diff --git a/change/@azure-msal-browser-9e057f03-1c0c-4592-8d24-032b325205f1.json b/change/@azure-msal-browser-9e057f03-1c0c-4592-8d24-032b325205f1.json new file mode 100644 index 0000000000..ee89603b7f --- /dev/null +++ b/change/@azure-msal-browser-9e057f03-1c0c-4592-8d24-032b325205f1.json @@ -0,0 +1,7 @@ +{ + "type": "patch", + "comment": "Add correlationId to POST request query params [#8308](https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8308)", + "packageName": "@azure/msal-browser", + "email": "hemoral@microsoft.com", + "dependentChangeType": "patch" +} diff --git a/lib/msal-browser/src/protocol/Authorize.ts b/lib/msal-browser/src/protocol/Authorize.ts index 64922417b9..3014da1bf0 100644 --- a/lib/msal-browser/src/protocol/Authorize.ts +++ b/lib/msal-browser/src/protocol/Authorize.ts @@ -215,6 +215,13 @@ export async function getEARForm( queryParams, request.extraQueryParameters || {} ); + + // Add correlationId to query params so gateway can propagate it to IDPs + RequestParameterBuilder.addCorrelationId( + queryParams, + request.correlationId + ); + const url = AuthorizeProtocol.getAuthorizeUrl( authority, queryParams, @@ -258,11 +265,18 @@ export async function getCodeForm( ); const queryParams = new Map(); + RequestParameterBuilder.addExtraQueryParameters( queryParams, request.extraQueryParameters || {} ); + // Add correlationId to query params so gateway can propagate it to IDPs + RequestParameterBuilder.addCorrelationId( + queryParams, + request.correlationId + ); + const url = AuthorizeProtocol.getAuthorizeUrl( authority, queryParams, diff --git a/lib/msal-browser/test/protocol/Authorize.spec.ts b/lib/msal-browser/test/protocol/Authorize.spec.ts index f29be90dca..0e57dd266c 100644 --- a/lib/msal-browser/test/protocol/Authorize.spec.ts +++ b/lib/msal-browser/test/protocol/Authorize.spec.ts @@ -194,6 +194,14 @@ describe("Authorize Protocol Tests", () => { BrowserConstants.MSAL_SKU ); checkInputProperties(AADServerParamKeys.X_CLIENT_VER, version); + + // Verify correlationId is present in authorize URL query params + const actionUrl = new URL(form.action); + expect( + actionUrl.searchParams.get( + AADServerParamKeys.CLIENT_REQUEST_ID + ) + ).toEqual(validRequest.correlationId); }); }); @@ -382,4 +390,81 @@ describe("Authorize Protocol Tests", () => { }); }); }); + describe("getCodeForm tests", () => { + const config = buildConfiguration( + { auth: { clientId: TEST_CONFIG.MSAL_CLIENT_ID } }, + true + ); + const logger = new Logger({}); + const performanceClient = new StubPerformanceClient(); + const authorityOptions: AuthorityOptions = { + protocolMode: ProtocolMode.AAD, + knownAuthorities: [], + cloudDiscoveryMetadata: "", + authorityMetadata: "", + }; + const eventHandler = new EventHandler(); + const cacheManager = new BrowserCacheManager( + TEST_CONFIG.MSAL_CLIENT_ID, + config.cache, + new CryptoOps(logger, performanceClient), + logger, + performanceClient, + eventHandler + ); + let authority: Authority; + const validRequest: CommonAuthorizationUrlRequest = { + authority: TEST_CONFIG.validAuthority, + scopes: ["openid", "profile"], + correlationId: TEST_CONFIG.CORRELATION_ID, + redirectUri: window.location.href, + state: TEST_STATE_VALUES.TEST_STATE_REDIRECT, + nonce: ID_TOKEN_CLAIMS.nonce, + responseMode: ResponseMode.FRAGMENT, + codeChallenge: "code-challenge", + }; + + beforeAll(async () => { + jest.useFakeTimers(); + authority = await AuthorityFactory.createDiscoveredInstance( + TEST_CONFIG.validAuthority, + config.system.networkClient, + cacheManager, + authorityOptions, + logger, + TEST_CONFIG.CORRELATION_ID, + performanceClient + ); + }); + + afterAll(() => { + jest.useRealTimers(); + }); + + it("Adds correlationId to both post body and query params", async () => { + const form = await Authorize.getCodeForm( + document, + config, + authority, + validRequest, + logger, + performanceClient + ); + + // Post body check + const clientRequestIdInput = form.elements.namedItem( + AADServerParamKeys.CLIENT_REQUEST_ID + ) as HTMLInputElement; + expect(clientRequestIdInput).toBeTruthy(); + expect(clientRequestIdInput.value).toEqual( + validRequest.correlationId + ); + + // Query param check + const actionUrl = new URL(form.action); + expect( + actionUrl.searchParams.get(AADServerParamKeys.CLIENT_REQUEST_ID) + ).toEqual(validRequest.correlationId); + }); + }); });