@azure/msal-browser 3.15.0 → 3.17.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.15.0 2024-05-28 */
+/*! @azure/msal-browser v3.17.0 2024-06-10 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -314,7 +314,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -331,7 +331,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -380,7 +380,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -478,7 +478,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -730,7 +730,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -791,7 +791,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -806,7 +806,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -818,7 +818,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -872,7 +872,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1010,7 +1010,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1107,7 +1107,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1154,7 +1154,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1318,7 +1318,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1458,7 +1458,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1471,7 +1471,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1491,7 +1491,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1501,7 +1501,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1511,7 +1511,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1548,9 +1548,16 @@
          * Used to acquire a new access token interactively through pop ups
          */
         AcquireTokenPopup: "acquireTokenPopup",
+        /**
+         * acquireTokenPreRedirect (msal-browser).
+         * First part of the redirect flow.
+         * Used to acquire a new access token interactively through redirects.
+         */
+        AcquireTokenPreRedirect: "acquireTokenPreRedirect",
         /**
          * acquireTokenRedirect (msal-browser).
-         * Used to acquire a new access token interactively through redirects
+         * Second part of the redirect flow.
+         * Used to acquire a new access token interactively through redirects.
          */
         AcquireTokenRedirect: "acquireTokenRedirect",
         /**
@@ -1986,7 +1993,7 @@
         "multiMatchedRT",
     ]);
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2082,7 +2089,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2191,7 +2198,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2228,7 +2235,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2555,7 +2562,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3394,7 +3401,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3425,7 +3432,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3443,7 +3450,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3490,7 +3497,7 @@
     const LOGIN_HINT = "login_hint";
     const DOMAIN_HINT = "domain_hint";
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3506,6 +3513,12 @@
         base64Encode: () => {
             throw createClientAuthError(methodNotImplemented);
         },
+        base64UrlEncode: () => {
+            throw createClientAuthError(methodNotImplemented);
+        },
+        encodeKid: () => {
+            throw createClientAuthError(methodNotImplemented);
+        },
         async getPublicKeyThumbprint() {
             throw createClientAuthError(methodNotImplemented);
         },
@@ -3523,7 +3536,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3714,12 +3727,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.10.0";
+    const version$1 = "14.12.0";
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3919,7 +3932,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3959,7 +3972,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4021,7 +4034,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4043,7 +4056,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4290,7 +4303,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4298,7 +4311,7 @@
     const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
     const cacheUnknownErrorCode = "cache_error_unknown";
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4325,7 +4338,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5464,7 +5477,7 @@
         /**
          * Returns true if the credential's keyId matches the one in the request, false otherwise
          * @param entity
-         * @param tokenType
+         * @param keyId
          */
         matchKeyId(entity, keyId) {
             return !!(entity.keyId && entity.keyId === keyId);
@@ -5580,7 +5593,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5678,7 +5691,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5696,7 +5709,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5794,7 +5807,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5831,7 +5844,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5841,7 +5854,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5925,7 +5938,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6309,7 +6322,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6412,7 +6425,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6438,7 +6451,7 @@
         refreshTokenExpired: refreshTokenExpired
     });
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6526,7 +6539,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6542,7 +6555,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6614,7 +6627,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6639,11 +6652,10 @@
         async generateCnf(request, logger) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
             const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-            const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+            const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
             return {
                 kid: reqCnf.kid,
                 reqCnfString,
-                reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
             };
         }
         /**
@@ -6699,7 +6711,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6726,7 +6738,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6994,7 +7006,13 @@
             let refreshOn;
             let familyId = Constants.EMPTY_STRING;
             if (cacheRecord.accessToken) {
-                if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+                /*
+                 * if the request object has `popKid` property, `signPopToken` will be set to false and
+                 * the token will be returned unsigned
+                 */
+                if (cacheRecord.accessToken.tokenType ===
+                    AuthenticationScheme.POP &&
+                    !request.popKid) {
                     const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                     const { secret, keyId } = cacheRecord.accessToken;
                     if (!keyId) {
@@ -7090,7 +7108,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7258,9 +7276,16 @@
             parameterBuilder.addClientInfo();
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+                parameterBuilder.addPopToken(reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
@@ -7454,9 +7479,16 @@
                 // pass the req_cnf for POP
                 if (request.authenticationScheme === AuthenticationScheme.POP) {
                     const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                    // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                    const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                    parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                    // req_cnf is always sent as a string for SPAs
+                    let reqCnfData;
+                    if (!request.popKid) {
