Webassembly MSAL unsupported

[svrooij]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

It seems that MSAL webassembly is using a deprecated version of msal-browser

This is related to this issue

Main issue is:
I want to send the id_token_hint to Azure AD B2C, this parameter is specified in the openid connect specs so I don't understand why it would let me send this thing out.

Expected Behavior

I expect production code not to use deprecated libraries to do authentication

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

9.0.100

Anything else?

No response

[MackinnonBuck]

@wtgodbe, any idea why component governance wouldn't have caught this?

[svrooij]

@MackinnonBuck great question 😄. Let's say I would like to contribute to this and have it implemented in dotnet 8 or dotnet 9, which branch should I start with?

The MSAL WebAssembly implementation is very minimal and can use some improvements. Where can I start?
Sorry if this is documented somewhere, I had a hard time finding it out. Can we even contribute stuff to dotnet 8 or 9 or are it just security updates?

[wtgodbe]

any idea why component governance wouldn't have caught this?

CG files issues for components with security vulnerabilities - it wouldn't necessarily flag for a deprecated version, if that component didn't have any CVEs filed for it.

[wtgodbe]

Let's say I would like to contribute to this and have it implemented in dotnet 8 or dotnet 9, which branch should I start with?

We would take a version upgrade in 9.0 and 8.0, but we likely wouldn't take any larger feature-level changes there. If you want, you could contribute the version updates in https://github.com/dotnet/aspnetcore/tree/release/9.0 and https://github.com/dotnet/aspnetcore/tree/release/8.0, and a more fleshed-out feature improvement in https://github.com/dotnet/aspnetcore/tree/main.