Add local-network-access iframe attribute for Chrome 142+ compatibility #8128

Copilot · 2025-11-04T23:05:12Z

✅ Fix ssoSilent failure in Chrome 142 due to Local Network Access Restrictions

Summary

Chrome 142 enables Local Network Access Restrictions by default, blocking iframe access to authorization servers with a LocalNetworkAccessPermissionDenied CORS error. This causes ssoSilent() to timeout and fail with BrowserAuthError: monitor_window_timeout.

Solution: Add allow="local-network-access *" attribute to the iframe element created for silent authentication.

Changes Completed ✅

Update createHiddenIframe() function in SilentHandler.ts to add allow attribute with local-network-access *
Add test to verify the allow attribute is set correctly
Build and test the changes - all tests pass
Run linter and ensure all checks pass
Verify code formatting
Final verification with comprehensive test suite
Generate beachball changefile

Files Modified (15 lines total)

lib/msal-browser/src/interaction_handler/SilentHandler.ts - Added 1 line to set allow attribute
lib/msal-browser/test/interaction_handler/SilentHandler.spec.ts - Added 13 lines for new test
change/@azure-msal-browser-bc911259-ba35-43da-8c09-76cc3916692c.json - Beachball changefile for patch release

Testing Results ✅

✅ SilentHandler.spec.ts: All 7 tests pass (including new test for allow attribute)
✅ SilentIframeClient.spec.ts: All 24 tests pass
✅ All interaction tests: 310 tests passed, 1 skipped (pre-existing)
✅ Linter: Passes with no new errors or warnings
✅ Code formatting: Passes prettier checks
✅ Build: Succeeds for both msal-common and msal-browser
✅ Beachball check: Passes validation

Technical Details

Production Code Change (1 line)

// In createHiddenIframe() function:
authFrame.setAttribute("allow", "local-network-access *");

Test Coverage Added

New test verifies that the allow attribute is correctly set to "local-network-access *" on the created iframe.

Beachball Changefile

Generated changefile for @azure/msal-browser with patch version bump.

Impact Analysis

✅ Minimal change: Only 1 line added to production code
✅ Non-breaking: The attribute is permissive and doesn't restrict existing functionality
✅ Backward compatible: Works with older Chrome versions without issues
✅ Forward compatible: Addresses Chrome 142+ requirements
ℹ️ User consent: Users will still need to consent to local network access in Chrome 142+, but the authentication flow will no longer timeout

References

Original prompt

This section details on the original issue you should resolve

<issue_title>ssoSilent fails in upcoming version of Chrome (142)</issue_title>
<issue_description>### Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

4.25.0

Wrapper Library

Not Applicable

Wrapper Library Version

N/A

Public or Confidential Client?

Confidential, Public

Description

Version 142 (latest beta version) of chrome enables Local Network Access Restrictions [0] [1]. This breaks the ssoLogin function due to the following CORS error: LocalNetworkAccessPermissionDenied. Rather than returning account information, it causes a BrowserAuthError due to a timeout.

I'm able to reproduce this on older versions of chrome by manually enabling the following flag: chrome://flags/#local-network-access-check.

I was able to reproduce this with both msal-browser and msal-react. I've reproduced this locally and on deployed (non-localhost) websites.

Note that it seems like other browsers plan to include similar features so this issue might become more widespread.

Error Message

Network error CORS: LocalNetworkAccessPermissionDenied. That error causes the following upstream issue:
BrowserAuthError: monitor_window_timeout: Token acquisition in iframe failed due to timeout. For more visit: aka.ms/msaljs/browser-errors.

After doing some debugging. I was able to find the following error occurring in monitorIframeForHash function in SilentHandler.ts: Uncaught SecurityError: Failed to read a named property 'href' from 'Location': Blocked a frame with origin "http://localhost:5173" from accessing a cross-origin frame.

MSAL Logs

[MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - initialize called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Executing function initializeCache
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Info - MSAL.js was last initialized by version: 4.25.0
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Returning result from initializeCache
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - Claims-based caching is disabled. Clearing the previous cache with claims
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Executing function clearTokensAndKeysWithClaims
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Returning result from clearTokensAndKeysWithClaims
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - handleRedirectPromise called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - BrowserCacheManager.getTemporaryCache: No cache item found in local storage
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Info - handleRedirectPromise called but there is no interaction in progress, returning null.
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - handleRedirectPromise has been called for the first time, storing the promise
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - getAllAccounts called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : @azure/msal-browser@4.25.0 : Verbose - ssoSilent called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - canUsePlatformBroker called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - canUsePlatformBroker: platform broker unavilable, returning false
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Warning - No user hint provided. The authorization server may need more information to complete this request.
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Trace - Executing function standardInteractionClientInitializeAuthorizationRequest
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Verbose - getRedirectUri called
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Trace - Executing function initializeBaseRequest
auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Verbose - Authentication Scheme wasn't explici...

