Disable ServerTelemetryManager by default

change/@azure-msal-browser-0c5b4f43-6dec-40eb-8a4d-60a63666c744.json

@@ -0,0 +1,7 @@
+{
+  "type": "minor",
+  "comment": "Disable ServerTelemetryManager by default [#8600](https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8600)",
+  "packageName": "@azure/msal-browser",
+  "email": "thomas.norling@microsoft.com",
+  "dependentChangeType": "patch"
+}

change/@azure-msal-common-ac7e7225-f5ff-4376-a86b-b6989215c195.json

@@ -0,0 +1,7 @@
+{
+  "type": "minor",
+  "comment": "Disable ServerTelemetryManager by default [#8600](https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8600)",
+  "packageName": "@azure/msal-common",
+  "email": "thomas.norling@microsoft.com",
+  "dependentChangeType": "patch"
+}

lib/msal-browser/apiReview/msal-browser.api.md

@@ -411,6 +411,7 @@ export type BrowserSystemOptions = SystemOptions & {
     allowPlatformBroker?: boolean;
     nativeBrokerHandshakeTimeout?: number;
     protocolMode?: ProtocolMode;
+    serverTelemetryEnabled?: boolean;
 };
 
 // Warning: (ae-missing-release-tag) "BrowserTelemetryOptions" is part of the package's API, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1542,8 +1543,8 @@ export type WrapperSKU = (typeof WrapperSKU)[keyof typeof WrapperSKU];
 // src/cache/LocalStorage.ts:366:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
 // src/cache/LocalStorage.ts:429:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
 // src/cache/LocalStorage.ts:460:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
-// src/config/Configuration.ts:217:5 - (ae-incompatible-release-tags) The symbol "experimental" is marked as @public, but its signature references "BrowserExperimentalOptions" which is marked as @internal
-// src/config/Configuration.ts:226:5 - (ae-forgotten-export) The symbol "InternalAuthOptions" needs to be exported by the entry point index.d.ts
+// src/config/Configuration.ts:222:5 - (ae-incompatible-release-tags) The symbol "experimental" is marked as @public, but its signature references "BrowserExperimentalOptions" which is marked as @internal
+// src/config/Configuration.ts:231:5 - (ae-forgotten-export) The symbol "InternalAuthOptions" needs to be exported by the entry point index.d.ts
 // src/event/EventHandler.ts:116:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
 // src/event/EventHandler.ts:143:8 - (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
 // src/index.ts:8:12 - (tsdoc-characters-after-block-tag) The token "@azure" looks like a TSDoc tag but contains an invalid character "/"; if it is not a tag, use a backslash to escape the "@"

lib/msal-browser/docs/configuration.md

@@ -53,7 +53,8 @@ const msalConfig = {
         windowHashTimeout: 60000,
         iframeHashTimeout: 6000,
         loadFrameTimeout: 0,
-        protocolMode: "AAD"
+        protocolMode: "AAD",
+        serverTelemetryEnabled: false,
     },
     telemetry: {
         application: {
@@ -104,7 +105,8 @@ See [Caching in MSAL](./caching.md) for more.
 | `cryptoOptions`            | Config object for crypto operations in the browser.                                                                                                                                                                                                                                                           | See [below](#crypto-config-options.) | See [below](#crypto-config-options.)             |
 | `popupBridgeTimeout`       | Timeout in milliseconds to wait for the popup to send its response via BroadcastChannel. If the user closes the popup without completing authentication, `loginPopup` or `acquireTokenPopup` will reject with a `timed_out` error after this timeout. See [Popup closure detection](./login-user.md#popup-closure-detection-and-interactionstatus). | integer (milliseconds) | `60000` |
 | `iframeBridgeTimeout`      | Timeout in milliseconds to wait for a hidden iframe to send its response via BroadcastChannel during silent token acquisition (`ssoSilent`, `acquireTokenSilent`). If the iframe does not respond within this time, the call will reject with a `timed_out` error. | integer (milliseconds) | `10000` |
-| `protocolMode`               | Enum representing the protocol mode to use. If `"AAD"`, will function on the OIDC-compliant AAD v2 endpoints; if `"OIDC"`, will function on other OIDC-compliant endpoints.   
+| `protocolMode`             | Enum representing the protocol mode to use. If `"AAD"`, will function on the OIDC-compliant AAD v2 endpoints; if `"OIDC"`, will function on other OIDC-compliant endpoints.                                                                                                                             | string                               | `"AAD"`                                          |
+| `serverTelemetryEnabled`   | Enables MSER server telemetry headers and browser cache writes for failed requests. When `false`, MSAL does not send MSER headers and does not persist server telemetry data to browser storage. This option is deprecated and will be removed in a future release.                                         | boolean                              | `false`                                            |
 
