search

wrobins / cordova-plugin-msal

Use the newest Microsoft MSAL library in your Cordova-based project!
Apache License 2.0
23 stars 63 forks source link

Query on "cordova-plugin-msal" Key Hash Logic #110

Open weijiji opened 11 months ago

weijiji commented 11 months ago

Dear Walter Robins,

I came across your "cordova-plugin-msal" project on OutSystems and noticed a recent change you made, removing CLIENT_ID and TENANT_ID from the preferences. This is a great improvement that allows developers to have more flexibility in configuration. However, I also noticed that you still kept the logic to retrieve KEY_HASH from the preferences. I was curious if there is a specific reason for retaining this logic. Would it be possible to consider passing KEY_HASH as a parameter during the MsalInit phase? Would passing KEY_HASH during the MsalInit phase potentially introduce any bugs? For instance, in OutSystems, if multiple apps reference the same "cordova-plugin-msal," but with different CLIENT_ID, TENANT_ID, and KEY_HASH values, would this result in any bugs?

Thank you for your time and I appreciate your insights on this matter!

peitschie commented 11 months ago

Hi @weijiji

I'm simply an interested bystander, but I think I can answer your question.

The KEY_HASH is needed at app compile time as an exported intent-filter is needed on Android to receive the response from the Azure B2C login workflow: https://github.com/wrobins/cordova-plugin-msal/blob/master/plugin.xml#L40-L43

In summary, I don't believe what you're asking for is possible.

However, the KEY_HASH here refers to the signing key you used to build the application, so it won't ever change unless you recompile the application with a completely different signing key. Unlike the CLIENT_ID and TENANT_ID, it's impossible for this to change at runtime, as it's always constant for that particular application package.