export declare const Constants: {
LIBRARY_NAME: string;
CACHE_PREFIX: string;
DEFAULT_AUTHORITY: string;
AAD_INSTANCE_DISCOVERY_ENDPT: string;
RESOURCE_DELIM: string;

@@ -37,3 +39,2 @@ NO_ACCOUNT: string;

REQUEST_PARAMS = "request.params",
REDIRECT_REQUEST = "redirect.request",
SCOPES = "scopes"

@@ -117,3 +118,3 @@ }

*/
export declare const PromptState: {
export declare const PromptValue: {
LOGIN: string;

@@ -120,0 +121,0 @@ SELECT_ACCOUNT: string;

@@ -30,2 +30,7 @@ import { DecodedJwt } from "../auth/DecodedJwt";

static trimAndConvertArrayEntriesToLowerCase(arr: Array<string>): Array<string>;
/**
* Removes empty strings from array
* @param arr
*/
static removeEmptyStringsFromArray(arr: Array<string>): Array<string>;
}

@@ -6,8 +6,2 @@ /**

/**
* Returns time in seconds for expiration based on string value passed in.
*
* @param expiresIn
*/
static parseExpiresInSeconds(expiresIn: number): number;
/**
* return the current time in Unix time (seconds).

@@ -14,0 +8,0 @@ */

@@ -13,3 +13,3 @@ {

},
"version": "1.0.0-alpha.0",
"version": "1.0.0-beta.0",
"description": "Microsoft Authentication Library for js",

@@ -48,3 +48,3 @@ "keywords": [

"test": "mocha",
"test:coverage": "nyc --reporter=text mocha",
"test:coverage": "nyc --reporter=text mocha --exit",
"test:coverage:only": "npm run clean:coverage && npm run test:coverage",

