HttpInterceptor not adding Accesstoken when an XMLHttpRequest is send

[rfcdejong]

Library

• [x ] [email protected] or @azure/[email protected]
• @azure/[email protected]
• @azure/[email protected]
• @azure/[email protected]
• @azure/[email protected]

Framework

Angular 9

Description

My project has migrated from asp.net core cookie authentication to MSAL client side in Angular. Calling my api from angular the interceptor is adding the user his accesstoken as header, this works fine in almost all situations. Except while using ngx-uploader. The api response is 401 unauthorized.

Looking at the source code of ngx-uploader it is using XMLHttpRequest to call an api. My conclusing is that the HttpInterceptor is not adding the accesstoken in here.

Error Message

Security

• Is this issue security related?

Regression

• Did this behavior work before?
  Version:

MSAL Configuration

// Provide configuration values here.
// For Azure B2C issues, please include your policies.

Reproduction steps

// Provide relevant code snippets here.
// For Azure B2C issues, please include your policies.

Expected behavior

Accesstoken is added as header automaticly, just like other Http calls.

Browsers/Environment

• [x ] Chrome
• Firefox
• Edge
• Safari
• IE
• Other (Please add browser name here)

[rfcdejong]

I'm not sure if this can be resolved looking at bleenco/ngx-uploader#495

[rfcdejong]

Closed because I believe Angular doesn't support intercepting XMLHttpRequest, so this cannot be done automatically

I resolved this manually by using the follow code when calling ngx-uploader

const scopes = this.auth.getScopesForEndpoint(environment.apiUrl);
this.auth.getLogger().verbose("Url: " + environment.apiUrl + " maps to scopes: " + scopes);

let token: string;
this.auth.acquireTokenSilent({ scopes })
    .then((response: AuthResponse) => {
        token = response.tokenType === ServerHashParamKeys.ID_TOKEN ? response.idToken.rawIdToken : response.accessToken;
        this.authHeader = { Authorization: `bearer ${token}` };               
    })