Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: window.open("about:blank") replaces the preview page, which breaks MSAL login and its redirect fallback

Aperta Adatta ai principianti
  • Qualcosa non va?
#14,452 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
electron, typescript
Ambito
authentication, desktop

Direzione di ricerca

Inizia da apps/desktop/src/preview/Manager.ts, leggendo isPopupUrl, previewWindowOpenAction e setWindowOpenHandler nel percorso di attach dell’anteprima. Riproduci il caso window.open con about:blank, quindi verifica che gli URL non-popup negati non vengano più caricati nell’anteprima e che la pagina originale rimanga disponibile per il fallback di redirect.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug via-triage
Before submitting
  • I searched existing issues and did not find a duplicate.
  • I included enough detail to reproduce or investigate the problem.
Area

apps/desktop

Steps to reproduce

  1. Open any page in a preview tab, for example http://localhost:3000/.

  2. Run this in the page, for example from a click handler:

    const w = window.open('about:blank', 'popup', 'width=483,height=600')
console.log(w) // null

  3. The call returns null, and then the preview tab navigates to about:blank. The original page is gone.

This is how @azure/msal-browser opens its popup. With the default asyncPopups: false, loginPopup() and acquireTokenPopup() call window.open("about:blank", …) synchronously in the click handler, then set the popup's URL (PopupClient.openSizedPopup). Other SDKs pre-open a blank popup this way to keep the user gesture.

Expected behavior

If the preview won't open a real window for about:blank, it should deny the call without navigating the preview tab. window.open then returns null and the page stays as it was, which is what a normal popup blocker does. SDKs detect this case and fall back: MSAL throws popup_window_error, and apps typically call loginRedirect() next.

Actual behavior

The call is denied and the preview tab loads about:blank. MSAL throws popup_window_error, and the app's loginRedirect() fallback runs from a page that is already being replaced. The tab stays blank, with no Microsoft sign-in. Reading sessionStorage on that page then throws SecurityError: Access is denied for this document.

Cause, in apps/desktop/src/preview/Manager.ts on main (c2fa9fc911):

  • isPopupUrl deliberately excludes about:blank, for the contextIsolation reason in its comment. So previewWindowOpenAction returns "navigate" for this new-window request.
  • The setWindowOpenHandler in the preview attach path handles "navigate" with wc.loadURL(details.url) and returns { action: "deny" }. For about:blank, this loads a blank page over the opener.

Loading about:blank into the opener never helps. A possible fix: when the URL isn't a popup URL, for example about:blank or "", return { action: "deny" } without calling loadURL. The page then gets a plain blocked popup and can use its own fallback.

Related: #6561 / #8435 (OAuth popups for http(s) URLs) and #13953 (target="_blank" loads in place). The new-tab fix planned for #13953 covers http(s) tab dispositions, not this about:blank new-window case.

Impact

Blocks work completely

Version or commit

T3Code(Nightly)/0.0.44-nightly.20260929.2456 (Electron 44.4.2, Chrome 152.0.7977.130)

Environment

Ubuntu 26.04.1 LTS, Linux 7.0.0-34-generic

Logs or stack traces
[auth] loginPopup failed, trying loginRedirect BrowserAuthError: popup_window_error: Error opening popup window. This can happen if you are using IE or if popups are blocked in the browser.
    at createBrowserAuthError (...)
    at PopupClient.openPopup (...)
    at PopupClient.initiateAuthRequest (...)
Workaround

Two app-side options:

  • In the page, replace window.open with a stub that returns null without calling the native handler. The redirect fallback then works: we confirmed a full sign-in through Microsoft this way.
  • Detect Electron/ in the user agent and call loginRedirect() directly, without trying the popup.
Lingua principale
TypeScript
Stelle
24k
Fork
6.3k
Merge medio
10h 20m
PR unite (30g)
309

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pingdotgg/t3code

Tutte le issue di pingdotgg/t3code

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.