Does not follow reject Promise calling acquireTokenSilent if in Iframe

[binaryjam]

I'm submitting a...

[ ] Regression (a behavior that used to work and stopped working in a new release)
[X ] Bug report  
[ ] Performance issue
[ ] Feature request
[ ] Documentation issue or request
[ ] Other... Please describe:

Browser:

• [X ] Chrome version Version 76.0.3809.87 (Official Build) (64-bit)
• Firefox version XX
• IE version XX
• [X ] Edge version DevEdge 77.0.230.2 (Official build) dev (64-bit)
• Safari version XX

Library version

Library version: 1.1.1

Current behavior

When making a call to msal.acquireTokenSilent, if the page is embedded in an Iframe it does not work and neither does it return an error.

Expected behavior

Now I know that you do not want to support IFRAMEs in this library from earlier tickets, but when this is called it needs to obey the promise pattern and either succeed or fail.

In this case it should return an error, preferably with a new error code to say we do not support iframes as part of the promise.

In the UserAgentApplication.ts the decorator resolveTokenOnlyIfOutOfIframe
checks if in Iframe and returns a new promise, but does nothing with that promise subsequently, if not in an iframe a differnt promise is called and resolves or rejects correctly.
That promise needs to be rejected with an iframe error warning please.

Minimal reproduction of the problem with instructions

If you take the QuickStart Code and make that work stand alone, then embed that page inside an Iframe in another Website (pref not both localhost, I have not tried on localhost or same websites so this is how I set it up). you can actually login it will popup the Dialog box, but it will not do anything.

[pkanher617]

@binaryjam We are currently working on updating the iframe logic to support msal.js within iframes. @sameerag Can you give more information here?

[DarylThayil]

I am into this suggestion, I wonder if this should be a breaking change or not
I don't think it is ....

[sameerag]

I asked @binaryjam to open this. If there is a way we can send an error with our current behavior if a token is not resolved in an iframe, that can be at least informative. What I need to investigate is if this can be achieved today and the redundancy of the same once we lift the condition in MSAL.

[DarylThayil]

#909
@binaryjam / @sameerag please review

[sameerag]

Ah! I see @DarylThayil, This makes sense. I was more trying to find a condition at resolution. This sounds good.

[sameerag]

@binaryjam Can you also please test #909 in your environment to verify?

[binaryjam]

Sure, will be Monday though

…

On Fri, 2 Aug 2019, 18:03 Sameera Gajjarapu, ***@***.***> wrote: @binaryjam <https://github.com/binaryjam> Can you also please test #909 <#909> in your environment to verify? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#902?email_source=notifications&email_token=ABYDEIG5XDMITEOTHYHRASDQCRSFBA5CNFSM4IIR2HPKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3OKAQI#issuecomment-517775425>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYDEIDRYJW6SG3ZYOCTZP3QCRSFBANCNFSM4IIR2HPA> .

[DarylThayil]

we believe this will be solved in #899, unfortunately my pr does not take into account the full scenario, and we believe removing the iframe in iframe restriction will. closing this ticket