@@ -80,3 +80,3 @@ "build:modules": "rollup -c",

"nyc": "^14.1.1",
"rimraf": "^3.0.0",
"rimraf": "^3.0.2",
"rollup": "^1.24.0",

@@ -83,0 +83,0 @@ "rollup-plugin-typescript2": "^0.24.3",

@@ -1,36 +0,37 @@

Microsoft Authentication Library for JavaScript (MSAL.js) (DRAFT)
=========================================================
# (Preview) Microsoft Authentication Library for JavaScript (MSAL.js) Common Package
[![npm version](https://img.shields.io/npm/v/@azure/msal-common.svg?style=flat)](https://www.npmjs.com/package/@azure/msal-common/)[![npm version](https://img.shields.io/npm/dm/@azure/msal-common.svg)](https://nodei.co/npm/@azure/msal-common/)[![Coverage Status](https://coveralls.io/repos/github/AzureAD/microsoft-authentication-library-for-js/badge.svg?branch=dev)](https://coveralls.io/github/AzureAD/microsoft-authentication-library-for-js?branch=dev)
| [Getting Started](https://docs.microsoft.com/en-us/azure/active-directory/develop/guidedsetups/active-directory-javascriptspa)| [AAD Docs](https://aka.ms/aaddevv2) | [Library Reference](https://htmlpreview.github.io/?https://raw.githubusercontent.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-core/docs/classes/_useragentapplication_.useragentapplication.html) | [Support](README.md#community-help-and-support) | [Samples](https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki/Samples)
| <a href="https://docs.microsoft.com/azure/active-directory/develop/guidedsetups/active-directory-javascriptspa" target="_blank">Getting Started</a> | <a href="https://aka.ms/aaddevv2" target="_blank">AAD Docs</a> | <a href="https://azuread.github.io/microsoft-authentication-library-for-js/ref/msal-core/" target="_blank">Library Reference</a> |
| --- | --- | --- | --- | --- |
1. [About](#about)
2. [FAQ](./FAQ.md)
3. [Releases](#releases)
4. [Prerequisites](#prerequisites)
5. [Installation](#installation)
6. [Usage](#usage)
9. [Security Reporting](#security-reporting)
10. [License](#license)
11. [Code of Conduct](#we-value-and-adhere-to-the-microsoft-open-source-code-of-conduct)
The MSAL library for JavaScript enables client-side JavaScript applications to authenticate users using [Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview) work and school accounts (AAD), Microsoft personal accounts (MSA) and social identity providers like Facebook, Google, LinkedIn, Microsoft accounts, etc. through [Azure AD B2C](https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-overview#identity-providers) service. It also enables your app to get tokens to access [Microsoft Cloud](https://www.microsoft.com/enterprise) services such as [Microsoft Graph](https://graph.microsoft.io).
## About
[![Build Status](https://travis-ci.org/AzureAD/microsoft-authentication-library-for-js.png?branch=dev)](https://travis-ci.org/AzureAD/microsoft-authentication-library-for-js)[![npm version](https://img.shields.io/npm/v/@azure/msal-browser.svg?style=flat)](https://www.npmjs.com/package/msal-browser)[![npm version](https://img.shields.io/npm/dm/@azure/msal-browser.svg)](https://nodei.co/npm/msal/)
The MSAL library for JavaScript enables client-side JavaScript applications to authenticate users using [Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview) work and school accounts (AAD), Microsoft personal accounts (MSA) and social identity providers like Facebook, Google, LinkedIn, Microsoft accounts, etc. through [Azure AD B2C](https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-overview#identity-providers) service. It also enables your app to get tokens to access [Microsoft Cloud](https://www.microsoft.com/enterprise) services such as [Microsoft Graph](https://graph.microsoft.io).
## Installation
### Via NPM:
The `@azure/msal-common` package described by the code in this folder serves as a common package dependency for the `@azure/msal-browser` package (and in the future, the msal-node package). **It is not meant for production consumption by itself.**
npm install @azure/msal-common
## FAQ
## Roadmap and What To Expect From This Library
MSAL support on Javascript is a collection of libraries. `msal-common` is the platform agnostic core library, and `msal-browser` is our core library for Single Page Applications (SPAs) without a backend. This library includes improvements for new browser requirements in Safari, as well as an updated token acquisition flow utilizing the OAuth 2.0 Authorization Code Flow.
See [here](./FAQ.md).
Our goal is to communicate extremely well with the community and to take their opinions into account. We would like to get to a monthly minor release schedule, with patches comming as often as needed. The level of communication, planning, and granularity we want to get to will be a work in progress.
## Releases
Please check our [roadmap](https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki#roadmap) to see what we are working on and what we are tracking next.
*Expect us to detail our major and minor releases moving forward, while leaving out our patch releases. Patch release notes can be found in our change log.*
## OAuth 2.0 and the Implicit Flow vs Authorization Code Flow with PKCE
Msal used to only implement the [Implicit Grant Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow), as defined by the OAuth 2.0 protocol and [OpenID](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc).
| Date | Release | Announcement | Main features |
| ------| ------- | ---------| --------- |
| | @azure/msal-common v2.0.0-beta | Beta version of the `@azure/msal-common` package |
| January 17, 2020 | @azure/msal-common v1.0.0-alpha | No release notes yet | Alpha version of the `@azure/msal-common` package with authorization code flow for SPAs working in dev. |
Our goal is that the library abstracts enough of the protocol away so that you can get plug and play authentication, but it is important to know and understand the implicit flow from a security perspective.
The implicit flow runs in the context of a web browser which cannot manage client secrets securely. It is optimized for single page apps and has one less hop between client and server so tokens are returned directly to the browser. These aspects make it naturally less secure.
These security concerns are mitigated per standard practices such as- use of short lived tokens (and so no refresh tokens are returned), the library requiring a registered redirect URI for the app, library matching the request and response with a unique nonce and state parameter.
However, recent discussion among the IETF community has uncovered numerous vulnerabilities in the implicit flow. The MSAL library will now support the Authorization Code Flow with PKCE for Browser-Based Applications without a backend web server. You can read more about the [disadvantages of the implicit flow here](https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-9.8.6).
We plan to continue support for the implicit flow in the library.
## Usage
## Prerequisites and Usage
This library is not meant for production use. Please use one of these packages specific to the platform you are developing for:

@@ -40,10 +41,7 @@

#### Prerequisite
## Installation
### Via NPM:
Before using MSAL.js you will need to [register an application in Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app) to get a valid `clientId` for configuration, and to register the routes that your app will accept redirect traffic on.
npm install @azure/msal-common
> TBD
You can learn further details about MSAL.js functionality documented in the [MSAL Wiki](https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki) and find complete [code samples](https://github.com/AzureAD/microsoft-authentication-library-for-js/wiki/Samples).
## Security Reporting

@@ -50,0 +48,0 @@

Sorry, the diff of this file is too big to display

Sorry, the diff of this file is too big to display

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc