test: add URL-as-title test cases for redirect URI without title element

Cover the scenario where document.title defaults to the raw redirect URL
(browser behavior when no <title> element is set on the page).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: sameerag

lib/msal-browser/test/interaction_client/PopupClient.spec.ts

@@ -2365,6 +2365,33 @@ describe("PopupClient", () => {
             ).toBe("Microsoft Authentication");
         });
 
+        it("replaces URL-based document.title on popup window when no title is set", () => {
+            const mockPopupWindow = {
+                ...window,
+                document: {
+                    title: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=test",
+                },
+                focus: jest.fn(),
+            };
+            jest.spyOn(window, "open").mockReturnValue(
+                mockPopupWindow as unknown as Window
+            );
+
+            const popupWindow = popupClient.initiateAuthRequest(
+                "http://localhost/#/code=hello",
+                {
+                    popupName: "name",
+                    popupWindowAttributes: {},
+                    popupWindowParent: window,
+                }
+            );
+
+            expect(
+                (popupWindow as unknown as { document: { title: string } })
+                    .document.title
+            ).toBe("Microsoft Authentication");
+        });
+
         it("does not throw when setting document.title on cross-origin popup fails", () => {
             const mockPopupWindow = {
                 focus: jest.fn(),

lib/msal-browser/test/interaction_client/RedirectClient.spec.ts

@@ -247,6 +247,27 @@ describe("RedirectClient", () => {
                 });
         });
 
+        it("restores URL-based document.title when redirect URI page has no title element", (done) => {
+            document.title =
+                "https://localhost:3000/redirect#code=authCode123&state=abc";
+            browserStorage.setInteractionInProgress(true);
+
+            redirectClient
+                .handleRedirectPromise(
+                    testRequest,
+                    TEST_CONFIG.TEST_VERIFIER,
+                    rootMeasurement,
+                    { hash: "" }
+                )
+                .then(() => {
+                    // Restores to the URL-based title since that was the original value
+                    expect(document.title).toBe(
+                        "https://localhost:3000/redirect#code=authCode123&state=abc"
+                    );
+                    done();
+                });
+        });
+
         it("does nothing if no hash is detected", (done) => {
             browserStorage.setInteractionInProgress(true);
 

lib/msal-browser/test/redirect_bridge/broadcastResponseToMainFrame.spec.ts

@@ -145,6 +145,16 @@ describe("broadcastResponseToMainFrame", () => {
             expect(document.title).toBe("Microsoft Authentication");
         });
 
+        it("replaces URL-based document.title when redirect URI has no title set", async () => {
+            document.title =
+                "https://localhost:3000/redirect#code=testCode&state=testState";
+            window.location.hash = TEST_HASHES.TEST_SUCCESS_CODE_HASH_POPUP;
+
+            await broadcastResponseToMainFrame();
+
+            expect(document.title).toBe("Microsoft Authentication");
+        });
+
         it("broadcasts response for popup flow from hash", async () => {
             window.location.hash = TEST_HASHES.TEST_SUCCESS_CODE_HASH_POPUP;