Clarification on Server Side Rendering (SSR) for React

[Robstei]

Core Library

No response

Wrapper Library

MSAL React (@azure/msal-react)

Public or Confidential Client?

Public

Documentation Location

#5038 (comment)

Description

Hi,

It seems like the docs and the comments in issues are contradicting each other regarding SSR in react.

While the docs say that SSR is supported

As stated here there is no support for SSR.

Here it says that Cookies are supported.

While following the link to the options says that all cookie related options are deprecated.

My current understanding is that SSR without Cookies is not possible since the request needs to be checked server side in order to immediately create the correct html.

Is my assertion correct that SSR is not supported? How would I read the token server side from the request otherwise.

I am using react router v7 in framework mode.

[tnorling]

Apologies for the confusion, I can see how the wording is deceptive! The FAQ and the comment you linked actually do attempt to say the same thing, MSAL.js will not break or prevent you from rendering other parts of your app server side but the MSAL.js APIs themselves will not work server-side. MSAL.js is designed only for client-side applications and takes a hard dependency on several DOM APIs which are not available during SSR.

R.e. Cookies: they are both still currently supported and deprecated, meaning support will end in a future major version (cookies are currently scheduled for removal in v5). Note that the cookies mentioned only store temporary artifacts needed during a redirect request, not the persistent auth artifacts themselves, so this would not help SSR anyway.

[Robstei]

Thanks a lot for the fast response.

For anyone finding this. My understanding now is that the initial render on server side and client side will be null. And after the msalInstance got initialized the content inside the provider renders.

We do consider to use msal-browser without msal-react and set the cookie ourselves.
Do you have any thoughts on that?

Thanks a lot for the help.

[tnorling]

msal-browser APIs will also not work server side, nor do we recommend passing auth artifacts across the client/server boundary. If you would like to perform auth server-side you should use msal-node but tokens should remain on the server, not passed up to the client. The client still needs to perform its own auth, optionally using the hybrid spa flow to reduce interactions.

[microsoft-github-policy-service]

@@Robstei This issue has been automatically marked as stale because it is marked as requiring author feedback but has not had any activity for 5 days. If your issue has been resolved please let us know by closing the issue. If your issue has not been resolved please leave a comment to keep this open. It will be closed automatically in 7 days if it remains stale.