Merge pull request #1579 from AzureAD/hotfix/1.15.1

Merge Hotfix/1.15.1 to main

Author: swasti29

IdentityCore/src/MSIDConstants.h

@@ -217,6 +217,7 @@ extern NSString * _Nonnull const MSID_FLIGHT_DISABLE_JIT_TROUBLESHOOTING_LEGACY_
 extern NSString * _Nonnull const MSID_FLIGHT_CLIENT_SFRT_STATUS;
 extern NSString * _Nonnull const MSID_FLIGHT_DISABLE_PREFERRED_IDENTITY_CBA;
 extern NSString * _Nonnull const MSID_FLIGHT_SUPPORT_STATE_DUNA_CBA;
+extern NSString * _Nonnull const MSID_FLIGHT_IGNORE_COOKIES_IN_DUNA_RESUME;
 
 /**
  * Flight to indicate if remove account artifacts should be disabled

IdentityCore/src/MSIDConstants.m

@@ -89,6 +89,7 @@
 NSString *const MSID_FLIGHT_CLIENT_SFRT_STATUS = @"sfrt_v2";
 NSString *const MSID_FLIGHT_DISABLE_PREFERRED_IDENTITY_CBA = @"dis_pre_iden_cba";
 NSString *const MSID_FLIGHT_SUPPORT_STATE_DUNA_CBA = @"support_state_duna_cba";
+NSString *const MSID_FLIGHT_IGNORE_COOKIES_IN_DUNA_RESUME = @"ignore_cookies_in_duna_resume";
 
 // Making the flight string short to avoid legacy broker url size limit
 NSString *const MSID_FLIGHT_DISABLE_REMOVE_ACCOUNT_ARTIFACTS = @"disable_rm_metadata";

IdentityCore/src/webview/operations/ios/MSIDSwitchBrowserResumeOperation.m

@@ -108,6 +108,15 @@ - (void)invokeWithRequestParameters:(nonnull MSIDInteractiveTokenRequestParamete
     webRequestConfiguration.startURL = [[NSURL alloc] initWithString:self.switchBrowserResumeResponse.actionUri];
     NSMutableDictionary *customHeaders = [webRequestConfiguration.customHeaders mutableCopy] ?: [NSMutableDictionary new];
     customHeaders[@"Authorization"] = [NSString stringWithFormat:@"Bearer %@", self.switchBrowserResumeResponse.switchBrowserSessionToken];
+
+    if (![MSIDFlightManager.sharedInstance boolForKey:MSID_FLIGHT_IGNORE_COOKIES_IN_DUNA_RESUME])
+    {
+        if (customHeaders[MSID_REFRESH_TOKEN_CREDENTIAL] && [customHeaders[@"Cookie"] isEqualToString:@""])
+        {
+            [customHeaders removeObjectForKey:@"Cookie"];
+        }
+    }
+    
     webRequestConfiguration.customHeaders = customHeaders;
 
     NSObject<MSIDWebviewInteracting> *webView = [oauthFactory.webviewFactory webViewWithConfiguration:webRequestConfiguration

changelog.txt

@@ -1,3 +1,6 @@
+Version 1.15.1
+Allow cookies in duna resume request #1574
+
 Version 1.15.0
 * Query and populate ECC STK in Workplacejoin information for iOS (#1555)