EAR auth code fallback #8111
Open
EAR auth code fallback #8111
+288
−53
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
This pull request implements automatic fallback from Encrypted Authorize Response (EAR) to standard authorization code flow when the server does not support EAR, ensuring authentication succeeds even with MSA which lacks symmetric EAR support.
Key Changes
- Added PKCE code generation and propagation through the EAR flow across all interactive clients (PopupClient, RedirectClient, SilentIframeClient)
- Implemented fallback logic to detect when server returns
codeinstead ofear_jweand automatically switch to authorization code flow - Optimized authority discovery in StandardInteractionClient by allowing reuse of already-discovered authority instances
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| lib/msal-browser/src/protocol/Authorize.ts | Added PKCE code challenge as backup parameter in EAR requests to support fallback to auth code flow |
| lib/msal-browser/src/interaction_client/PopupClient.ts | Added PKCE code generation to EAR flow and implemented fallback logic to handle auth code response |
| lib/msal-browser/src/interaction_client/RedirectClient.ts | Added PKCE code generation and caching for EAR flow to support fallback on redirect |
| lib/msal-browser/src/interaction_client/SilentIframeClient.ts | Added PKCE code generation to EAR flow and implemented fallback logic for silent iframe flows |
| lib/msal-browser/src/interaction_client/StandardInteractionClient.ts | Added optional authority parameter to avoid redundant authority discovery when already available |
| lib/msal-browser/test/protocol/Authorize.spec.ts | Updated tests to verify code challenge and method are included in EAR authorization requests |
| lib/msal-browser/test/interaction_client/PopupClient.spec.ts | Added test case to verify EAR flow successfully falls back to auth code when server returns code |
| lib/msal-browser/test/interaction_client/RedirectClient.spec.ts | Added test case to verify EAR flow fallback behavior in redirect scenarios |
| lib/msal-browser/test/interaction_client/SilentIframeClient.spec.ts | Added test case to verify EAR flow fallback behavior in silent iframe flows |
| change/@azure-msal-browser-4584bec2-2724-4645-aac5-73cf620cedd7.json | Beachball change file documenting the patch-level change for EAR fallback support |
| @@ -0,0 +1,7 @@ | |||
| { | |||
| "type": "patch", | |||
| "comment": "EAR flow falls back to auth code when /authorize returns code #8111", | |||
There was a problem hiding this comment.
The change message should include a link to the PR according to the beachball guidelines. The expected format is: Brief description of change [#XXXX](PR_URL).
For example: EAR flow falls back to auth code when /authorize returns code [#8111](https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8111)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces enhancements to the authentication flow to support fallback from Encrypted Authorize Response (EAR) to standard authorization code flow, working around lack of support for symmetric EAR in MSA.
Authentication flow fallback and PKCE improvements:
PopupClientandSilentIframeClientto detect when the server does not support EAR and automatically fallback to the authorization code flow, passing the PKCE verifier as needed. This ensures authentication succeeds even if EAR is unsupported. [1] [2]PopupClient,RedirectClient,SilentIframeClient). The code challenge is included in requests and cached with the verifier for later use. [1] [2] [3] [4]Protocol and test updates:
Authorize.tsto always include the PKCE code challenge in EAR requests as a backup, improving compatibility with servers that may not support EAR.