Add NativeAuthRequestInterceptor for custom per-request headers Fixes AB#3600652 by spetrescu84 · Pull Request #3112 · AzureAD/microsoft-authentication-library-common-for-android

spetrescu84 · 2026-05-13T16:41:46Z

Implement custom HTTP headers request interceptor for native auth CIAM requests

Add NativeAuthHeaderValidator to enforce header naming rules
Pass interceptor through the full config propagation chain: OAuth2StrategyParameters → NativeAuthCIAMAuthority → NativeAuthOAuth2Configuration → NativeAuthOAuth2StrategyFactory → all 4 interactors (SignIn, SignUp, ResetPassword, JIT)
Add interceptor field to BaseNativeAuthCommandParameters
Wire interceptor in NativeAuthMsalController.createOAuth2Strategy()
Add unit tests for header validation
Add integration tests for interceptor in all interactors

API Change: NativeAuthRequestInterceptor moved to MSAL

The NativeAuthRequestInterceptor interface has been moved to the MSAL module (com.microsoft.identity.nativeauth package) as it is a public-facing type that customers implement. Common now uses the base OAuth2RequestInterceptor type internally, which NativeAuthRequestInterceptor extends. This follows the established pattern where public nativeauth types live in MSAL.

AB#3600652

Implement custom HTTP headers request interceptor for native auth CIAM requests, matching the iOS PR (microsoft-authentication-library-for-objc#2862). - Add NativeAuthRequestInterceptor interface for injecting custom x-* headers - Add NativeAuthHeaderValidator to enforce header naming rules - Pass interceptor through the full config propagation chain: OAuth2StrategyParameters → NativeAuthCIAMAuthority → NativeAuthOAuth2Configuration → NativeAuthOAuth2StrategyFactory → all 4 interactors (SignIn, SignUp, ResetPassword, JIT) - Add interceptor field to BaseNativeAuthCommandParameters - Wire interceptor in NativeAuthMsalController.createOAuth2Strategy() - Add unit tests for header validation (11 tests) - Add integration tests for interceptor in SignInInteractor (6 tests) Co-authored-by: Copilot <[email protected]>

spetrescu84 · 2026-05-13T16:42:13Z

@copilot resolve the merge conflicts in this pull request

Co-authored-by: spetrescu84 <[email protected]>

Copilot

Pull request overview

Adds a NativeAuthRequestInterceptor extension point that lets applications inject custom x-* HTTP headers (e.g., Akamai/fraud signals) into native-auth (CIAM) network requests. The interceptor is threaded from BaseNativeAuthCommandParameters through OAuth2StrategyParameters → NativeAuthCIAMAuthority → NativeAuthOAuth2Configuration → NativeAuthOAuth2StrategyFactory and into all four interactors (SignIn, SignUp, ResetPassword, JIT). A NativeAuthHeaderValidator enforces the x- prefix and rejects reserved prefixes (x-ms-, x-client-, x-broker-, x-app-).

Changes:

New NativeAuthRequestInterceptor interface and NativeAuthHeaderValidator (with unit tests) for additive, validated headers.
Interceptor field added to OAuth2StrategyParameters, BaseNativeAuthCommandParameters, NativeAuthOAuth2Configuration, and the four interactors; NativeAuthMsalController.createOAuth2Strategy propagates it; identical applyInterceptorHeaders helper duplicated in each interactor.
Integration tests for SignInInteractor (only) covering merge, null/empty interceptor, reserved-prefix filtering, URL passthrough; changelog entry added.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
common4j/.../providers/NativeAuthRequestInterceptor.kt	New SAM-style interface for per-request additional headers.
common4j/.../providers/NativeAuthHeaderValidator.kt	New validator filtering headers by prefix rules.
common4j/.../providers/NativeAuthOAuth2Configuration.kt	Adds nullable `requestInterceptor` config field.
common4j/.../providers/NativeAuthOAuth2StrategyFactory.kt	Passes interceptor into all four interactors.
common4j/.../providers/interactors/SignInInteractor.kt	Adds interceptor field + `applyInterceptorHeaders` and applies to 4 calls.
common4j/.../providers/interactors/SignUpInteractor.kt	Same interceptor wiring as SignIn (no tests added).
common4j/.../providers/interactors/ResetPasswordInteractor.kt	Same interceptor wiring (no tests added).
common4j/.../providers/interactors/JITInteractor.kt	Same interceptor wiring (no tests added).
common4j/.../authorities/NativeAuthCIAMAuthority.kt	Threads interceptor from strategy params into config; uses fully-qualified type name.
common4j/.../providers/oauth2/OAuth2StrategyParameters.java	Adds `mRequestInterceptor`; introduces dependency from generic OAuth2 layer to nativeauth package.
common4j/.../commands/parameters/BaseNativeAuthCommandParameters.java	Adds `transient` `requestInterceptor` field (excluded from equals/hash).
common/.../controllers/NativeAuthMsalController.kt	Forwards `parameters.requestInterceptor` into the strategy params builder.
common4j/.../NativeAuthHeaderValidatorTest.kt	New unit tests for the prefix validator.
common4j/.../SignInInteractorRequestInterceptorTest.kt	New tests for interceptor behavior, only covering SignIn.
changelog.txt	Adds entry with empty PR number `(#)` and misleading "HttpRequest interceptor" wording.

Comments suppressed due to low confidence (1)

common4j/src/main/com/microsoft/identity/common/java/nativeauth/providers/interactors/SignInInteractor.kt:74

additionalHeaders is invoked from inside the network call path with no try/catch around it (see applyInterceptorHeaders in each interactor). A buggy interceptor implementation that throws (e.g., NPE while computing a fraud signal) will tear down the entire token request with an unrelated exception type that the existing native-auth error mapping is not designed to handle. Consider catching Throwable from the interceptor invocation, logging it, and falling back to no extra headers so an interceptor crash cannot break sign-in/sign-up/reset-password/JIT for end users.

    private fun applyInterceptorHeaders(requestUrl: URL, headers: Map<String, String?>): Map<String, String?> {
        if (requestInterceptor == null) return headers
        val additionalHeaders = requestInterceptor.additionalHeaders(requestUrl) ?: return headers
        val validHeaders = NativeAuthHeaderValidator.filterValidHeaders(additionalHeaders)
        if (validHeaders.isEmpty()) return headers
        val mergedHeaders = headers.toMutableMap()
        mergedHeaders.putAll(validHeaders)
        return mergedHeaders
    }

@@ -61,6 +62,12 @@ public class OAuth2StrategyParameters {
    @Nullable
    public final List<String> mCapabilities;

+    /**
+     * An optional interceptor for injecting custom HTTP headers into native auth requests.
+     */
+    @Nullable
+    public final transient NativeAuthRequestInterceptor mRequestInterceptor;


Copilot · 2026-05-13T16:47:55Z

@copilot resolve the merge conflicts in this pull request

Resolved and pushed. I merged origin/dev, fixed the changelog.txt conflict, and finalized the merge commit in f04517b.

spetrescu84 · 2026-05-13T16:48:05Z

@copilot apply changes based on the comments in this thread

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/3a466cba-db2f-42cd-afa9-92e96cef6792 Co-authored-by: spetrescu84 <[email protected]>

Copilot · 2026-05-13T16:57:14Z

@copilot apply changes based on the comments in this thread

Applied the linked review-thread updates in d415f28 (plus the main refactor/tests in f450877): shared interceptor-header merge utility used by all 4 interactors, added shared tests, normalized validated custom header names to lowercase with coverage, improved interceptor threading/exception contract docs, removed FQCN usage, decoupled OAuth2StrategyParameters from native-auth type via generic OAuth2RequestInterceptor, and updated changelog wording/PR number.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

dl.google.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=1024m -XX:+HeapDumpOnOutOfMemoryError -Xmx3072m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
identitydivision.pkgs.visualstudio.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=1024m -XX:+HeapDumpOnOutOfMemoryError -Xmx3072m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
www.puppycrawl.com
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/working/files-to-index8567248807499331946.list --sourceArchiveDir=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/src --outputDir=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

- Add SignUpInteractorRequestInterceptorTest (8 tests) - Add ResetPasswordInteractorRequestInterceptorTest (7 tests) - Add JITInteractorRequestInterceptorTest (5 tests) - Expand SignInInteractorRequestInterceptorTest to cover all 7 methods (12 tests) - Total: 43 tests (32 interactor + 11 validator), all passing Co-authored-by: Copilot <[email protected]>

github-actions · 2026-05-13T17:22:30Z

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

spetrescu84 · 2026-05-13T17:24:52Z

@copilot apply changes based on the comments in this thread

Copilot · 2026-05-13T17:26:18Z

@copilot apply changes based on the comments in this thread

Applied. The review-thread items are implemented in the latest commits, including shared interceptor header handling, case-insensitive header normalization/merge behavior, generic OAuth2 interceptor decoupling, and follow-up docs/guards/tests (1611df9, d415f28, f450877).

spetrescu84 · 2026-05-13T17:30:26Z

@copilot apply changes based on the comments in this thread

Copilot · 2026-05-13T17:31:31Z

@copilot apply changes based on the comments in this thread

Applied; the linked review-thread changes are already in the branch via 1611df9, d415f28, and f450877 (shared interceptor merge utility + coverage, case-insensitive header normalization/merge behavior, generic OAuth2 interceptor decoupling, and docs/changelog updates).

mustafamizrak · 2026-05-14T09:26:41Z

    override fun createOAuth2Strategy(parameters: OAuth2StrategyParameters): NativeAuthOAuth2Strategy {
-        val config = createNativeAuthOAuth2Configuration(parameters.mChallengeTypes, parameters.mCapabilities)
+        if (parameters.mRequestInterceptor != null && parameters.mRequestInterceptor !is NativeAuthRequestInterceptor) {
+            Logger.warn(TAG, "Ignoring non-native OAuth2RequestInterceptor for NativeAuthCIAMAuthority.")


I think WARN message is misleading the situation.

I've changed how this works, please take a look

…behavior, add tests - NativeAuthCIAMAuthority: Improve misleading WARN log message to clearly explain that custom headers will not be applied when interceptor type does not match - RequestInterceptorHeaderUtils: Add detailed KDoc explaining case-insensitive merge semantics matching iOS behavior and why reserved SDK headers cannot be overwritten - JITInteractorRequestInterceptorTest: Use 3 base headers (was 2) so null interceptor size assertion is more meaningful - SignUpInteractorRequestInterceptorTest: Add test for reserved header overwrite protection and case-insensitive header merge Co-authored-by: Copilot <[email protected]>

Move shared merge logic tests (reserved filtering, case-insensitive merge, overwrite protection, URL passthrough, null/empty interceptor) out of individual interactor tests into RequestInterceptorHeaderUtilsTest. Each interactor test now only verifies wiring: that the interceptor is called for each public method and that null interceptor passes through unchanged. This eliminates ~370 lines of duplicated test code. Test distribution: - RequestInterceptorHeaderUtilsTest: 9 tests (shared merge contract) - NativeAuthHeaderValidatorTest: 12 tests (validation rules) - 4 interactor tests: 24 tests total (per-method wiring) Co-authored-by: Copilot <[email protected]>

Each interactor method now has both a merge test and a null-interceptor test for full symmetry across SignIn, SignUp, ResetPassword, and JIT. Co-authored-by: Copilot <[email protected]>

Each test now uses the actual production endpoint URL for its method (e.g., /signup/v1.0/challenge for performChallenge) instead of a single shared URL per file. Co-authored-by: Copilot <[email protected]>

Replace all usages of NativeAuthRequestInterceptor in common with the base OAuth2RequestInterceptor type. The NativeAuthRequestInterceptor interface is a public-facing API that customers implement, so it belongs in the MSAL module (com.microsoft.identity.nativeauth package) following the established pattern for public nativeauth types. Common now uses OAuth2RequestInterceptor internally, which is the parent interface with the same contract. Any MSAL-level NativeAuthRequestInterceptor implementation will satisfy this type since it extends OAuth2RequestInterceptor. Co-authored-by: Copilot <[email protected]>

mustafamizrak

Why did you move NativeAuthRequestInterceptor to MSAL module? What are the reasons?

antrix1989 · 2026-05-26T20:45:24Z

Why did you move NativeAuthRequestInterceptor to MSAL module? What are the reasons?

