Skip to content

Conversation

hectormmg
Copy link
Member

@hectormmg hectormmg commented Jul 9, 2025

This PR:

  • Adds the httpMethod and authorizePostBodyParameters options to BaseAuthRequest
  • Enables calls to the /authorize endpoint using HTTP method "POST" using the Redirect, Popup, and SilentIFrame flows
  • Ensures extraQueryParameters are still encoded into the request URL in POST flow
  • Ensures httpMethod cannot be set to 'GET' when using the EAR protocol mode (throws when the request is validated)
  • Ensures request validation to make sure the combinations of httpMethod and authorizePostBodyParameters as well as httpMethod and protocol mode happens before synchronous popup is opened.

@github-actions github-actions bot added msal-browser Related to msal-browser package msal-common Related to msal-common package labels Jul 9, 2025
@github-actions github-actions bot added the samples Related to the samples apps for the library. label Jul 20, 2025
@hectormmg hectormmg marked this pull request as ready for review July 21, 2025 17:47
@Copilot Copilot AI review requested due to automatic review settings July 21, 2025 17:47
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds support for sending authorize requests using the HTTP POST method in addition to the existing GET method. The feature enables passing parameters in the request body through the new authorizePostBodyParameters property.

  • Introduces new httpMethod and authorizePostBodyParameters options to auth requests
  • Adds validation logic to ensure proper method/parameter combinations
  • Implements POST-based authorization flows for both redirect and popup clients

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
samples/msal-browser-samples/VanillaJSTestApp2.0/app/default/authConfig.js Updates sample configuration to demonstrate POST method usage with body parameters
samples/msal-browser-samples/VanillaJSTestApp2.0/app/default/auth.js Minor cleanup removing unused redirectUri parameter
lib/msal-common/src/utils/Constants.ts Defines HttpMethod constants for GET and POST
lib/msal-common/src/request/RequestParameterBuilder.ts Adds utility function for handling POST body parameters
lib/msal-common/src/request/BaseAuthRequest.ts Extends request interface with httpMethod and authorizePostBodyParameters
lib/msal-common/src/exports-common.ts Exports the new HttpMethod constant
lib/msal-common/src/error/ClientConfigurationErrorCodes.ts Adds error codes for invalid request configurations
lib/msal-common/src/error/ClientConfigurationError.ts Defines error messages for new validation scenarios
lib/msal-browser/test/utils/StringConstants.ts Adds test constants for authorize body parameters
lib/msal-browser/test/interaction_client/*.spec.ts Comprehensive test coverage for new POST method functionality
lib/msal-browser/src/request/RequestHelpers.ts Implements request validation logic for method/parameter combinations
lib/msal-browser/src/protocol/Authorize.ts Adds getCodeForm function for POST-based authorization
lib/msal-browser/src/interaction_client/StandardInteractionClient.ts Integrates request method validation into client initialization
lib/msal-browser/src/interaction_client/RedirectClient.ts Implements executeCodeFlowWithPost method for redirect scenarios
lib/msal-browser/src/interaction_client/PopupClient.ts Implements executeCodeFlowWithPost method for popup scenarios
Comments suppressed due to low confidence (1)

lib/msal-browser/test/interaction_client/RedirectClient.spec.ts:26

  • The imported testNavUrl constant appears to be used in tests but its definition is not shown in the diff. Ensure this constant is properly defined and exported from the StringConstants file.
    testNavUrl,

@github-actions github-actions bot added the documentation Related to documentation. label Jul 21, 2025
@github-actions github-actions bot removed the samples Related to the samples apps for the library. label Jul 21, 2025
@github-actions github-actions bot added the samples Related to the samples apps for the library. label Jul 21, 2025
@hectormmg hectormmg enabled auto-merge (squash) July 22, 2025 19:08
@hectormmg hectormmg merged commit fbb3fbf into dev Jul 22, 2025
8 checks passed
@hectormmg hectormmg deleted the post-auth branch July 22, 2025 19:13
hectormmg added a commit that referenced this pull request Aug 13, 2025
This PR:
- Adds the `httpMethod` and `authorizePostBodyParameters` options to
`BaseAuthRequest`
- Enables calls to the `/authorize` endpoint using HTTP method "POST"
using the `Redirect`, `Popup`, and `SilentIFrame` flows
- Ensures `extraQueryParameters` are still encoded into the request URL
in `POST` flow
- Ensures `httpMethod` cannot be set to 'GET' when using the EAR
protocol mode (throws when the request is validated)
- Ensures request validation to make sure the combinations of
`httpMethod` and `authorizePostBodyParameters` as well as `httpMethod`
and protocol mode happens before synchronous popup is opened.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Related to documentation. msal-browser Related to msal-browser package msal-common Related to msal-common package samples Related to the samples apps for the library.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants