Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug]: window.open("about:blank") replaces the preview page, which breaks MSAL login and its redirect fallback

Open Beginner friendly
  • Is something wrong?
#14,452 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
electron, typescript
Domain
authentication, desktop

Research direction

Start in apps/desktop/src/preview/Manager.ts, reading isPopupUrl, previewWindowOpenAction, and the preview attach path's setWindowOpenHandler. Reproduce the about:blank window.open case, then verify that denied non-popup URLs no longer load into the preview and that the original page remains available for the redirect fallback.

Written by the indexing model from the issue text.

Description

bug via-triage
Before submitting
  • I searched existing issues and did not find a duplicate.
  • I included enough detail to reproduce or investigate the problem.
Area

apps/desktop

Steps to reproduce

  1. Open any page in a preview tab, for example http://localhost:3000/.

  2. Run this in the page, for example from a click handler:

    const w = window.open('about:blank', 'popup', 'width=483,height=600')
console.log(w) // null

  3. The call returns null, and then the preview tab navigates to about:blank. The original page is gone.

This is how @azure/msal-browser opens its popup. With the default asyncPopups: false, loginPopup() and acquireTokenPopup() call window.open("about:blank", …) synchronously in the click handler, then set the popup's URL (PopupClient.openSizedPopup). Other SDKs pre-open a blank popup this way to keep the user gesture.

Expected behavior

If the preview won't open a real window for about:blank, it should deny the call without navigating the preview tab. window.open then returns null and the page stays as it was, which is what a normal popup blocker does. SDKs detect this case and fall back: MSAL throws popup_window_error, and apps typically call loginRedirect() next.

Actual behavior

The call is denied and the preview tab loads about:blank. MSAL throws popup_window_error, and the app's loginRedirect() fallback runs from a page that is already being replaced. The tab stays blank, with no Microsoft sign-in. Reading sessionStorage on that page then throws SecurityError: Access is denied for this document.

Cause, in apps/desktop/src/preview/Manager.ts on main (c2fa9fc911):

  • isPopupUrl deliberately excludes about:blank, for the contextIsolation reason in its comment. So previewWindowOpenAction returns "navigate" for this new-window request.
  • The setWindowOpenHandler in the preview attach path handles "navigate" with wc.loadURL(details.url) and returns { action: "deny" }. For about:blank, this loads a blank page over the opener.

Loading about:blank into the opener never helps. A possible fix: when the URL isn't a popup URL, for example about:blank or "", return { action: "deny" } without calling loadURL. The page then gets a plain blocked popup and can use its own fallback.

Related: #6561 / #8435 (OAuth popups for http(s) URLs) and #13953 (target="_blank" loads in place). The new-tab fix planned for #13953 covers http(s) tab dispositions, not this about:blank new-window case.

Impact

Blocks work completely

Version or commit

T3Code(Nightly)/0.0.44-nightly.20260929.2456 (Electron 44.4.2, Chrome 152.0.7977.130)

Environment

Ubuntu 26.04.1 LTS, Linux 7.0.0-34-generic

Logs or stack traces
[auth] loginPopup failed, trying loginRedirect BrowserAuthError: popup_window_error: Error opening popup window. This can happen if you are using IE or if popups are blocked in the browser.
    at createBrowserAuthError (...)
    at PopupClient.openPopup (...)
    at PopupClient.initiateAuthRequest (...)
Workaround

Two app-side options:

  • In the page, replace window.open with a stub that returns null without calling the native handler. The redirect fallback then works: we confirmed a full sign-in through Microsoft this way.
  • Detect Electron/ in the user agent and call loginRedirect() directly, without trying the popup.
Dominant language
TypeScript
Stars
23.6k
Forks
6.1k
Avg merge
10h 20m
Merged PRs (30d)
309

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from pingdotgg/t3code

All issues in pingdotgg/t3code

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.