From ab7c67d783ee40474d1ba557fb2ef5aa0e97223f Mon Sep 17 00:00:00 2001
From: Sai Pavan Nunna <saipavan991@gmail.com>
Date: Thu, 9 Jul 2026 12:17:26 +0530
Subject: [PATCH] Best-effort auto-close of the SSO login browser tab

After a successful `aws sso login` Authorization Code flow, the local
callback page now attempts to close its own browser tab and shows an
honest message telling the user they can close it manually if the
browser does not.

Browsers only permit window.close() on tabs that were opened by script
or that have a single history entry, so this closes the tab on a warm
re-auth and is a harmless no-op after an interactive login. No new flags
or plumbing are added; the behavior lives entirely in the served
callback page.
---
 .changes/next-release/enhancement-sso-4703.json |  5 +++++
 awscli/customizations/sso/index.html            | 10 ++++++++--
 tests/unit/customizations/sso/test_utils.py     | 10 ++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 .changes/next-release/enhancement-sso-4703.json

diff --git a/.changes/next-release/enhancement-sso-4703.json b/.changes/next-release/enhancement-sso-4703.json
new file mode 100644
index 000000000000..d4b4dacfb0be
--- /dev/null
+++ b/.changes/next-release/enhancement-sso-4703.json
@@ -0,0 +1,5 @@
+{
+  "type": "enhancement",
+  "category": "sso",
+  "description": "The browser tab opened by ``aws sso login`` for the Authorization Code flow now makes a best-effort attempt to close itself after a successful login. This is a no-op in browsers that block it (e.g. after an interactive login), where the page continues to display a message that the tab can be closed."
+}
diff --git a/awscli/customizations/sso/index.html b/awscli/customizations/sso/index.html
index 1c2a3b8dfe5b..988de537c826 100644
--- a/awscli/customizations/sso/index.html
+++ b/awscli/customizations/sso/index.html
@@ -121,8 +121,8 @@ <h1 class="title">Sign in to AWS</h1>
                     </path>
                 </svg>
                 <div class="success-text">
-                    Your credentials have been shared successfully and can be used until your session expires. You can
-                    now close this tab.
+                    Your credentials have been shared successfully and can be used until your session expires. This tab
+                    will try to close automatically&mdash;if it is still open, you can safely close it now.
                 </div>
             </div>
             <div id="error-message" class="error-content hidden">
@@ -146,6 +146,12 @@ <h1 class="title">Sign in to AWS</h1>
                 document.getElementById('success-message').classList.add('hidden');
                 document.getElementById('error-message').classList.remove('hidden');
                 document.getElementById('error-text').innerText = error;
+            } else {
+                // Best-effort tab close. Browsers only allow window.close() on
+                // tabs opened by script or with a single history entry, so this
+                // is a no-op after an interactive login. When it is blocked the
+                // success message above tells the user to close the tab.
+                window.setTimeout(() => window.close(), 300);
             }
         };
     </script>
diff --git a/tests/unit/customizations/sso/test_utils.py b/tests/unit/customizations/sso/test_utils.py
index 647132b8e143..1f1b69872976 100644
--- a/tests/unit/customizations/sso/test_utils.py
+++ b/tests/unit/customizations/sso/test_utils.py
@@ -317,6 +317,16 @@ def test_error(self):
         assert actual_code is None
         assert actual_state is None
 
+    def test_callback_page_attempts_best_effort_close(self):
+        url = self.url + '?code=1234&state=4567'
+
+        http = urllib3.PoolManager()
+        response = http.request("GET", url)
+
+        self.fetcher.get_auth_code_and_state()
+        assert response.status == 200
+        assert b'window.close()' in response.data
+
 
 @mock.patch(
     'awscli.customizations.sso.utils.AuthCodeFetcher._REQUEST_TIMEOUT', 0.1