We use NativeAuthRequestInterceptor in public api, that is why we moved it to the main MSAL module. Common core code should not be exposed in the public api.

spetrescu84 self-assigned this May 13, 2026

Copilot AI review requested due to automatic review settings May 13, 2026 16:41

spetrescu84 requested review from a team as code owners May 13, 2026 16:41

Copilot started work on behalf of spetrescu84 May 13, 2026 16:42 View session

Copilot started reviewing on behalf of spetrescu84 May 13, 2026 16:42 View session

Merge origin/dev and resolve changelog conflict

f04517b

Co-authored-by: spetrescu84 <[email protected]>

Copilot AI reviewed May 13, 2026

View reviewed changes

Copilot finished work on behalf of spetrescu84 May 13, 2026 16:48

Copilot started work on behalf of spetrescu84 May 13, 2026 16:48 View session

Copilot AI and others added 2 commits May 13, 2026 16:53

Address PR review feedback for interceptor wiring and docs

f450877

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/3a466cba-db2f-42cd-afa9-92e96cef6792 Co-authored-by: spetrescu84 <[email protected]>

Add docs and interceptor type guard per review feedback

d415f28

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/3a466cba-db2f-42cd-afa9-92e96cef6792 Co-authored-by: spetrescu84 <[email protected]>

Copilot finished work on behalf of spetrescu84 May 13, 2026 16:58

Copilot started work on behalf of spetrescu84 May 13, 2026 17:25 View session

Copilot finished work on behalf of spetrescu84 May 13, 2026 17:26

Copilot started work on behalf of spetrescu84 May 13, 2026 17:30 View session

Copilot finished work on behalf of spetrescu84 May 13, 2026 17:32

mustafamizrak reviewed May 14, 2026

View reviewed changes

spetrescu84 and others added 2 commits May 14, 2026 17:34

Merge branch 'dev' into spetrescu/custom_headers

4343317

spetrescu84 changed the title ~~Add NativeAuthRequestInterceptor for custom per-request headers~~ Add NativeAuthRequestInterceptor for custom per-request headers Fixes AB#3600652 May 15, 2026

spetrescu84 and others added 4 commits May 15, 2026 09:42

Updated message

bf80e0b

Updated comment

521100e

Add symmetric null-interceptor tests for all JIT methods

d91d6bf

Each interactor method now has both a merge test and a null-interceptor test for full symmetry across SignIn, SignUp, ResetPassword, and JIT. Co-authored-by: Copilot <[email protected]>

Use realistic per-method endpoint URLs in interceptor tests

89f5860

Each test now uses the actual production endpoint URL for its method (e.g., /signup/v1.0/challenge for performChallenge) instead of a single shared URL per file. Co-authored-by: Copilot <[email protected]>

spetrescu84 mentioned this pull request May 15, 2026

Provide custom HTTP headers setting Azure-Samples/ms-identity-ciam-native-auth-android-sample#57

Merged

antrix1989 approved these changes May 15, 2026

View reviewed changes

Merge branch 'dev' into spetrescu/custom_headers

0d1e6fb

mustafamizrak approved these changes May 20, 2026

View reviewed changes

mustafamizrak reviewed May 26, 2026

View reviewed changes

Merge branch 'dev' into spetrescu/custom_headers

2dc5782

antrix1989 approved these changes May 26, 2026

View reviewed changes

Conversation

spetrescu84 commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Change: NativeAuthRequestInterceptor moved to MSAL

Uh oh!

spetrescu84 commented May 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 13, 2026

Uh oh!

spetrescu84 commented May 13, 2026

Uh oh!

Copilot AI commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented May 13, 2026

Uh oh!

spetrescu84 commented May 13, 2026

Uh oh!

Copilot AI commented May 13, 2026

Uh oh!

spetrescu84 commented May 13, 2026

Uh oh!

Copilot AI commented May 13, 2026

Uh oh!

mustafamizrak May 14, 2026

Choose a reason for hiding this comment

Uh oh!

spetrescu84 May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mustafamizrak left a comment

Choose a reason for hiding this comment

Uh oh!

antrix1989 commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

spetrescu84 commented May 13, 2026 •

edited

Loading

Copilot AI commented May 13, 2026 •

edited

Loading