@azure/msal-browser 3.15.0 → 3.17.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.15.0 2024-05-28 */
+/*! @azure/msal-browser v3.17.0 2024-06-10 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -310,7 +310,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -327,7 +327,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -376,7 +376,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -474,7 +474,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -726,7 +726,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -787,7 +787,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -802,7 +802,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -814,7 +814,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -868,7 +868,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1006,7 +1006,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1103,7 +1103,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1150,7 +1150,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1314,7 +1314,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1454,7 +1454,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1467,7 +1467,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1487,7 +1487,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1497,7 +1497,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1507,7 +1507,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1544,9 +1544,16 @@ const PerformanceEvents = {
      * Used to acquire a new access token interactively through pop ups
      */
     AcquireTokenPopup: "acquireTokenPopup",
+    /**
+     * acquireTokenPreRedirect (msal-browser).
+     * First part of the redirect flow.
+     * Used to acquire a new access token interactively through redirects.
+     */
+    AcquireTokenPreRedirect: "acquireTokenPreRedirect",
     /**
      * acquireTokenRedirect (msal-browser).
-     * Used to acquire a new access token interactively through redirects
+     * Second part of the redirect flow.
+     * Used to acquire a new access token interactively through redirects.
      */
     AcquireTokenRedirect: "acquireTokenRedirect",
     /**
@@ -1982,7 +1989,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2078,7 +2085,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2187,7 +2194,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2224,7 +2231,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2551,7 +2558,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3390,7 +3397,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3421,7 +3428,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3439,7 +3446,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3486,7 +3493,7 @@ const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3502,6 +3509,12 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     base64Encode: () => {
         throw createClientAuthError(methodNotImplemented);
     },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
     async getPublicKeyThumbprint() {
         throw createClientAuthError(methodNotImplemented);
     },
@@ -3519,7 +3532,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3710,12 +3723,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.10.0";
+const version$1 = "14.12.0";
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3915,7 +3928,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3955,7 +3968,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4017,7 +4030,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4039,7 +4052,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4286,7 +4299,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4294,7 +4307,7 @@ class AccountEntity {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4321,7 +4334,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5460,7 +5473,7 @@ class CacheManager {
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
     matchKeyId(entity, keyId) {
         return !!(entity.keyId && entity.keyId === keyId);
@@ -5576,7 +5589,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5674,7 +5687,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5692,7 +5705,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5790,7 +5803,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5827,7 +5840,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5837,7 +5850,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5921,7 +5934,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6305,7 +6318,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6408,7 +6421,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6434,7 +6447,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6522,7 +6535,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6538,7 +6551,7 @@ class CacheRecord {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6610,7 +6623,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6635,11 +6648,10 @@ class PopTokenGenerator {
     async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
         const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-        const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
     /**
@@ -6695,7 +6707,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6722,7 +6734,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6990,7 +7002,13 @@ class ResponseHandler {
         let refreshOn;
         let familyId = Constants.EMPTY_STRING;
         if (cacheRecord.accessToken) {
-            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
+            if (cacheRecord.accessToken.tokenType ===
+                AuthenticationScheme.POP &&
+                !request.popKid) {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
@@ -7086,7 +7104,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7254,9 +7272,16 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addClientInfo();
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7450,9 +7475,16 @@ class AuthorizationCodeClient extends BaseClient {
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
         return parameterBuilder.createQueryString();
@@ -7495,7 +7527,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7660,9 +7692,16 @@ class RefreshTokenClient extends BaseClient {
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7702,7 +7741,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7838,7 +7877,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7853,7 +7892,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7861,7 +7900,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7886,7 +7925,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7926,7 +7965,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7984,7 +8023,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8188,7 +8227,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8267,7 +8306,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.10.0 2024-05-28 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8906,6 +8945,7 @@ const nativeConnectionNotEstablished = "native_connection_not_established";
 const uninitializedPublicClientApplication = "uninitialized_public_client_application";
 const nativePromptNotSupported = "native_prompt_not_supported";
 const invalidBase64String = "invalid_base64_string";
+const invalidPopTokenRequest = "invalid_pop_token_request";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -8928,6 +8968,7 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     interactionInProgress: interactionInProgress,
     invalidBase64String: invalidBase64String,
     invalidCacheType: invalidCacheType,
+    invalidPopTokenRequest: invalidPopTokenRequest,
     monitorPopupTimeout: monitorPopupTimeout,
     monitorWindowTimeout: monitorWindowTimeout,
     nativeConnectionNotEstablished: nativeConnectionNotEstablished,
@@ -9010,6 +9051,7 @@ const BrowserAuthErrorMessages = {
     [uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
     [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [invalidBase64String]: "Invalid base64 encoded string.",
+    [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9200,6 +9242,10 @@ const BrowserAuthErrorMessage = {
         code: invalidBase64String,
         desc: BrowserAuthErrorMessages[invalidBase64String],
     },
+    invalidPopTokenRequest: {
+        code: invalidPopTokenRequest,
+        desc: BrowserAuthErrorMessages[invalidPopTokenRequest],
+    },
 };
 /**
  * Browser library error class thrown by the MSAL.js library for SPAs
@@ -10131,7 +10177,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.15.0";
+const version = "3.17.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10947,6 +10993,21 @@ class CryptoOps {
     base64Decode(input) {
         return base64Decode(input);
     }
+    /**
+     * Encodes input string to base64 URL safe string.
+     * @param input
+     */
+    base64UrlEncode(input) {
+        return urlEncode(input);
+    }
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid) {
+        return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+    }
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request
@@ -13287,10 +13348,11 @@ class NativeInteractionClient extends BaseInteractionClient {
             // continue with a native call for any and all errors
             this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
         }
+        const { ...nativeTokenRequest } = nativeRequest;
         // fall back to native calls
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         const response = await this.nativeMessageHandler.sendMessage(messageBody);
         const validatedResponse = this.validateNativeResponse(response);
@@ -13366,14 +13428,16 @@ class NativeInteractionClient extends BaseInteractionClient {
     }
     /**
      * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
-     * @param request
+     * @param {RedirectRequest} request
+     * @param {InProgressPerformanceEvent} rootMeasurement
      */
-    async acquireTokenRedirect(request) {
+    async acquireTokenRedirect(request, rootMeasurement) {
         this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
         const nativeRequest = await this.initializeNativeRequest(request);
+        const { ...nativeTokenRequest } = nativeRequest;
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         try {
             const response = await this.nativeMessageHandler.sendMessage(messageBody);
@@ -13394,6 +13458,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const redirectUri = this.config.auth.navigateToLoginRequestUrl
             ? window.location.href
             : this.getRedirectUri(request.redirectUri);
+        rootMeasurement.end({ success: true });
         await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
     }
     /**
@@ -13475,7 +13540,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         this.cacheAccount(baseAccount);
-        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.accessToken, result.tenantId, reqTimestamp);
+        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
     /**
@@ -13506,7 +13571,8 @@ class NativeInteractionClient extends BaseInteractionClient {
      * @param response
      */
     async generatePopAccessToken(response, request) {
-        if (request.tokenType === AuthenticationScheme.POP) {
+        if (request.tokenType === AuthenticationScheme.POP &&
+            request.signPopToken) {
             /**
              * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
              * is still received, SHR is calculated locally
@@ -13626,7 +13692,7 @@ class NativeInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response, request);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
         const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
         void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
     }
@@ -13756,8 +13822,13 @@ class NativeInteractionClient extends BaseInteractionClient {
                 ...request.extraQueryParameters,
                 ...request.tokenQueryParameters,
             },
-            extendedExpiryToken: false, // Make this configurable?
