Enhance browser-based login success message to advise against its use… #28990
Conversation
… and recommend Web Account Manager (WAM) for better security.
| Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status. |
There was a problem hiding this comment.
Pull request overview
This pull request adds a warning message to the browser-based interactive login success page, recommending users switch to Web Account Manager (WAM) for improved authentication security and robustness.
Key Changes
- Added browser customization to display a warning message after successful browser-based login
- Updated the ChangeLog.md to document this user-facing change
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| src/Accounts/Authenticators/InteractiveUserAuthenticator.cs | Introduces BrowserCustomizationOptions with a success message warning users about the authentication method and recommending WAM |
| src/Accounts/Accounts/ChangeLog.md | Documents the new warning message in the upcoming release section |
| var browserCustomizationOptions = new BrowserCustomizationOptions() | ||
| { | ||
| SuccessMessage = @"Login completed successfully. You can close this browser window and return to the application. | ||
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", |
There was a problem hiding this comment.
The message says "strongly advise against the authentication method" which may be too strong and potentially confusing for users. Consider softening the language to "recommend using" rather than "strongly advise against", as browser-based authentication is still a valid and functional method, just not the most robust option. The current wording could cause unnecessary alarm for users who may not be able to immediately switch to WAM.
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", | |
| <b>Notice:</b> For a more robust authentication experience, we recommend using the broker (WAM) when possible. Learn more about using WAM here http://", |
| var browserCustomizationOptions = new BrowserCustomizationOptions() | ||
| { | ||
| SuccessMessage = @"Login completed successfully. You can close this browser window and return to the application. | ||
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", |
There was a problem hiding this comment.
The URL in the success message is incomplete - it ends with "http://". This should be replaced with a complete URL. Based on other references in the codebase, the standard URL for WAM documentation is either https://go.microsoft.com/fwlink/?linkid=2272007 or https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", | |
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here https://go.microsoft.com/fwlink/?linkid=2272007", |
| var browserCustomizationOptions = new BrowserCustomizationOptions() | ||
| { | ||
| SuccessMessage = @"Login completed successfully. You can close this browser window and return to the application. | ||
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", |
There was a problem hiding this comment.
The message states "the authentication method you are about to use" but this message appears after login has been completed successfully. The wording should be changed to reflect that the authentication has already occurred. Consider rephrasing to something like "the authentication method you just used" or "this authentication method".
| <b>Warning:</b> We strongly advise against the authentication method you are about to use. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", | |
| <b>Warning:</b> We strongly advise against the authentication method you just used. Please switch to the broker (WAM) for a more robust authentication mechanism. Learn more about using WAM here http://", |
| --> | ||
|
|
||
| ## Upcoming Release | ||
| * Updated the success message of browser-based interactive login to warn users against using this authentication method and recommend switching to Web Account Manager (WAM) for a more robust authentication mechanism. |
There was a problem hiding this comment.
According to the ChangeLog.md guidelines for this repository, less-obvious acronyms should always be explained on first use in a release section. While "WAM" is explained as "Web Account Manager" here, it would be helpful to also explain what WAM provides or why users should switch to it, similar to how other changelog entries in this file provide context about what changes mean for users.
1 participant
… and recommend Web Account Manager (WAM) for better security.
Description
This pull request updates the browser-based interactive login flow to improve user guidance. The main change is a new warning message advising users to switch from the current authentication method to Web Account Manager (WAM) for better security and robustness.
User experience improvements:
InteractiveUserAuthenticator.cs).ChangeLog.mdfor the upcoming release.Mandatory Checklist
Please choose the target release of Azure PowerShell. (⚠️ Target release is a different concept from API readiness. Please click below links for details.)
Check this box to confirm: I have read the Submitting Changes section of
CONTRIBUTING.mdand reviewed the following information:ChangeLog.mdfile(s) appropriatelysrc/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.## Upcoming Releaseheader in the past tense.ChangeLog.mdif no new release is required, such as fixing test case only.