fix: set document.title during authentication redirects#8624
Open
sameerag wants to merge 13 commits into
Open
Conversation
Set document.title to 'Microsoft Authentication' across all redirect scenarios (popup, iframe, redirect, and redirect bridge) to prevent the browser from displaying raw URLs as the page title. - Popup: set document.title after window.open (with cross-origin guard) - Hidden iframe: add title attribute for accessibility (WCAG H64) - Redirect bridge: set document.title at start of broadcastResponseToMainFrame - RedirectClient: set title during handleRedirectPromise, restore in finally Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add documentation advising app developers to set a meaningful <title> on their redirect bridge pages. Without an explicit title, browsers display the raw redirect URL (containing auth codes/tokens) as the tab title and history entry. - Added 'Page Title' section to redirect-bridge.md - Updated example HTML titles from 'Redirect' to 'Signing in' - Added title as item #5 in login-user.md redirect page requirements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- SilentHandler: verify iframe has title attribute set - PopupClient: verify popup document.title is set; verify cross-origin access failure does not throw - RedirectClient: verify title is restored after handleRedirectPromise completes (both with and without user-set title) - Redirect bridge: verify document.title is set during processing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Cover the scenario where document.title defaults to the raw redirect URL (browser behavior when no <title> element is set on the page). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
tnorling
previously approved these changes
Jun 2, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates msal-browser redirect-related flows (redirect bridge, popup, redirect handling, and silent iframe) to set a consistent document.title/iframe title (“Microsoft Authentication”) to avoid browser tabs/history showing raw auth URLs during processing, and adds unit tests + docs to explain recommended redirect-page titles.
Changes:
- Set
document.titleduring redirect-bridge processing andRedirectClient.handleRedirectPromise(with restore infinally). - Set popup window
document.titleafterwindow.open(guarded withtry/catch) and set hidden iframetitleattribute for accessibility. - Add/extend unit tests and documentation covering page title behavior and best practices.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| lib/msal-browser/src/redirect_bridge/index.ts | Sets document.title at the start of broadcastResponseToMainFrame. |
| lib/msal-browser/src/interaction_handler/SilentHandler.ts | Adds iframe title attribute for the hidden silent iframe. |
| lib/msal-browser/src/interaction_client/PopupClient.ts | Attempts to set popup window document.title after opening/focusing. |
| lib/msal-browser/src/interaction_client/RedirectClient.ts | Sets document.title during redirect handling and restores original in finally. |
| lib/msal-browser/test/redirect_bridge/broadcastResponseToMainFrame.spec.ts | Adds tests asserting document.title is set during redirect-bridge success paths. |
| lib/msal-browser/test/interaction_handler/SilentHandler.spec.ts | Adds test asserting hidden iframe has the expected title. |
| lib/msal-browser/test/interaction_client/PopupClient.spec.ts | Adds tests for popup title behavior and cross-origin safety. |
| lib/msal-browser/test/interaction_client/RedirectClient.spec.ts | Adds tests asserting document.title is restored after handleRedirectPromise. |
| lib/msal-browser/docs/redirect-bridge.md | Documents redirect-bridge page title recommendations and provides examples. |
| lib/msal-browser/docs/login-user.md | Adds redirect page <title> guidance to redirectUri considerations. |
| change/@azure-msal-browser-03263af0-8b31-4553-a492-03ffe5f4f204.json | Adds a patch changefile for the behavior change. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
peterzenz
previously approved these changes
Jun 2, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
peterzenz
previously approved these changes
Jun 2, 2026
tnorling
previously approved these changes
Jun 2, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Sets
document.titleto "Microsoft Authentication" across all redirect scenarios to prevent the browser from displaying raw URLs as the page title during authentication flows.Changes
SilentHandler.tstitleattribute for accessibility (WCAG H64)PopupClient.tsdocument.titleafterwindow.open(with cross-origin try/catch)redirect_bridge/index.tsdocument.titleat start ofbroadcastResponseToMainFrameRedirectClient.tshandleRedirectPromise, restore original infinallyMotivation
When a user is redirected back to the application after authentication, the browser displays the raw URL (containing auth response parameters) as the document title. This is: