@microsoft/sp-http-base

sp-http-base

This package defines the communication layer for the SharePoint Framework to communicate with SharePoint and 3-party AAD applications.

This package is part of the SharePoint Framework, which is a collection of NPM packages that empower developers to create client-side experiences for Microsoft SharePoint. For more information, including complete API documentation and code samples, please visit the SharePoint Framework web site.

EAR bootstrap for external MSAL

With APEXEnableEarClientSide (62349, isProcessEarCookieClientSideEnabled()), the cached and async providers import a valid, unprocessed EAR cookie before the requesting normal PCA or pairwise broker host's (pwBroker) first initialize(). The manager shares one bootstrap promise and only exposes the client after initialization, redirect handling and account setup. Broker hosts retain their actAsBroker and popup configuration, and bootstrap awaits their full initialization before redirect handling. This lets first initialization hydrate persisted records without relying on MSAL's asynchronous cache broadcasts. It does not synchronize PCAs owned by other applications.

The owning EAR flight selects pre-initialization import for normal and broker-host clients with either localStorage or sessionStorage, without an exact runtime-version check. Import failures fall back to account lookup and Graph SSO after normal initialization. With the EAR flight off, the previous initialization, redirect, failure logging and Graph SSO behavior is unchanged. NAA and pairwise broker children never import EAR before or after broker readiness. Their factories, broker handshake, trust configuration and authentication routing remain unchanged. Pairwise children retain their early skip-ensureState return while isSkipEnsureStateForPwBrokeeKSActivated() is false; the active kill switch still reaches the existing account/SSO path, without an EAR import. Bundled MSAL and legacy MSAL are unchanged. No dependency upgrade or new flight is required.

Each external chunk owns its EAR preparation, finalization, cookie decoding and expiration marker storage. Its manager owns the shared normal/broker-host initialization and redirect lifecycle, including startup failure logging. The EAR module does not initialize clients or handle redirects. The manager's existing promise map owns client readiness without a separate EAR-client set. Providers pass an explicit { aadUserId, aadTenantId } object through a Pick<IAadTokenProviderConfiguration, 'aadUserId' | 'aadTenantId'> contract, rather than callbacks or unrelated provider settings. Those fields bind the expected SharePoint user and tenant; MSAL configuration does not supply the expected user. The importer gets authority, cache and telemetry options from the client's normalized getConfiguration(). It clones that configuration and its telemetry options, omitting only telemetry.client. That instance-bound telemetry client depends on the requesting PCA's uninitialized cache; omitting the property lets the standalone importer create its own. Other normalized options and the requesting PCA's configuration remain intact.

Bootstrap skips missing, expired, malformed, wrong-user and already/newer-processed cookies. Failed or null imports do not mark the cookie processed. The provider reuses _ensureMsalClientIsInitialized() before its normal account lookup and Graph SSO fallback; it never retries the import into an initialized PCA. Request telemetry stays with the existing initialization helper, and direct ensure-state calls do not fabricate a request context. EAR finalization failures, including failure of both localStorage and sessionStorage marker writes, log an EAR failure without rejecting the ready client or clearing a valid account. Genuine initialization and redirect failures on the EAR path still reject the shared promise. Redirect results and existing active accounts are not replaced by an older EAR.

The processed marker is shared by tabs on the same origin. One tab can await initialization or redirect handling for expiration E1 while another tab imports a refreshed cookie E2 and writes its marker. Finalization rechecks the marker before activating E1 or writing its expiration, so it does not replace E2. This does not assume that different SharePoint tenant origins share localStorage.

For B2B users, the importer may return a home-tenant base account while the configured user ID identifies a resource-tenant guest. Bootstrap validates the hydrated account using MSAL's tenant-aware lookup, bound to the imported home account ID, configured resource tenant and guest user ID, before activating the account or recording the processed expiration.

Run targeted validation with RUSH_BUILD_CACHE_ENABLED=0 RUSH_BUILD_CACHE_WRITE_ALLOWED=0 rush --quiet retest -o @microsoft/sp-http-base --include-phase-deps --test-path-pattern=msalV3.MsalBrowser --fstrace-mode disabled. The EAR bootstrap tests exercise both external chunks through provider construction and public token requests, including first-initialize-only cache hydration with no broadcasts, both storage modes, concurrency, skip/failure paths and rollback order. NAA and pairwise-child fixtures simulate broker readiness; they are not live Teams-web validation or evidence that Teams lacks an EAR cookie. Existing EncryptedAuthorizationResponse, EnsureState, SsoSilent and initialization/redirect QoS events remain the rollout signals; EAR cookie decoding failures log only a fixed failure code.