AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
https://stackoverflow.com/questions/tagged/azure-ad-msal+python
Other
757 stars 192 forks source link

MSAL shows gibberish if `localhost` is accessed using HTTPS #546

Closed jiasli closed 6 months ago

jiasli commented 1 year ago

Describe the bug MSAL shows gibberish (mojibake) if localhost is accessed using HTTPS.

To Reproduce Run

az login --debug

The login URL is

https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?...redirect_uri=http%3A%2F%2Flocalhost%3A61886...

Even though redirect_uri is an HTTP URL http://localhost:61886/, we switch the protocol to HTTPS https://localhost:61886/ and visit it in the browser. In the real world, the protocol may be changed by the browser's policy (https://github.com/Azure/azure-cli/issues/10426#issuecomment-528308713).

Then the browser will show ERR_SSL_PROTOCOL_ERROR:

image

In the terminal, MSAL shows gibberish characters because these are actually HTTPS-encrypted binary stream.

msal.oauth2cli.authcode: code 400, message Bad request version ('\x08\x9e\x87\x95]ÈeÏ9íÏ\x82\x8aUÇÑ~\x03\x91W\x00')
msal.oauth2cli.authcode: "▬♥☺☻☺☺ü♥♥_↨Ò1ع6ÙÍß
«#p◄Á03ó#åy¦ð+Í }ºR;2þì7fâÅD¶apIè▼þµ*áÓ!V]-"ªª‼☺‼☻‼☻‼♥À+À/À,À0̨̩À‼À¶/5☺☺ZZÿ☺☺-☻☺☺♥☻☻
                                                                                      i♣♥☻h2
↕►♦♦♦☺♣♣♣♠♠☺↨+♠**♥♦♥♥
☻☺►
☻hhttp/1.13+)☺↔ ZMÁ7ðó►ã_·]ÈeÏ9íÏUÇÑ~♥W" 400 -
msal.oauth2cli.authcode: code 400, message Bad request version ('\x02h2\x08http/1.1\x00')
msal.oauth2cli.authcode: "▬♥☺☻☺☺ü♥♥ݶ5ã{ï£V♠ò_Ã♥

This issue is reported by https://github.com/Azure/azure-cli/issues/25935, and the solution is https://github.com/Azure/azure-cli/issues/10426#issuecomment-528308713.

Expected behavior MSAL can consider capturing such error and warn the user incorrect protocol is used. I haven't deep dived into the implementation of http.server yet, but it is totally possible that this can't be achieved by MSAL.

jiasli commented 1 year ago

My computer's locale setting:

image

rayluo commented 1 year ago

Honestly not sure when we will get around to this. Marking it as an enhancement request, for now. :-)