Microsoft-authentication-library-for-js: Safari on iOS: acquireTokenSilent never completes

Created on 6 Mar 2020 · 4Comments · Source: AzureAD/microsoft-authentication-library-for-js

Library

[X] [email protected] or @azure/[email protected]
[ ] @azure/[email protected]
[ ] @azure/[email protected]
[ ] @azure/[email protected]
[ ] @azure/[email protected]

Framework

React 16.12.0

Description

In iOS Safari, acquireTokenSilent does not complete. No result is ever processed, no error is caught.

Security

Regression

Configuration

var instance = 'https://login.microsoftonline.com/tfp/';
var tenant = 'nssapp.onmicrosoft.com';
var signInPolicy = 'B2C_1_signup_signin_v2';
var authority = `${instance}${tenant}/${signInPolicy}`

export const msalApp = new UserAgentApplication({
    auth: {
        clientId: "abcdabcd-643f-4914-9a04-dff4097879fb",
        authority: authority,
        validateAuthority: true,
        postLogoutRedirectUri: window.location.origin,
        navigateToLoginRequestUrl: false
    },
    cache: {
        cacheLocation: "sessionStorage",
        storeAuthStateInCookie: isIE()
    },
    system: {
        navigateFrameWait: 0,
        logger: {
            error: console.error,
            errorPii: console.error,
            info: console.log,
            infoPii: console.log,
            verbose: console.log,
            verbosePii: console.log,
            warning: console.warn,
            warningPii: console.warn
        }
    }
});

Reproduction steps

Uses Azure B2C. Flow is the provided b2c_1_signup_signin_v2 .

Check for presence of account with msalApp.getAccount();
If account is present, call acquireTokenSilent with user_impersonation scope
Wait for the promise returned to complete, or catch(...) to receive an error. Neither occurs.**

** This is not entirely true. An error is never received. Occasionally, the promise does complete, and the object passed in has a valid accessToken. After this point, the app continues to run fine. The frequency of this is very low.

Expected behavior

On other browsers, acquireTokenSilent always seems to complete fine, and the result includes a valid accessToken that is accepted by the target API.

Browsers

Fault occurs on:

Safari on iOS, iPad OS
iOS: 13.3.1
iPadOS: 13.3

Fault does not occur on:

Safari on MacOS Mojave
Chrome, Edge, Firefox on Windows

Notes

Behavior is the same whether cross-site tracking prevention is turned on or off.
Delaying the calls mentioned in the reproduction steps seems to have no noticeable effect on the behavior.

My experience in js/react/... is very limited, so I could be doing something pretty silly. However, this does work fine in other browsers I've tried. A user reported a similar-looking issue in Chrome on Windows once, but I haven't been able to reproduce that. Could be related.

I looked over similar issues and tried a few things suggested, but the behavior didn't change, and it didn't seem like any were identical to my issue.

Could https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/1354 be a fix?

Logs

bug

Source

tragdorvigani1

All 4 comments

@tragdorvigani1 Yes, I believe #1354 should fix this. Working to have that released soon.

jasonnutter on 6 Mar 2020

@jasonnutter Thanks! [Is there some way I can register for a notification for that release? If it'll take a while I could try patching the changes myself, to find out whether it solves the issue.] - never mind, it's pretty obvious I can watch that topic if I actually have a look on the page...

tragdorvigani1 on 8 Mar 2020

👍1

The fix for this is available in [email protected], please try that version and confirm that it has been fixed, thanks!

jasonnutter on 12 Mar 2020

Hi @jasonnutter - just a note to say that this is fixed, also confirmed in 1.3.0. Thanks!

tragdorvigani1 on 1 May 2020

👍1

Was this page helpful?

0 / 5 - 0 ratings