O365Manual and login.microsoftonline.com's new redirect

[esabol]

Recently (about a week or two ago at most), Microsoft added a redirect from https://login.microsoftonline.com/common/oauth2/nativeclient to https://login.microsoftonline.com/common/wrongplace that makes O365Manual annoyingly difficult to use. You have 1 second to copy the https://login.microsoftonline.com/common/oauth2/nativeclient before it redirects. It's possible, but it typically takes me like 2-3 attempts before I'm able to successfully copy the URL before the redirect.

While this isn't something that DavMail is responsible for, it does affect DavMail usage, so I thought I'd open an issue here to at least discuss possible mitigations with other DavMail users.

I've tried the Redirect Blocker extension in Firefox, but it doesn't seem to work with redirects to the same domain name. I've opened an issue with regards to that: Tyson3101/Redirect-Blocker#31

Google Gemini suggested using the uBlock Origin extension to disable redirects. Has anyone tried that and can report whether it works?

Any other ideas?

[cgm999]

python script that gets the token:
https://gist.github.com/cgm999/6b5a1333013dcbcd7465f1bcfaaaeaaa

[esabol]

Nice! @Tyson3101 recommended this userscript for the Tampermonkey extension/add-on that should block the redirect in Firefox/Chrome/etc.

[mguessan]

I assume you are using the default DavMail clientId? In this case you may want to try with an alternative redirect url:

https://localhost/common/oauth2/nativeclient

I managed to access DavMail original application configuration through Azure portal to add this additional url.
Warning: if you had to consent access to DavMail application this will probably trigger a new consent request.

Anyway you should also consider switching from Manual to O365Interactive authenticator with new SWT based implementation that relies on native browser instead of OpenJFX version => Edge on windows and Webkit on linux, this greatly improves compatibility with various authentication flows.

[esabol]

A couple days ago, I got the Tampermonkey userscript to work, but I had to use Violentmonkey on Firefox instead. I'm happy with this solution.

I run DavMail on a remote Linux server over a slow connection. Using O365Interactive isn't a viable option for me.

[kalaklanar]

I needed to add a wildcard to the end of the match string in the Tapermonkey string to get it to work for me.

This is my first time using Tapermonkey, so I decided to learn a bit and add a copy to clipboard feature and also to display a message and the URL to copy as well.

You can't submit a PR to a gist, so my version is at https://gist.github.com/kalaklanar/d52f33d09a11c4214a54de4071aea053

[esabol]

Thank you so much, @kalaklanar ! I'll try your changes and report back.

[esabol]

Well, I tried it and it doesn't work for me in Firefox. Are you using Firefox, @kalaklanar, or a different browser?

No matter what I tried, I couldn't get Tampermonkey to work, so I've gone back to Violentmonkey.

I found and fixed several possibly Firefox-specific errors, and I got the following version working in Firefox:

Block Microsoft Redirect-1.1.1.user.js
Block Microsoft Redirect-1.1.2.user.js

I had to use GM_setClipboard() on Firefox, which involved @grant-ing that. Firefox blocks navigator.clipboard.write() for security reasons, and using GM_setClipboard() is supposed to bypass it. But that apparently changes the context that the script runs in, so you also have to @grant unsafeWindow and use unsafeWindow instead of window in the userscript. Oh, and I had to insert the HTML and copy the URL to the clipboard in a DOMContentLoaded event listener. Otherwise, document.body wasn't defined and the URL that was copied to the clipboard was the wrong URL. Ugh! But I finally got a version that works well for me and copies the URL to the clipboard automatically, which was a cool idea.

[cgm999]

Did anyone tried the py script ?

I started using it for past 2 weeks and it seems to just work.. needs python and playwright .. and is 100% automated :)

[esabol]

I have not. It sounds great, @cgm999, but I don't do my O365 authorizations on a Linux box, and playwright is not available there.

[kalaklanar]

@esabol I tried your script in a new Firefox profile with only Tapermonkey installed as an extension, and it still redirected. It didn't copy the clipboard either. I'm wondering if something changed in MS's end. I didn't dig before, but there is a CSP script being loaded, and I think that is causing the problems. I wound up changing my earlier script so that it detects FF and makes it a bit lamer, just blocking the redirect with an alert warning to copy the URL by hand.

I put it at blockMicrosoftRedirect.js

I'm starting to wish these versions were a full git and not a gist. Too bad DavMail doesn't have a utils section.

[esabol]

Sorry, I have a new version, 1.1.2, that I've been meaning to upload. Attached below. I guarantee it works on Firefox with ViolentMonkey. No idea about Chrome or with Tampermonkey. (I couldn't get any userscripts to work with Tampermonkey in Firefox. I'm not sure if that's "user error" or if it's just not currently compatible with Firefox.)

Block Microsoft Redirect-1.1.2.user.js

[hakansonOHSU]

Anyway you should also consider switching from Manual to O365Interactive authenticator with new SWT based implementation that relies on native browser instead of OpenJFX version => Edge on windows and Webkit on linux, this greatly improves compatibility with various authentication flows.

@mguessan , I'm using O365Interative (macOS Tahoe, currently, but also on previous macOS 15.7.3), and I still get this same problem (only have a few seconds to grab the URL/token before the redirect happens).

Suggestions would be welcome.

[mguessan]

Anyway you should also consider switching from Manual to O365Interactive authenticator with new SWT based implementation that relies on native browser instead of OpenJFX version => Edge on windows and Webkit on linux, this greatly improves compatibility with various authentication flows.

@mguessan , I'm using O365Interative (macOS Tahoe, currently, but also on previous macOS 15.7.3), and I still get this same problem (only have a few seconds to grab the URL/token before the redirect happens).

Suggestions would be welcome.

So you have O365Interactive selected but you still have a failover to O365Manual ?

If you have default DavMail clientId you can try to change redirect_uri to https://localhost/common/oauth2/nativeclient

You may also want to try to grab latest SWT implementation from:
https://download.eclipse.org/eclipse/downloads/drops4/R-4.37-202509050730/

at the bottom: SWT Binary and Source, picl the one matching your architecture, probably aarch64
You just need the swt.jar file, drop it inside davmail.app with the other jars

Note: this is not tested at all, no access to any apple machine currently

[kalaklanar]

There's an update to my block script

@esabol You new version still didn't work for me. I'm guessing that there is a difference between Tampermonkey and Violentmonkey that is enough to effect both our userscripts. Making "one unified" script would be possible to detect what is running it, but it's getting a bit complex for something we're posting as gists.

If I get motivated, I might add it to a repo or something, but I'm swamped now.

So, for anyone who finds this, look to @esabol for Violentmonkey, and my version for Tampermonkey for now.