msal popup based authentication is it secure on electron??

Question

I want to integrate msal based authentication in my electron app, but msal does all the authentication process in the chromium runtime browser itself, so i am not sure if it is secure by default because there is a post https://stackoverflow.com/a/69332071/8527880 that describes that some providers don't allow electron authentication flow.

Answer 1

Hi @Ashu Ghildiyal ,

I reached out to the product team to share your concern, and they replied that they are working on making the sample a bit more secure by using the default browser. They will update the sample when as they add more layers of security to it.

For now though, the Electron NodeJS sample and tutorial follows the best practices that we have found, but since we don't officially support electron, we can't guarantee that it's as safe as it can be. https://learn.microsoft.com/en-us/azure/active-directory/develop/tutorial-v2-nodejs-desktop

As mentioned in the article, to demonstrate best security practices, the Electron sample application makes use of a custom file protocol instead of a regular web (https://) redirect URI in order to handle the redirection step of the authorization flow. This is suggested in the OAuth2.0 specification for Native Apps.

I hope this helps!

Marilee

-

If this answer was helpful to you, please remember to "mark as answer" so that others in the community with similar questions can more easily find a solution.