-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Add support for authorize call using method POST #7920
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…rizationRequest instead of baseAuthRequest
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds support for sending authorize requests using the HTTP POST method in addition to the existing GET method. The feature enables passing parameters in the request body through the new authorizePostBodyParameters
property.
- Introduces new
httpMethod
andauthorizePostBodyParameters
options to auth requests - Adds validation logic to ensure proper method/parameter combinations
- Implements POST-based authorization flows for both redirect and popup clients
Reviewed Changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
File | Description |
---|---|
samples/msal-browser-samples/VanillaJSTestApp2.0/app/default/authConfig.js | Updates sample configuration to demonstrate POST method usage with body parameters |
samples/msal-browser-samples/VanillaJSTestApp2.0/app/default/auth.js | Minor cleanup removing unused redirectUri parameter |
lib/msal-common/src/utils/Constants.ts | Defines HttpMethod constants for GET and POST |
lib/msal-common/src/request/RequestParameterBuilder.ts | Adds utility function for handling POST body parameters |
lib/msal-common/src/request/BaseAuthRequest.ts | Extends request interface with httpMethod and authorizePostBodyParameters |
lib/msal-common/src/exports-common.ts | Exports the new HttpMethod constant |
lib/msal-common/src/error/ClientConfigurationErrorCodes.ts | Adds error codes for invalid request configurations |
lib/msal-common/src/error/ClientConfigurationError.ts | Defines error messages for new validation scenarios |
lib/msal-browser/test/utils/StringConstants.ts | Adds test constants for authorize body parameters |
lib/msal-browser/test/interaction_client/*.spec.ts | Comprehensive test coverage for new POST method functionality |
lib/msal-browser/src/request/RequestHelpers.ts | Implements request validation logic for method/parameter combinations |
lib/msal-browser/src/protocol/Authorize.ts | Adds getCodeForm function for POST-based authorization |
lib/msal-browser/src/interaction_client/StandardInteractionClient.ts | Integrates request method validation into client initialization |
lib/msal-browser/src/interaction_client/RedirectClient.ts | Implements executeCodeFlowWithPost method for redirect scenarios |
lib/msal-browser/src/interaction_client/PopupClient.ts | Implements executeCodeFlowWithPost method for popup scenarios |
Comments suppressed due to low confidence (1)
lib/msal-browser/test/interaction_client/RedirectClient.spec.ts:26
- The imported testNavUrl constant appears to be used in tests but its definition is not shown in the diff. Ensure this constant is properly defined and exported from the StringConstants file.
testNavUrl,
lib/msal-browser/src/interaction_client/StandardInteractionClient.ts
Outdated
Show resolved
Hide resolved
This PR: - Adds the `httpMethod` and `authorizePostBodyParameters` options to `BaseAuthRequest` - Enables calls to the `/authorize` endpoint using HTTP method "POST" using the `Redirect`, `Popup`, and `SilentIFrame` flows - Ensures `extraQueryParameters` are still encoded into the request URL in `POST` flow - Ensures `httpMethod` cannot be set to 'GET' when using the EAR protocol mode (throws when the request is validated) - Ensures request validation to make sure the combinations of `httpMethod` and `authorizePostBodyParameters` as well as `httpMethod` and protocol mode happens before synchronous popup is opened.
This PR:
httpMethod
andauthorizePostBodyParameters
options toBaseAuthRequest
/authorize
endpoint using HTTP method "POST" using theRedirect
,Popup
, andSilentIFrame
flowsextraQueryParameters
are still encoded into the request URL inPOST
flowhttpMethod
cannot be set to 'GET' when using the EAR protocol mode (throws when the request is validated)httpMethod
andauthorizePostBodyParameters
as well ashttpMethod
and protocol mode happens before synchronous popup is opened.