Add NativeAuthRequestInterceptor for custom per-request HTTP headers AB#3606613

[spetrescu84]

Summary

Implements the Android equivalent of the iOS PR microsoft-authentication-library-for-objc#2862, enabling apps to inject custom x-* headers into native auth HTTP requests (e.g., for CIAM fraud-signal scenarios like Akamai sensor data).

Changes

MSAL (this PR)

• NativeAuthPublicClientApplicationConfiguration.kt — Added @Transient var requestInterceptor property with mergeConfiguration support
• CommandParametersAdapter.java — Propagated requestInterceptor through all 16 native auth builder calls; fixed pre-existing duplicate .challengeType() in createSignInResendCodeCommandParameters()

Common (spetrescu/custom_headers)

• NativeAuthRequestInterceptor.kt — Public interface: fun additionalHeaders(requestUrl: URL): Map<String, String>?
• NativeAuthHeaderValidator.kt — Validates headers (must start with x-, must NOT start with x-ms-, x-client-, x-broker-, x-app-)
• Wired interceptor through full propagation chain
• Applied applyInterceptorHeaders() before every httpClient.post() call in all 4 interactors

Testing

• 11 unit tests for NativeAuthHeaderValidator (all validation scenarios)
• 6 integration tests for SignInInteractorRequestInterceptorTest
• All 17 tests pass

Design Decisions

• Synchronous interface (vs iOS async callbacks) — Android interactors already run on background threads
• Same propagation pattern as challengeTypes/capabilities for consistency
• Reserved prefix filtering prevents SDK header override
• @Transient on config field — set programmatically, not from JSON

AB#3606613

[github-actions]

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

[Copilot]

Pull request overview

Adds native auth support for per-request custom HTTP headers by introducing a request interceptor on native auth configuration and propagating it into native auth command parameters.

Changes:

• Added a transient requestInterceptor property to NativeAuthPublicClientApplicationConfiguration and included it in configuration merging.
• Propagated requestInterceptor through most native auth command parameter builders.
• Removed a duplicate challengeType() call in sign-in resend-code parameter construction.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

File	Description
msal/src/main/java/com/microsoft/identity/nativeauth/NativeAuthPublicClientApplicationConfiguration.kt	Adds the native auth request interceptor configuration field and merge behavior.
msal/src/main/java/com/microsoft/identity/client/internal/CommandParametersAdapter.java	Passes the configured interceptor into native auth command parameter builders.

[spetrescu84]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied both fixes in commit d6bb35a:

1. JIT builders — Added .requestInterceptor(configuration.getRequestInterceptor()) to both createJITChallengeAuthMethodCommandParameters and createJITSubmitChallengeCommandParameters in CommandParametersAdapter.java, so custom headers are propagated consistently across all native auth flows including JIT.

2. Public factory path — Added a requestInterceptor field to NativeAuthPublicClientApplicationParameters.kt, updated the private createNativeAuthApplication to accept and apply it to the config, and threaded parameters.getRequestInterceptor() through the createNativeAuthPublicClientApplication(Context, NativeAuthPublicClientApplicationParameters) factory. The three legacy/file-based factory paths continue to pass null (the interceptor is set programmatically, not from JSON).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Xmx2048m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[spetrescu84]

This was removed because it's duplicated above