Fixes ssoSilent fails in upcoming version of Chrome (142) #8100

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

… compatibility Co-authored-by: tnorling <5307810+tnorling@users.noreply.github.com>

tnorling · 2025-11-05T00:14:44Z

@copilot Please generate changefiles by running npm run beachball:change from the root of the repo

Copilot · 2025-11-05T00:20:26Z

@copilot Please generate changefiles by running npm run beachball:change from the root of the repo

Changefile generated successfully. The file is located at change/@azure-msal-browser-bc911259-ba35-43da-8c09-76cc3916692c.json and beachball check validates successfully.

Copilot

Pull Request Overview

This PR adds the allow="local-network-access *" attribute to silent authentication iframes to ensure compatibility with Chrome 142, which introduces new privacy controls for local network access.

Adds local-network-access * attribute to the hidden iframe used for silent authentication flows
Includes a test case to verify the attribute is correctly set on the iframe

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lib/msal-browser/src/interaction_handler/SilentHandler.ts	Adds `allow="local-network-access *"` attribute to the hidden iframe created for silent token renewal
lib/msal-browser/test/interaction_handler/SilentHandler.spec.ts	Adds test to verify the `allow` attribute is properly set on the iframe
change/@azure-msal-browser-bc911259-ba35-43da-8c09-76cc3916692c.json	Beachball change file documenting the patch for Chrome 142 compatibility

Copilot · 2025-11-05T23:01:34Z

change/@azure-msal-browser-bc911259-ba35-43da-8c09-76cc3916692c.json

@@ -0,0 +1,7 @@
+{
+  "type": "patch",
+  "comment": "Add allow=\"local-network-access *\" attribute to iframe for Chrome 142 compatibility",


The change file comment is missing the PR number reference. According to repository guidelines, change messages should follow the template: 'Brief description of change #XXXX'. Please update the comment to include the PR number as a link.

…ty (#8128) ## ✅ Fix ssoSilent failure in Chrome 142 due to Local Network Access Restrictions ### Summary Chrome 142 enables Local Network Access Restrictions by default, blocking iframe access to authorization servers with a `LocalNetworkAccessPermissionDenied` CORS error. This causes `ssoSilent()` to timeout and fail with `BrowserAuthError: monitor_window_timeout`. **Solution**: Add `allow="local-network-access *"` attribute to the iframe element created for silent authentication. ### Changes Completed ✅ - [x] Update `createHiddenIframe()` function in `SilentHandler.ts` to add `allow` attribute with `local-network-access *` - [x] Add test to verify the `allow` attribute is set correctly - [x] Build and test the changes - all tests pass - [x] Run linter and ensure all checks pass - [x] Verify code formatting - [x] Final verification with comprehensive test suite - [x] Generate beachball changefile ### Files Modified (15 lines total) - **lib/msal-browser/src/interaction_handler/SilentHandler.ts** - Added 1 line to set allow attribute - **lib/msal-browser/test/interaction_handler/SilentHandler.spec.ts** - Added 13 lines for new test - **change/@azure-msal-browser-bc911259-ba35-43da-8c09-76cc3916692c.json** - Beachball changefile for patch release ### Testing Results ✅ - ✅ **SilentHandler.spec.ts**: All 7 tests pass (including new test for allow attribute) - ✅ **SilentIframeClient.spec.ts**: All 24 tests pass - ✅ **All interaction tests**: 310 tests passed, 1 skipped (pre-existing) - ✅ **Linter**: Passes with no new errors or warnings - ✅ **Code formatting**: Passes prettier checks - ✅ **Build**: Succeeds for both msal-common and msal-browser - ✅ **Beachball check**: Passes validation ### Technical Details #### Production Code Change (1 line) ```typescript // In createHiddenIframe() function: authFrame.setAttribute("allow", "local-network-access *"); ``` #### Test Coverage Added New test verifies that the `allow` attribute is correctly set to `"local-network-access *"` on the created iframe. #### Beachball Changefile Generated changefile for @azure/msal-browser with patch version bump. ### Impact Analysis - ✅ **Minimal change**: Only 1 line added to production code - ✅ **Non-breaking**: The attribute is permissive and doesn't restrict existing functionality - ✅ **Backward compatible**: Works with older Chrome versions without issues - ✅ **Forward compatible**: Addresses Chrome 142+ requirements - ℹ️ **User consent**: Users will still need to consent to local network access in Chrome 142+, but the authentication flow will no longer timeout ### References - [Chrome Status - Local Network Access](https://chromestatus.com/feature/5152728072060928) - [Chrome Developer Blog - Local Network Access](https://developer.chrome.com/blog/local-network-access) - [Implementation Guide](https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-aoU251p705FbIQjDuGs/edit)  <details> <summary>Original prompt</summary> ---- *This section details on the original issue you should resolve* <issue_title>ssoSilent fails in upcoming version of Chrome (142)</issue_title> <issue_description>### Core Library MSAL.js (@azure/msal-browser) ### Core Library Version 4.25.0 ### Wrapper Library Not Applicable ### Wrapper Library Version N/A ### Public or Confidential Client? Confidential, Public ### Description Version 142 (latest beta version) of chrome enables Local Network Access Restrictions [[0]](https://chromestatus.com/feature/5152728072060928) [[1]](https://developer.chrome.com/blog/local-network-access). This breaks the ssoLogin function due to the following CORS error: `LocalNetworkAccessPermissionDenied`. Rather than returning account information, it causes a BrowserAuthError due to a timeout. I'm able to reproduce this on older versions of chrome by manually enabling the following flag: `chrome://flags/#local-network-access-check`. I was able to reproduce this with both msal-browser and msal-react. I've reproduced this locally and on deployed (non-localhost) websites. Note that it seems like other browsers plan to include similar features so this issue might become more widespread. ### Error Message Network error `CORS: LocalNetworkAccessPermissionDenied`. That error causes the following upstream issue: `BrowserAuthError: monitor_window_timeout: Token acquisition in iframe failed due to timeout. For more visit: aka.ms/msaljs/browser-errors`. After doing some debugging. I was able to find the following error occurring in `monitorIframeForHash` function in [SilentHandler.ts](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/src/interaction_handler/SilentHandler.ts): `Uncaught SecurityError: Failed to read a named property 'href' from 'Location': Blocked a frame with origin "http://localhost:5173" from accessing a cross-origin frame.` ### MSAL Logs [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - initialize called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Executing function initializeCache auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Info - MSAL.js was last initialized by version: 4.25.0 auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Returning result from initializeCache auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - Claims-based caching is disabled. Clearing the previous cache with claims auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Executing function clearTokensAndKeysWithClaims auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - Returning result from clearTokensAndKeysWithClaims auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - handleRedirectPromise called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - BrowserCacheManager.getTemporaryCache: No cache item found in local storage auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Info - handleRedirectPromise called but there is no interaction in progress, returning null. auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - handleRedirectPromise has been called for the first time, storing the promise auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Verbose - getAllAccounts called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : @azure/msal-browser@4.25.0 : Verbose - ssoSilent called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - canUsePlatformBroker called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [] : @azure/msal-browser@4.25.0 : Trace - canUsePlatformBroker: platform broker unavilable, returning false auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Warning - No user hint provided. The authorization server may need more information to complete this request. auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Trace - Executing function standardInteractionClientInitializeAuthorizationRequest auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Verbose - getRedirectUri called auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Trace - Executing function initializeBaseRequest auth.ts:25 [MSAL] [Wed, 15 Oct 2025 04:35:15 GMT] : [0199e626-a35a-73c9-914d-9011cd563f1d] : msal.js.browser@4.25.0 : Verbose - Authentication Scheme wasn't explici... </details> - Fixes #8100  --- ✨ Let Copilot coding agent [set things up for you](https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tnorling <5307810+tnorling@users.noreply.github.com>

