Add token binding to MicrosoftIdentityMessageHandler by cpp11nullptr · Pull Request #3743 · AzureAD/microsoft-identity-web

cpp11nullptr · 2026-03-04T17:20:37Z

No description provided.

…andler-with-token-binding

jmprieur

There are a couple of things to improve:

the RequiredService seems inconsistent with the option. Either use GetService or explain why required is fine. I think it's a breaking change, personally. you don't want to break Aspire!!
Fragile code that can be improved
+some questions/remarks

bgavrilMS · 2026-03-05T17:42:26Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

tlupes · 2026-03-05T22:04:52Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

It looks very similar to how DownstreamApi works, which means it should be easy to transfer over. Centralizing the logic would make things easier.

…oken-binding' of https://github.com/AzureAD/microsoft-identity-web into iepoly/extend-microsoft-identity-message-handler-with-token-binding

…soft-identity-message-handler-with-token-binding

cpp11nullptr · 2026-03-23T15:49:29Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

It looks very similar to how DownstreamApi works, which means it should be easy to transfer over. Centralizing the logic would make things easier.

(replied in other comment)

jmprieur

LGTM
I left a few comments worth looking at.

jmprieur

Thanks for addressing the feedback

bgavrilMS · 2026-03-26T10:18:48Z

-                    UserFlow = originalOptions.AcquireTokenOptions.UserFlow
-                };
+                challengeOptions.AcquireTokenOptions.Claims = challengeClaims;
+                challengeOptions.AcquireTokenOptions.ForceRefresh = true;


This isn't needed. MSAL would do the right thing. Functioanlly it's ok, except that some telemetry will go haywire.

Pinned [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) at 4.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.8.0 ## What's Changed * Bump flatted from 3.3.3 to 3.4.2 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3753 * Update changelog.md for ID.Web 4.6.0 by @bgavrilMS in AzureAD/microsoft-identity-web#3756 * Add token binding to MicrosoftIdentityMessageHandler by @cpp11nullptr in AzureAD/microsoft-identity-web#3743 * Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3759 * Documentation: Clarify managed identity credential types for containerized vs. VM/App Service deployments by @Copilot in AzureAD/microsoft-identity-web#3585 * Bump path-to-regexp from 8.3.0 to 8.4.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3762 * Upgrade Microsoft Application Insights packages by @RojaEnnam in AzureAD/microsoft-identity-web#3763 * Use Abstractions 12 by @pmaytak in AzureAD/microsoft-identity-web#3761 * Post-4.7.0 by @pmaytak in AzureAD/microsoft-identity-web#3768 * Fix Comp Gov DOTNET-Security-10.0 by @reginayap8 in AzureAD/microsoft-identity-web#3769 * Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by @reginayap8 in AzureAD/microsoft-identity-web#3770 * fix warnings by @gladjohn in AzureAD/microsoft-identity-web#3771 * adding examples for using postgres as a distributed cache by @JaredMSFT in AzureAD/microsoft-identity-web#3766 * Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility test app by @Copilot in AzureAD/microsoft-identity-web#3774 * Bump vite from 7.1.11 to 7.3.2 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3772 * Skip legacy B2C local-account Todo UI test in WebAppUiTests by @Copilot in AzureAD/microsoft-identity-web#3778 * Fix initialization of ConfidentialClientApplicationOptions in MergedOptions by @cpp11nullptr in AzureAD/microsoft-identity-web#3760 * Bump net8/net9/net10 runtime package baselines to patched crypto servicing versions by @Copilot in AzureAD/microsoft-identity-web#3779 * Fix flaky certificate test failures on CI by @gladjohn in AzureAD/microsoft-identity-web#3780 * MTLS Without Tokens Support by @tlupes in AzureAD/microsoft-identity-web#3747 * Fix CredentialsProvider DI lifetime mismatch causing startup crash in Development by @Avery-Dunn in AzureAD/microsoft-identity-web#3783 * Remove unused DataProtection configuration from Sidecar by @Copilot in AzureAD/microsoft-identity-web#3776 ## New Contributors * @RojaEnnam made their first contribution in AzureAD/microsoft-identity-web#3763 * @reginayap8 made their first contribution in AzureAD/microsoft-identity-web#3769 * @JaredMSFT made their first contribution in AzureAD/microsoft-identity-web#3766 **Full Changelog**: AzureAD/microsoft-identity-web@4.6.0...4.8.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.7.0...4.8.0). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Add token binding to MicrosoftIdentityMessageHandler

8be50c8

cpp11nullptr requested a review from a team as a code owner March 4, 2026 17:20

Merge branch 'master' into iepoly/extend-microsoft-identity-message-h…

b0c1184

…andler-with-token-binding

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs Outdated

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs Outdated

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

bgavrilMS approved these changes Mar 5, 2026

View reviewed changes

jmprieur reviewed Mar 5, 2026

View reviewed changes

Comment thread docs/calling-downstream-apis/custom-apis.md Outdated

jmprieur requested changes Mar 5, 2026

View reviewed changes

tlupes reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Zhenya Polyvanyi added 3 commits March 23, 2026 15:44

Commit changes after code review comments

7d2a3cd

Merge branch 'iepoly/extend-microsoft-identity-message-handler-with-t…

0a072f6

…oken-binding' of https://github.com/AzureAD/microsoft-identity-web into iepoly/extend-microsoft-identity-message-handler-with-token-binding

Merge remote-tracking branch 'origin/master' into iepoly/extend-micro…

6185747

…soft-identity-message-handler-with-token-binding

cpp11nullptr requested a review from a team as a code owner March 23, 2026 15:45

bgavrilMS requested review from gladjohn and jmprieur March 25, 2026 15:23

jmprieur approved these changes Mar 25, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Comment thread tests/DevApps/MtlsPop/MtlsPopClient/Program.cs

Refactor CreateDownstreamApiOptions helper method

5ee9150

jmprieur approved these changes Mar 25, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

cpp11nullptr merged commit 231b092 into master Mar 25, 2026
4 checks passed

cpp11nullptr deleted the iepoly/extend-microsoft-identity-message-handler-with-token-binding branch March 25, 2026 22:22

bgavrilMS reviewed Mar 26, 2026

View reviewed changes

Avery-Dunn mentioned this pull request Apr 20, 2026

Post-4.8.0 release updates #3784

Merged

Conversation

cpp11nullptr commented Mar 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bgavrilMS commented Mar 5, 2026

Uh oh!

Uh oh!

tlupes commented Mar 5, 2026

Uh oh!

cpp11nullptr commented Mar 23, 2026

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bgavrilMS Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants