Authentication failure in safari browser(version- 13.3) and ios mobile devices (version 13.4.1))

[divya2603]

Library

• msal@1.3.0

Framework

React v16

Description

It is a single-tenant application. The incoming user is authenticated using msal.js. If the user exists in AD, they can access our application.

Security

Is this issue security related? NO

Regression

Did this behavior work before? NO

Configuration

const authContext = new UserAgentApplication({
auth: {
clientId: clientId,
authority: https://login.microsoftonline.com/${tenantId},
postLogoutRedirectUri: window.location.origin,
redirectUri: window.location.origin
},
cache: {
cacheLocation: "localStorage",
storeAuthStateInCookie: true
}
});

Reproduction steps

When the code is executed in Safari browser(version 13.1), acquireTokenSilent throws the following error:
ClientAuthError: URL navigated to is https://login.microsoftonline.com//oauth2/v2.0/authorize?response_type=token&scope=openid%20profile%20User.Read&client_id=<client_id>&redirect_uri=<redirect_uri>&state=&nonce=< ### >&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.0&client-request-id=<request_id>&prompt=none&response_mode=fragment, Token renewal operation failed due to timeout.

Expected behavior

The user should be authenticated successfully in safari browser as well.

Browsers

This is a browser specific behaviour. The authentication call fails only in Safari (version 13.1) and mobile iOS devices (version- 13.4.1). It works perfectly in all other browsers.

[tnorling]

@divya2603 Unfortunately due to Safari blocking third party cookies, acquireTokenSilent is expected not to work. As a workaround you can either enable third party cookies or call acquireTokenRedirect or acquireTokenPopup. You can read more about this issue here

Additionally, we have a new version of msal, known as msal@2.0 or msal-browser, which is currently in Public Preview that implements the Auth Code flow which solves this problem by using refresh tokens instead of acquiring tokens using a hidden iframe. You can read more about how this solves the problem here

Also see issue #1000

[tnorling]

Closing as this is expected behavior in msal 1.x. Let us know if you have any further questions. Thanks!