 #### Logger Config Options
 

lib/msal-browser/src/config/Configuration.ts

@@ -167,6 +167,11 @@ export type BrowserSystemOptions = SystemOptions & {
      * Enum that represents the protocol that msal follows. Used for configuring proper endpoints.
      */
     protocolMode?: ProtocolMode;
+    /**
+     * @deprecated This option will be removed in a future release.
+     * Flag to enable emitting telemetry to the STS. When disabled, failed requests are not cached to browser storage and x-client-current-telemetry, x-client-last-telemetry parameters are not sent to the STS. Defaults to false.
+     */
+    serverTelemetryEnabled?: boolean;
 };
 
 /** @internal */
@@ -315,6 +320,7 @@ export function buildConfiguration(
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,
         protocolMode: ProtocolMode.AAD,
+        serverTelemetryEnabled: false,
     };
 
     const providedSystemOptions: Required<BrowserSystemOptions> = {

lib/msal-browser/src/interaction_client/BaseInteractionClient.ts

@@ -10,6 +10,7 @@ import {
     AccountInfo,
     UrlString,
     ServerTelemetryManager,
+    StubServerTelemetryManager,
     ServerTelemetryRequest,
     createClientConfigurationError,
     ClientConfigurationErrorCodes,
@@ -108,6 +109,7 @@ export function getRedirectUri(
  * @param browserStorage - Browser cache manager instance for storing telemetry data
  * @param logger - Optional logger instance for verbose logging
  * @param forceRefresh - Optional flag to force refresh of telemetry data
+ * @param enabled - Optional flag to enable or disable server telemetry (default: true for custom_auth flows, false for standard flows)
  * @returns Configured ServerTelemetryManager instance
  */
 export function initializeServerTelemetryManager(
@@ -116,9 +118,18 @@ export function initializeServerTelemetryManager(
     correlationId: string,
     browserStorage: BrowserCacheManager,
     logger: Logger,
-    forceRefresh?: boolean
+    forceRefresh?: boolean,
+    enabled: boolean = true
 ): ServerTelemetryManager {
     logger.verbose("initializeServerTelemetryManager called", correlationId);
+    if (!enabled) {
+        logger.verbose(
+            "Server telemetry is disabled in configuration. Skipping telemetry manager initialization.",
+            correlationId
+        );
+        return new StubServerTelemetryManager();
+    }
+
     const telemetryPayload: ServerTelemetryRequest = {
         clientId: clientId,
         correlationId: correlationId,

lib/msal-browser/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -177,7 +177,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -369,7 +371,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                     this.config.auth.clientId,
                     this.correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 );
                 serverTelemetryManager.setNativeBrokerErrorCode(e.errorCode);
                 if (isFatalNativeAuthError(e)) {
@@ -472,7 +476,9 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             );
             serverTelemetryManager.clearNativeBrokerErrorCode();
             this.performanceClient?.addFields(

lib/msal-browser/src/interaction_client/PopupClient.ts

@@ -298,7 +298,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkce =
@@ -533,7 +535,9 @@ export class PopupClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -699,7 +703,9 @@ export class PopupClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

lib/msal-browser/src/interaction_client/RedirectClient.ts

@@ -197,7 +197,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const pkceCodes = await invokeAsync(
@@ -414,7 +416,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const navigateToLoginRequestUrl =
@@ -815,7 +819,9 @@ export class RedirectClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

lib/msal-browser/src/interaction_client/SilentAuthCodeClient.ts

@@ -104,7 +104,9 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {

lib/msal-browser/src/interaction_client/SilentCacheClient.ts

@@ -36,7 +36,9 @@ export class SilentCacheClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const clientConfig = await invokeAsync(

lib/msal-browser/src/interaction_client/SilentIframeClient.ts

@@ -171,7 +171,9 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         try {
@@ -342,7 +344,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                     this.config.auth.clientId,
                     correlationId,
                     this.browserStorage,
-                    this.logger
+                    this.logger,
+                    undefined,
+                    this.config.system.serverTelemetryEnabled
                 ),
                 requestAuthority: request.authority,
                 requestAzureCloudOptions: request.azureCloudOptions,
@@ -436,7 +440,9 @@ export class SilentIframeClient extends StandardInteractionClient {
                 this.config.auth.clientId,
                 this.correlationId,
                 this.browserStorage,
-                this.logger
+                this.logger,
+                undefined,
+                this.config.system.serverTelemetryEnabled
             ),
             requestAuthority: silentRequest.authority,
             requestAzureCloudOptions: silentRequest.azureCloudOptions,

lib/msal-browser/src/interaction_client/SilentRefreshClient.ts

@@ -68,7 +68,9 @@ export class SilentRefreshClient extends StandardInteractionClient {
             this.config.auth.clientId,
             this.correlationId,
             this.browserStorage,
-            this.logger
+            this.logger,
+            undefined,
+            this.config.system.serverTelemetryEnabled
         );
 
         const refreshTokenClient = await this.createRefreshTokenClient({

lib/msal-browser/test/app/PublicClientApplication.spec.ts

@@ -5757,6 +5757,9 @@ describe("PublicClientApplication.ts Class Unit Tests", () => {
         });
 
