Microsoft-authentication-library-for-js: Usage of globals breaks SSR

[DaSchTour]

Please follow the issue template below. Failure to do so will result in a delay in answering your question.

Library

• [x] [email protected] or @azure/[email protected]
• [ ] @azure/[email protected]
• [x] @azure/[email protected]
• [ ] @azure/[email protected]
• [ ] @azure/[email protected]

Framework

Angular v9

Description

When trying to start my application with SSR and installed MSAL Library the application breaks because of the extensive direct usage of globals. It first breaks at TelemetryManager but I have seen that there are a lot of other potential unsafe usages of globals.

Security

Is this issue security related?

Regression

Did this behavior work before?

Configuration

Please provide your MSAL configuration options.

// Provide configuration values here.
// For Azure B2C issues, please include your policies.

Reproduction steps

1. Create Angular project with SSR
2. Install msal + msal angular
3. Try to start SSR

Expected behavior

SSR works without errors

Browsers

Is this issue browser-specific? If so, please detail which browsers are impacted (e.g. IE 11, Safari).

[jasonnutter]

@DaSchTour Unfortunately, server-side rendering is currently considered out of scope for the library, given it's heavy reliance on the browser environment, as you have noticed. This is something we may consider improving in the future, but for now, it is recommended to not include MSAL in server render paths, and only include it client-side.

[DaSchTour]

Yeah, when registring the module for root to have it available that‘s not easy to achive. At least some information about this would have been helpful. There are actually pretty easy solutions to solve this. It would have been much appreciated to have this obstacle communicated upfront that there is the need to implement such a solution.

[jasonnutter]

@DaSchTour That is good feedback, and yeah there is probably a relatively small amount of work we can do to get it so it doesn't break when used with server-side rendering, however, that hasn't been a priority yet.

[github-actions[bot]]

This issue has not seen activity in 14 days. It may be closed if it remains stale.

[jasonnutter]

Fixed in v2 via #2073