+                        const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                        reqCnfData = generatedReqCnfData.reqCnfString;
+                    }
+                    else {
+                        reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                    }
+                    parameterBuilder.addPopToken(reqCnfData);
                 }
             }
             return parameterBuilder.createQueryString();
@@ -7499,7 +7531,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7664,9 +7696,16 @@
             }
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
                 // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-                parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+                parameterBuilder.addPopToken(reqCnfData);
             }
             else if (request.authenticationScheme === AuthenticationScheme.SSH) {
                 if (request.sshJwk) {
@@ -7706,7 +7745,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7842,7 +7881,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7857,7 +7896,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7865,7 +7904,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7890,7 +7929,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7930,7 +7969,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7988,7 +8027,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8192,7 +8231,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8271,7 +8310,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.10.0 2024-05-28 */
+    /*! @azure/msal-common v14.12.0 2024-06-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8910,6 +8949,7 @@
     const uninitializedPublicClientApplication = "uninitialized_public_client_application";
     const nativePromptNotSupported = "native_prompt_not_supported";
     const invalidBase64String = "invalid_base64_string";
+    const invalidPopTokenRequest = "invalid_pop_token_request";
 
     var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -8932,6 +8972,7 @@
         interactionInProgress: interactionInProgress,
         invalidBase64String: invalidBase64String,
         invalidCacheType: invalidCacheType,
+        invalidPopTokenRequest: invalidPopTokenRequest,
         monitorPopupTimeout: monitorPopupTimeout,
         monitorWindowTimeout: monitorWindowTimeout,
         nativeConnectionNotEstablished: nativeConnectionNotEstablished,
@@ -9014,6 +9055,7 @@
         [uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
         [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
         [invalidBase64String]: "Invalid base64 encoded string.",
+        [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
     };
     /**
      * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9204,6 +9246,10 @@
             code: invalidBase64String,
             desc: BrowserAuthErrorMessages[invalidBase64String],
         },
+        invalidPopTokenRequest: {
+            code: invalidPopTokenRequest,
+            desc: BrowserAuthErrorMessages[invalidPopTokenRequest],
+        },
     };
     /**
      * Browser library error class thrown by the MSAL.js library for SPAs
@@ -10135,7 +10181,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.15.0";
+    const version = "3.17.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10951,6 +10997,21 @@
         base64Decode(input) {
             return base64Decode(input);
         }
+        /**
+         * Encodes input string to base64 URL safe string.
+         * @param input
+         */
+        base64UrlEncode(input) {
+            return urlEncode(input);
+        }
+        /**
+         * Stringifies and base64Url encodes input public key
+         * @param inputKid
+         * @returns Base64Url encoded public key
+         */
+        encodeKid(inputKid) {
+            return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+        }
         /**
          * Generates a keypair, stores it and returns a thumbprint
          * @param request
@@ -13291,10 +13352,11 @@
                 // continue with a native call for any and all errors
                 this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
             }
+            const { ...nativeTokenRequest } = nativeRequest;
             // fall back to native calls
             const messageBody = {
                 method: NativeExtensionMethod.GetToken,
-                request: nativeRequest,
+                request: nativeTokenRequest,
             };
             const response = await this.nativeMessageHandler.sendMessage(messageBody);
             const validatedResponse = this.validateNativeResponse(response);
@@ -13370,14 +13432,16 @@
         }
         /**
          * Acquires a token from native platform then redirects to the redirectUri instead of returning the response
-         * @param request
+         * @param {RedirectRequest} request
+         * @param {InProgressPerformanceEvent} rootMeasurement
          */
-        async acquireTokenRedirect(request) {
+        async acquireTokenRedirect(request, rootMeasurement) {
             this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
             const nativeRequest = await this.initializeNativeRequest(request);
+            const { ...nativeTokenRequest } = nativeRequest;
             const messageBody = {
                 method: NativeExtensionMethod.GetToken,
-                request: nativeRequest,
+                request: nativeTokenRequest,
             };
             try {
                 const response = await this.nativeMessageHandler.sendMessage(messageBody);
@@ -13398,6 +13462,7 @@
             const redirectUri = this.config.auth.navigateToLoginRequestUrl
                 ? window.location.href
                 : this.getRedirectUri(request.redirectUri);
+            rootMeasurement.end({ success: true });
             await this.navigationClient.navigateExternal(redirectUri, navigationOptions); // Need to treat this as external to ensure handleRedirectPromise is run again
         }
         /**
@@ -13479,7 +13544,7 @@
             const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
             // cache accounts and tokens in the appropriate storage
             this.cacheAccount(baseAccount);
-            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.accessToken, result.tenantId, reqTimestamp);
+            this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
             return result;
         }
         /**
@@ -13510,7 +13575,8 @@
          * @param response
          */
         async generatePopAccessToken(response, request) {
-            if (request.tokenType === AuthenticationScheme.POP) {
+            if (request.tokenType === AuthenticationScheme.POP &&
+                request.signPopToken) {
                 /**
                  * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
                  * is still received, SHR is calculated locally
@@ -13630,7 +13696,7 @@
                     : response.expires_in) || 0;
             const tokenExpirationSeconds = reqTimestamp + expiresIn;
             const responseScopes = this.generateScopes(response, request);
-            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode);
+            const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
             const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
             void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
         }
@@ -13760,8 +13826,13 @@
                     ...request.extraQueryParameters,
                     ...request.tokenQueryParameters,
                 },
-                extendedExpiryToken: false, // Make this configurable?