+            extendedExpiryToken: false,
+            keyId: request.popKid,
         };
+        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+        if (validatedRequest.signPopToken && !!request.popKid) {
+            throw createBrowserAuthError(invalidPopTokenRequest);
+        }
         this.handleExtraBrokerParams(validatedRequest);
         validatedRequest.extraParameters =
             validatedRequest.extraParameters || {};
@@ -13772,10 +13843,20 @@ class NativeInteractionClient extends BaseInteractionClient {
                 shrNonce: request.shrNonce,
             };
             const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
-            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-            validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-            validatedRequest.keyId = reqCnfData.kid;
+            // generate reqCnf if not provided in the request
+            let reqCnfData;
+            if (!validatedRequest.keyId) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+                validatedRequest.keyId = generatedReqCnfData.kid;
+                validatedRequest.signPopToken = true;
+            }
+            else {
+                reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                validatedRequest.signPopToken = false;
+            }
+            // SPAs require whole string to be passed to broker
+            validatedRequest.reqCnf = reqCnfData;
         }
         return validatedRequest;
     }
@@ -15832,7 +15913,7 @@ class StandardController {
         const correlationId = useNative
             ? request?.correlationId
             : this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
-        const rootMeasurement = this.performanceClient.startMeasurement("acquireTokenRedirect", correlationId);
+        const rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, correlationId);
         this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
         let redirectResponse;
         if (useNative && this.nativeExtensionProvider) {
@@ -15907,43 +15988,64 @@ class StandardController {
         // Preflight request
         const correlationId = this.getRequestCorrelationId(request);
         this.logger.verbose("acquireTokenRedirect called", correlationId);
-        redirectPreflightCheck(this.initialized, this.config);
-        this.browserStorage.setInteractionInProgress(true);
+        const atrMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenPreRedirect, correlationId);
+        atrMeasurement.add({
+            accountType: getAccountType(request.account),
+            scenarioId: request.scenarioId,
+        });
+        const onRedirectNavigateCb = request.onRedirectNavigate;
+        request.onRedirectNavigate = (url) => {
+            const navigate = typeof onRedirectNavigateCb === "function"
+                ? onRedirectNavigateCb(url)
+                : undefined;
+            if (navigate !== false) {
+                atrMeasurement.end({ success: true });
+            }
+            else {
+                atrMeasurement.discard();
+            }
+            return navigate;
+        };
         // If logged in, emit acquire token events
         const isLoggedIn = this.getAllAccounts().length > 0;
-        if (isLoggedIn) {
-            this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Redirect, request);
-        }
-        else {
-            this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
-        }
-        let result;
-        if (this.nativeExtensionProvider && this.canUseNative(request)) {
-            const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-            result = nativeClient
-                .acquireTokenRedirect(request)
-                .catch((e) => {
-                if (e instanceof NativeAuthError &&
-                    isFatalNativeAuthError(e)) {
-                    this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                    const redirectClient = this.createRedirectClient(correlationId);
-                    return redirectClient.acquireToken(request);
-                }
-                else if (e instanceof InteractionRequiredAuthError) {
-                    this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
-                    const redirectClient = this.createRedirectClient(correlationId);
-                    return redirectClient.acquireToken(request);
-                }
-                this.browserStorage.setInteractionInProgress(false);
-                throw e;
-            });
-        }
-        else {
-            const redirectClient = this.createRedirectClient(correlationId);
-            result = redirectClient.acquireToken(request);
+        try {
+            redirectPreflightCheck(this.initialized, this.config);
+            this.browserStorage.setInteractionInProgress(true);
+            if (isLoggedIn) {
+                this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Redirect, request);
+            }
+            else {
+                this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
+            }
+            let result;
+            if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
+                result = nativeClient
+                    .acquireTokenRedirect(request, atrMeasurement)
+                    .catch((e) => {
+                    if (e instanceof NativeAuthError &&
+                        isFatalNativeAuthError(e)) {
+                        this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                        const redirectClient = this.createRedirectClient(correlationId);
+                        return redirectClient.acquireToken(request);
+                    }
+                    else if (e instanceof InteractionRequiredAuthError) {
+                        this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
+                        const redirectClient = this.createRedirectClient(correlationId);
+                        return redirectClient.acquireToken(request);
+                    }
+                    this.browserStorage.setInteractionInProgress(false);
+                    throw e;
+                });
+            }
+            else {
+                const redirectClient = this.createRedirectClient(correlationId);
+                result = redirectClient.acquireToken(request);
+            }
+            return await result;
         }
-        return result.catch((e) => {
-            // If logged in, emit acquire token events
+        catch (e) {
+            atrMeasurement.end({ success: false }, e);
             if (isLoggedIn) {
                 this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
             }
@@ -15951,7 +16053,7 @@ class StandardController {
                 this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Redirect, null, e);
             }
             throw e;
-        });
+        }
     }
     // #endregion
     // #region Popup Flow