OAuth popup authentication failure due to reliance on window.opener in Esri callback sample

NicolasGIS

Hello JS API team,

I am facing an issue where our SSO applies hardened security measures and intentionally clears `window.opener`.

I am currently working on an integration with Octave (aka EAM) which provides an ArcGIS Plugin. Their client application follows the sample and documentation provided by Esri, but as a consequence the integration is currently broken: authentication succeeds, yet the callback can no longer return the OAuth response to the parent application because `window.opener` is not available [1].

I don't think EAM/Octave can really be blamed for this, as they are following the most straightforward path provided by the SDK using `oauth-callback-html` [1] referenced throughout the documentation [2],[3].

After investigating this with our security team, I found that this situation is not necessarily specific to our SSO. Modern browser isolation mechanisms such as Cross-Origin-Opener-Policy (COOP) can also intentionally sever the popup/opener relationship.

It therefore seems that the SDK could be made more robust, and better aligned with current security practices, by also supporting environments where window.opener is unavailable.

One possible alternative would be to use a same-origin BroadcastChannel between the callback page and the application as a fallback when window.opener is unavailable. Microsoft MSAL Browser, for example, uses a similar approach to support popup authentication in COOP-enabled environments [4].

It would be great if the OAuth popup login flow could be enhanced to support such environments. External vendors integrating with ArcGIS are likely to follow the official samples and may otherwise inherit the assumption that window.opener will always remain available throughout the authentication flow

Thanks for listening !

Reference:

[1] https://github.com/Esri/jsapi-resources/blob/main/oauth/oauth-callback.html

[2] https://developers.arcgis.com/javascript/latest/references/core/identity/OAuthInfo/#popup

[3] https://developers.arcgis.com/javascript/latest/sample-code/identity-oauth-basic/

[4] https://learn.microsoft.com/en-us/entra/msal/javascript/browser/login-user

PS: I have a case opened (04242886) and they recommended me to open a post here.

NicolasGIS

FYI, the following enhancement has been logged for this request:

ENH-000187148 - Request to enhance the ArcGIS Maps SDK for JavaScript OAuth popup authentication workflow to work in security-hardened environment that actively clears the window.opener