[xinyuxu1026]

Fixes #6072 through an explicit opt-in for Linux container deployments.

Changes proposed in this request

• Add MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING. Only true (case-insensitive) or 1 enables the behavior; unset, empty, or other values leave it disabled.
• On Linux, enable an IPv4 wildcard listener for forwarded callbacks. Preserve the localhost listener when it resolves to IPv6 first, and avoid overlapping IPv4 listeners when localhost resolves to IPv4 first.
• Keep default binding, public APIs, and callback-processing behavior unchanged. Scope the product change to HttpListenerInterceptor.
• Require explicit opt-in because wildcard binding exposes all container IPv4 interfaces. The setting does not create a port mapping or launch a browser on the host.

Testing

• 27 focused tests passed on Ubuntu 24.04 WSL with .NET 8:
  dotnet test tests/Microsoft.Identity.Test.Unit/Microsoft.Identity.Test.Unit.csproj --framework net8.0 --filter "FullyQualifiedName~HttpListenerInterceptorTests|FullyQualifiedName~DefaultOsBrowserWebUiTests" -p:EnableWindowsTargeting=true
• Coverage includes environment-variable values, IPv4/IPv6 prefix selection, and an actual IPv4 callback retaining the localhost Host header.
• The targeted run also built the core library for net8.0 and netstandard2.0.
• No live identity-provider authentication or Docker end-to-end test was run for this final patch.

Performance impact
One environment-variable read per listener construction. The additional localhost lookup and IPv4 listener are used only when forwarding is enabled on Linux. No performance benchmarks were run.

Documentation

• All relevant documentation is updated.

Usage and network-exposure warnings are in docs/system-browser-port-forwarding.md; the project README is unchanged. Enable only in an isolated container, restrict the published host port to loopback, and restrict access from other containers.

<!-- BEGIN pr-telemetry -->
assistance: agentic-cli
type: bug
agent-tool: copilot-cli
agent-model: gpt-6-astra
work-item: AB#n/a
<!-- END pr-telemetry -->

[Copilot]

🔵 Needs a closer look

IPv6-first startup/callback coverage and Linux-specific binding diagnostics remain unresolved.

Pull request overview

Adds explicit Linux opt-in IPv4 wildcard forwarding for system-browser callbacks in container deployments.

Changes:

• Adds MSAL_ALLOW_SYSTEM_BROWSER_PORT_FORWARDING configuration.
• Supports IPv4 forwarding while preserving default listener behavior.
• Adds focused tests and documents security considerations.

File summaries

File	Summary
tests/Microsoft.Identity.Test.Unit/WebUITests/HttpListenerInterceptorTests.cs	Tests configuration, prefix selection, and callbacks; IPv6-first integration coverage remains needed.
src/client/Microsoft.Identity.Client/Platforms/Features/DefaultOSBrowser/HttpListenerInterceptor.cs	Implements opt-in Linux forwarding; Linux binding diagnostics need improvement.
docs/system-browser-port-forwarding.md	Documents configuration, usage, and network-exposure warnings.

Review details

Suppressed comments (3)

src/client/Microsoft.Identity.Client/Platforms/Features/DefaultOSBrowser/HttpListenerInterceptor.cs:95

• The IPv6-first branch is only exercised through TestBeforeStart, which cancels before httpListener.Start() runs. Add a Linux test that injects localhostResolvesToIpv6: () => true, starts both prefixes, and sends the forwarded IPv4 callback; otherwise the fix's main two-prefix binding scenario is not verified.

                if (usePortForwarding)
                {
                    string portForwardingUrl = "http://*:" + port + path.TrimEnd('/') + "/";
                    httpListener.Prefixes.Add(portForwardingUrl);

src/client/Microsoft.Identity.Client/Platforms/Features/DefaultOSBrowser/HttpListenerInterceptor.cs:99

• The new Linux wildcard prefix introduces a failure mode during HttpListener.Start(), but the existing exception path still reports only urlToListenTo (localhost) and recommends the Windows-only netsh workaround. When opt-in binding fails on Linux, this points users at the wrong URL and platform; report the actual configured prefix(es) and provide a Linux-appropriate diagnostic for this path.

                if (usePortForwarding)
                {
                    string portForwardingUrl = "http://*:" + port + path.TrimEnd('/') + "/";
                    httpListener.Prefixes.Add(portForwardingUrl);
                    TestBeforeStart?.Invoke(portForwardingUrl);
                    _logger.Warning(
                        "System browser port forwarding is enabled. The authorization response listener will accept " +
                        "requests on all IPv4 network interfaces. Restrict the forwarded host port to loopback.");

tests/Microsoft.Identity.Test.Unit/WebUITests/HttpListenerInterceptorTests.cs:227

• This test cancels from TestBeforeStart, so it never reaches httpListener.Start() for the IPv6-first case. The new dual-prefix configuration (localhost plus the IPv4 wildcard) is therefore only string-tested; a startup conflict or a failure to bind both address families would still pass. Please add an integration-style assertion that starts this branch and receives an IPv4 form POST before cancelling the listener.

                if (url == $"http://*:{port}/TestPath/")
                {
                    cts.Cancel();
                    cts.Token.ThrowIfCancellationRequested();
                }

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Listener binding and network exposure changes warrant final human review.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Copilot review overview

🔵 Needs a closer look

Address localhost lookup failures and complete the IPv6-first binding test coverage.

Review effort: Lite
Findings: None