         it("throws error that SilentFlowClient.acquireToken() throws", async () => {
+            // Enable server telemetry so cacheFailedRequest writes to storage
+            //@ts-ignore
+            pca.config.system.serverTelemetryEnabled = true;
             const testError: AuthError = new AuthError(
                 "create_login_url_error",
                 "Error in creating a login url"
@@ -5800,6 +5803,9 @@ describe("PublicClientApplication.ts Class Unit Tests", () => {
         });
 
         it("throws error that SilentFlowClient.acquireToken() throws when making parallel requests", async () => {
+            // Enable server telemetry so cacheFailedRequest writes to storage
+            //@ts-ignore
+            pca.config.system.serverTelemetryEnabled = true;
             const testError: AuthError = new AuthError(
                 "create_login_url_error",
                 "Error in creating a login url"

lib/msal-browser/test/config/Configuration.spec.ts

@@ -71,6 +71,25 @@ describe("Configuration.ts Class Unit Tests", () => {
         expect(emptyConfig.system?.allowPlatformBroker).toBe(false);
     });
 
+    it("serverTelemetryEnabled defaults to false", () => {
+        const config = buildConfiguration(
+            { auth: { clientId: TEST_CONFIG.MSAL_CLIENT_ID } },
+            true
+        );
+        expect(config.system.serverTelemetryEnabled).toBe(false);
+    });
+
+    it("sets serverTelemetryEnabled to passed in true value", () => {
+        const config = buildConfiguration(
+            {
+                auth: { clientId: TEST_CONFIG.MSAL_CLIENT_ID },
+                system: { serverTelemetryEnabled: true },
+            },
+            true
+        );
+        expect(config.system.serverTelemetryEnabled).toBe(true);
+    });
+
     it("sets allowPlatformBroker to passed in true value", () => {
         const config: Configuration = buildConfiguration(
             {

lib/msal-browser/test/interaction_client/PlatformAuthInteractionClient.spec.ts

@@ -1110,6 +1110,10 @@ describe("PlatformAuthInteractionClient Tests", () => {
         });
 
         it("does not set native broker error to server telemetry", async () => {
+            // Enable server telemetry so telemetry data is written to storage
+            //@ts-ignore
+            platformAuthInteractionClient.config.system.serverTelemetryEnabled =
+                true;
             jest.spyOn(
                 PlatformAuthExtensionHandler.prototype,
                 "sendMessage"
@@ -1134,6 +1138,10 @@ describe("PlatformAuthInteractionClient Tests", () => {
         });
 
         it("sets native broker error to server telemetry", async () => {
+            // Enable server telemetry so telemetry data is written to storage
+            //@ts-ignore
+            platformAuthInteractionClient.config.system.serverTelemetryEnabled =
+                true;
             jest.spyOn(
                 PlatformAuthExtensionHandler.prototype,
                 "sendMessage"
@@ -1162,6 +1170,10 @@ describe("PlatformAuthInteractionClient Tests", () => {
         });
 
         it("resets native broker error in server telemetry", async () => {
+            // Enable server telemetry so telemetry data is written to storage
+            //@ts-ignore
+            platformAuthInteractionClient.config.system.serverTelemetryEnabled =
+                true;
             const sendMessageStub = jest
                 .spyOn(PlatformAuthExtensionHandler.prototype, "sendMessage")
                 .mockImplementation();
@@ -1423,6 +1435,10 @@ describe("PlatformAuthInteractionClient Tests", () => {
         });
 
         it("sets native broker error to server telemetry", (done) => {
+            // Enable server telemetry so telemetry data is written to storage
+            //@ts-ignore
+            platformAuthInteractionClient.config.system.serverTelemetryEnabled =
+                true;
             jest.spyOn(
                 NavigationClient.prototype,
                 "navigateExternal"
@@ -1458,6 +1474,10 @@ describe("PlatformAuthInteractionClient Tests", () => {
         });
 
         it("resets native broker error in server telemetry", async () => {
+            // Enable server telemetry so telemetry data is written to storage
+            //@ts-ignore
+            platformAuthInteractionClient.config.system.serverTelemetryEnabled =
+                true;
             jest.spyOn(
                 NavigationClient.prototype,
                 "navigateExternal"

lib/msal-browser/test/interaction_client/PopupClient.spec.ts

@@ -867,6 +867,9 @@ describe("PopupClient", () => {
         });
 
         it("catches error and cleans cache before rethrowing", async () => {
+            // Enable server telemetry so cacheFailedRequest writes to storage
+            //@ts-ignore
+            popupClient.config.system.serverTelemetryEnabled = true;
             const testError: AuthError = new AuthError(
                 "create_login_url_error",
                 "Error in creating a login url"
@@ -1136,6 +1139,9 @@ describe("PopupClient", () => {
         });
 
         it("catches error and cleans cache before rethrowing", async () => {
+            // Enable server telemetry so cacheFailedRequest writes to storage
+            //@ts-ignore
+            popupClient.config.system.serverTelemetryEnabled = true;
             const testError: AuthError = new AuthError(
                 "create_logout_url_error",
                 "Error in creating a logout url"