unprotectedResources comming from router unprotect api endpoints

Please follow the issue template below. Failure to do so will result in a delay in answering your question.

Library

• msal@1.x.x or @azure/msal@1.x.x
• @azure/msal-browser@2.x.x
• @azure/msal-angular@0.x.x
• @azure/msal-angular@1.0.0
• @azure/msal-angularjs@1.x.x

Important: Please fill in your exact version number above, e.g. msal@1.1.3.

Framework

Angular 9

Description

Currently, in class MsalService constructor, if unprotectedResources are given, routes comming from Router are added to unprotectedResources. In most of our proyects we have a correlation between app routes and rest api endpoints, for example: https://myApp/profile -> https://myApi/api/profile

Taking into account routes were added to unprotected resources, lately, on isUnprotectedResource method, the validation that checks id an endpoint is on the unprotectedResources returns true, althought endpoint wasn’t added to them.

Security

Is this issue security related?

Regression

Did this behavior work before? Don’t Know

Configuration

Please provide your MSAL configuration options.

{
...
unprotectedResources: ['assets/i18n']
...
}

Reproduction steps

See description above

Expected behavior

Routes comming from router don’t unprotect api endpoints

Browsers

Is this issue browser-specific? no

[jasonnutter]

@MisterPhilip Does not providing unprotectedResources work as a mitigation?

[mbendtsen]

This took me 1½ day to figure this out 😦 I can confirm that setting unprotectedResources to null fixes my issue.

function MSALAngularConfigFactory(config: ConfigService): MsalAngularConfiguration {
  return {
    popUp: true,
    consentScopes: [
      config.getSettings('resourceScope'),
      ...config.getSettings('loginRequest')
    ],
    unprotectedResources: null,
    protectedResourceMap: [
      [
        config.getSettings('baseUrl'),
        [config.getSettings('resourceScope')]
      ]
    ],
    extraQueryParameters: {}
  };

NOTE: Setting unprotectedResources to empty array [] does not work.