@azure/msal-common - npm Package Compare versions

Comparing version 14.11.0 to 14.12.0

dist/cache/CacheManager.d.ts

@@ -447,3 +447,3 @@ import { AccountFilter, CredentialFilter, ValidCredentialType, AppMetadataFilter, AppMetadataCache, TokenKeys } from "./utils/CacheTypes";
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
@@ -450,0 +450,0 @@ private matchKeyId;

dist/crypto/ICrypto.d.ts

@@ -34,2 +34,12 @@ import { BaseAuthRequest } from "../request/BaseAuthRequest";
     /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
+    /**
      * Generates an JWK RSA S256 Thumbprint
@@ -36,0 +46,0 @@ * @param request

dist/crypto/PopTokenGenerator.d.ts

@@ -18,3 +18,2 @@ import { ICrypto, SignedHttpRequestParameters } from "./ICrypto";
     reqCnfString: string;
-    reqCnfHash: string;
 };
@@ -21,0 +20,0 @@ declare const KeyLocation: {

dist/packageMetadata.d.ts

 export declare const name = "@azure/msal-common";
-export declare const version = "14.11.0";
+export declare const version = "14.12.0";
 //# sourceMappingURL=packageMetadata.d.ts.map

dist/request/BaseAuthRequest.d.ts

@@ -25,2 +25,3 @@ import { AuthenticationScheme } from "../utils/Constants";
  * - scenarioId              - Scenario id to track custom user prompts
+ * - popKid                  - Key ID to identify the public key for PoP token request
  */
@@ -46,3 +47,4 @@ export type BaseAuthRequest = {
     scenarioId?: string;
+    popKid?: string;
 };
 //# sourceMappingURL=BaseAuthRequest.d.ts.map

package.json

@@ -13,3 +13,3 @@ {
   },
-  "version": "14.11.0",
+  "version": "14.12.0",
   "description": "Microsoft Authentication Library for js",
@@ -16,0 +16,0 @@ "keywords": [

src/client/AuthorizationCodeClient.ts

@@ -393,11 +393,18 @@ /*
 
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
@@ -686,11 +693,18 @@ if (request.sshJwk) {
                 );
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(
-                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                    PerformanceEvents.PopTokenGenerateCnf,
-                    this.logger,
-                    this.performanceClient,
-                    request.correlationId
-                )(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(
+                        popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                        PerformanceEvents.PopTokenGenerateCnf,
+                        this.logger,
+                        this.performanceClient,
+                        request.correlationId
+                    )(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                } else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
@@ -697,0 +711,0 @@ }

src/client/RefreshTokenClient.ts

@@ -410,11 +410,20 @@ /*
             );
-            const reqCnfData = await invokeAsync(
-                popTokenGenerator.generateCnf.bind(popTokenGenerator),
-                PerformanceEvents.PopTokenGenerateCnf,
-                this.logger,
-                this.performanceClient,
-                request.correlationId
-            )(request, this.logger);
+
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(
+                    popTokenGenerator.generateCnf.bind(popTokenGenerator),
+                    PerformanceEvents.PopTokenGenerateCnf,
+                    this.logger,
+                    this.performanceClient,
+                    request.correlationId
+                )(request, this.logger);
+
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            } else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
+
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         } else if (request.authenticationScheme === AuthenticationScheme.SSH) {
@@ -421,0 +430,0 @@ if (request.sshJwk) {

src/crypto/ICrypto.ts

@@ -53,2 +53,12 @@ /*
     /**
+     * base64 URL safe encoded string
+     */
+    base64UrlEncode(input: string): string;
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid: string): string;
+    /**
      * Generates an JWK RSA S256 Thumbprint
@@ -96,2 +106,8 @@ * @param request
     },
+    base64UrlEncode: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
+    encodeKid: (): string => {
+        throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);
+    },
     async getPublicKeyThumbprint(): Promise<string> {
@@ -98,0 +114,0 @@ throw createClientAuthError(ClientAuthErrorCodes.methodNotImplemented);

src/crypto/PopTokenGenerator.ts

@@ -29,3 +29,2 @@ /*
     reqCnfString: string;
-    reqCnfHash: string;
 };
@@ -71,3 +70,3 @@
         )(request);
-        const reqCnfString: string = this.cryptoUtils.base64Encode(
+        const reqCnfString: string = this.cryptoUtils.base64UrlEncode(
             JSON.stringify(reqCnf)
@@ -79,3 +78,2 @@ );
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
@@ -82,0 +80,0 @@ }

src/packageMetadata.ts

 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "14.11.0";
+export const version = "14.12.0";

src/request/BaseAuthRequest.ts

@@ -31,2 +31,3 @@ /*
  * - scenarioId              - Scenario id to track custom user prompts
+ * - popKid                  - Key ID to identify the public key for PoP token request
  */
@@ -52,2 +53,3 @@ export type BaseAuthRequest = {
     scenarioId?: string;
+    popKid?: string;
 };

src/response/ResponseHandler.ts

@@ -594,4 +594,10 @@ /*
         if (cacheRecord.accessToken) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
             if (
-                cacheRecord.accessToken.tokenType === AuthenticationScheme.POP
+                cacheRecord.accessToken.tokenType ===
+                    AuthenticationScheme.POP &&
+                !request.popKid
             ) {
@@ -598,0 +604,0 @@ const popTokenGenerator: PopTokenGenerator =

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2114438

increased by0.27%

Lines of code

38488

increased by0.3%

Published versions last year

34

increased by3.03%

No dependency changes