+                extendedExpiryToken: false,
+                keyId: request.popKid,
             };
+            // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+            if (validatedRequest.signPopToken && !!request.popKid) {
+                throw createBrowserAuthError(invalidPopTokenRequest);
+            }
             this.handleExtraBrokerParams(validatedRequest);
             validatedRequest.extraParameters =
                 validatedRequest.extraParameters || {};
@@ -13776,10 +13847,20 @@
                     shrNonce: request.shrNonce,
                 };
                 const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-                validatedRequest.keyId = reqCnfData.kid;
+                // generate reqCnf if not provided in the request
+                let reqCnfData;
+                if (!validatedRequest.keyId) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                    validatedRequest.keyId = generatedReqCnfData.kid;
+                    validatedRequest.signPopToken = true;
+                }
+                else {
+                    reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                    validatedRequest.signPopToken = false;
+                }
+                // SPAs require whole string to be passed to broker
+                validatedRequest.reqCnf = reqCnfData;
             }
             return validatedRequest;
         }
@@ -15836,7 +15917,7 @@
             const correlationId = useNative
                 ? request?.correlationId
                 : this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
-            const rootMeasurement = this.performanceClient.startMeasurement("acquireTokenRedirect", correlationId);
+            const rootMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenRedirect, correlationId);
             this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
             let redirectResponse;
             if (useNative && this.nativeExtensionProvider) {
@@ -15911,43 +15992,64 @@
             // Preflight request
             const correlationId = this.getRequestCorrelationId(request);
             this.logger.verbose("acquireTokenRedirect called", correlationId);
-            redirectPreflightCheck(this.initialized, this.config);
-            this.browserStorage.setInteractionInProgress(true);
+            const atrMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenPreRedirect, correlationId);
+            atrMeasurement.add({
+                accountType: getAccountType(request.account),
+                scenarioId: request.scenarioId,
+            });
+            const onRedirectNavigateCb = request.onRedirectNavigate;
+            request.onRedirectNavigate = (url) => {
+                const navigate = typeof onRedirectNavigateCb === "function"
+                    ? onRedirectNavigateCb(url)
+                    : undefined;
+                if (navigate !== false) {
+                    atrMeasurement.end({ success: true });
+                }
+                else {
+                    atrMeasurement.discard();
+                }
+                return navigate;
+            };
             // If logged in, emit acquire token events
             const isLoggedIn = this.getAllAccounts().length > 0;
-            if (isLoggedIn) {
-                this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Redirect, request);
-            }
-            else {
-                this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
-            }
-            let result;
-            if (this.nativeExtensionProvider && this.canUseNative(request)) {
-                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
-                result = nativeClient
-                    .acquireTokenRedirect(request)
-                    .catch((e) => {
-                    if (e instanceof NativeAuthError &&
-                        isFatalNativeAuthError(e)) {
-                        this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient = this.createRedirectClient(correlationId);
-                        return redirectClient.acquireToken(request);
-                    }
-                    else if (e instanceof InteractionRequiredAuthError) {
-                        this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
-                        const redirectClient = this.createRedirectClient(correlationId);
-                        return redirectClient.acquireToken(request);
-                    }
-                    this.browserStorage.setInteractionInProgress(false);
-                    throw e;
-                });
-            }
-            else {
-                const redirectClient = this.createRedirectClient(correlationId);
-                result = redirectClient.acquireToken(request);
+            try {
+                redirectPreflightCheck(this.initialized, this.config);
+                this.browserStorage.setInteractionInProgress(true);
+                if (isLoggedIn) {
+                    this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Redirect, request);
+                }
+                else {
+                    this.eventHandler.emitEvent(EventType.LOGIN_START, exports.InteractionType.Redirect, request);
+                }
+                let result;
+                if (this.nativeExtensionProvider && this.canUseNative(request)) {
+                    const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
+                    result = nativeClient
+                        .acquireTokenRedirect(request, atrMeasurement)
+                        .catch((e) => {
+                        if (e instanceof NativeAuthError &&
+                            isFatalNativeAuthError(e)) {
+                            this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
+                            const redirectClient = this.createRedirectClient(correlationId);
+                            return redirectClient.acquireToken(request);
+                        }
+                        else if (e instanceof InteractionRequiredAuthError) {
+                            this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
+                            const redirectClient = this.createRedirectClient(correlationId);
+                            return redirectClient.acquireToken(request);
+                        }
+                        this.browserStorage.setInteractionInProgress(false);
+                        throw e;
+                    });
+                }
+                else {
+                    const redirectClient = this.createRedirectClient(correlationId);
+                    result = redirectClient.acquireToken(request);
+                }
+                return await result;
             }
-            return result.catch((e) => {
-                // If logged in, emit acquire token events
+            catch (e) {
+                atrMeasurement.end({ success: false }, e);
                 if (isLoggedIn) {
                     this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, e);
                 }
@@ -15955,7 +16057,7 @@
                     this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Redirect, null, e);
                 }
                 throw e;
-            });
+            }
         }
         // #endregion
         // #region Popup Flow