Initial plan

5464b1c

Copilot AI assigned Copilot and tnorling Nov 4, 2025

Copilot started work on behalf of tnorling November 4, 2025 23:05 View session

Add allow="local-network-access *" attribute to iframe for Chrome 142…

410206a

… compatibility Co-authored-by: tnorling <5307810+tnorling@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix ssoSilent failure in Chrome version 142~~ Add local-network-access iframe attribute for Chrome 142+ compatibility Nov 4, 2025

Copilot AI requested a review from tnorling November 4, 2025 23:20

Copilot finished work on behalf of tnorling November 4, 2025 23:20

Copilot started work on behalf of tnorling November 5, 2025 00:15 View session

Change files

52078e2

Copilot finished work on behalf of tnorling November 5, 2025 00:21

tnorling marked this pull request as ready for review November 5, 2025 22:59

tnorling requested a review from a team as a code owner November 5, 2025 22:59

Copilot AI review requested due to automatic review settings November 5, 2025 22:59

Copilot AI reviewed Nov 5, 2025

View reviewed changes

lalimasharda approved these changes Nov 5, 2025

View reviewed changes

jo-arroyo approved these changes Nov 5, 2025

View reviewed changes

tnorling merged commit 5530b41 into dev Nov 5, 2025
14 checks passed

tnorling deleted the copilot/fix-ssosilent-chrome-142-issue branch November 5, 2025 23:37

Copilot AI mentioned this pull request Nov 5, 2025

[msal-v5] Add local-network-access iframe attribute for Chrome 142+ compatibility #8132

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add local-network-access iframe attribute for Chrome 142+ compatibility #8128

Add local-network-access iframe attribute for Chrome 142+ compatibility #8128

Copilot AI commented Nov 4, 2025 •

edited

Loading

Uh oh!

tnorling commented Nov 5, 2025

Uh oh!

Copilot AI commented Nov 5, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Add local-network-access iframe attribute for Chrome 142+ compatibility #8128

Add local-network-access iframe attribute for Chrome 142+ compatibility #8128

Conversation

Copilot AI commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Fix ssoSilent failure in Chrome 142 due to Local Network Access Restrictions

Summary

Changes Completed ✅

Files Modified (15 lines total)

Testing Results ✅

Technical Details

Production Code Change (1 line)

Test Coverage Added

Beachball Changefile

Impact Analysis

References

Core Library Version

Wrapper Library

Wrapper Library Version

Public or Confidential Client?

Description

Error Message

MSAL Logs

Uh oh!

tnorling commented Nov 5, 2025

Uh oh!

Copilot AI commented Nov 5, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Nov 4, 2025 •

edited

Loading