@azure/msal-browser 3.16.0 → 3.17.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.16.0 2024-06-04 */
+/*! @azure/msal-browser v3.17.0 2024-06-10 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -310,7 +310,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -327,7 +327,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -376,7 +376,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -474,7 +474,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -726,7 +726,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -787,7 +787,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -802,7 +802,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -814,7 +814,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -868,7 +868,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1006,7 +1006,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1103,7 +1103,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1150,7 +1150,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1314,7 +1314,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1454,7 +1454,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1467,7 +1467,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1487,7 +1487,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1497,7 +1497,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1507,7 +1507,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1989,7 +1989,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2085,7 +2085,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2194,7 +2194,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2231,7 +2231,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2558,7 +2558,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3397,7 +3397,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3428,7 +3428,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3446,7 +3446,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3493,7 +3493,7 @@ const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3509,6 +3509,12 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     base64Encode: () => {
         throw createClientAuthError(methodNotImplemented);
     },
+    base64UrlEncode: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
+    encodeKid: () => {
+        throw createClientAuthError(methodNotImplemented);
+    },
     async getPublicKeyThumbprint() {
         throw createClientAuthError(methodNotImplemented);
     },
@@ -3526,7 +3532,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3717,12 +3723,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.11.0";
+const version$1 = "14.12.0";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3922,7 +3928,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3962,7 +3968,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4024,7 +4030,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4046,7 +4052,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4293,7 +4299,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4301,7 +4307,7 @@ class AccountEntity {
 const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
 const cacheUnknownErrorCode = "cache_error_unknown";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4328,7 +4334,7 @@ class CacheError extends Error {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5467,7 +5473,7 @@ class CacheManager {
     /**
      * Returns true if the credential's keyId matches the one in the request, false otherwise
      * @param entity
-     * @param tokenType
+     * @param keyId
      */
     matchKeyId(entity, keyId) {
         return !!(entity.keyId && entity.keyId === keyId);
@@ -5583,7 +5589,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5681,7 +5687,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5699,7 +5705,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5797,7 +5803,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5834,7 +5840,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5844,7 +5850,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5928,7 +5934,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6312,7 +6318,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6415,7 +6421,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6441,7 +6447,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6529,7 +6535,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6545,7 +6551,7 @@ class CacheRecord {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6617,7 +6623,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6642,11 +6648,10 @@ class PopTokenGenerator {
     async generateCnf(request, logger) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.PopTokenGenerateCnf, request.correlationId);
         const reqCnf = await invokeAsync(this.generateKid.bind(this), PerformanceEvents.PopTokenGenerateCnf, logger, this.performanceClient, request.correlationId)(request);
-        const reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+        const reqCnfString = this.cryptoUtils.base64UrlEncode(JSON.stringify(reqCnf));
         return {
             kid: reqCnf.kid,
             reqCnfString,
-            reqCnfHash: await this.cryptoUtils.hashString(reqCnfString),
         };
     }
     /**
@@ -6702,7 +6707,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6729,7 +6734,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6997,7 +7002,13 @@ class ResponseHandler {
         let refreshOn;
         let familyId = Constants.EMPTY_STRING;
         if (cacheRecord.accessToken) {
-            if (cacheRecord.accessToken.tokenType === AuthenticationScheme.POP) {
+            /*
+             * if the request object has `popKid` property, `signPopToken` will be set to false and
+             * the token will be returned unsigned
+             */
+            if (cacheRecord.accessToken.tokenType ===
+                AuthenticationScheme.POP &&
+                !request.popKid) {
                 const popTokenGenerator = new PopTokenGenerator(cryptoObj);
                 const { secret, keyId } = cacheRecord.accessToken;
                 if (!keyId) {
@@ -7093,7 +7104,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7261,9 +7272,16 @@ class AuthorizationCodeClient extends BaseClient {
         parameterBuilder.addClientInfo();
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7457,9 +7475,16 @@ class AuthorizationCodeClient extends BaseClient {
             // pass the req_cnf for POP
             if (request.authenticationScheme === AuthenticationScheme.POP) {
                 const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
-                parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                // req_cnf is always sent as a string for SPAs
+                let reqCnfData;
+                if (!request.popKid) {
+                    const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                    reqCnfData = generatedReqCnfData.reqCnfString;
+                }
+                else {
+                    reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+                }
+                parameterBuilder.addPopToken(reqCnfData);
             }
         }
         return parameterBuilder.createQueryString();
@@ -7502,7 +7527,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7667,9 +7692,16 @@ class RefreshTokenClient extends BaseClient {
         }
         if (request.authenticationScheme === AuthenticationScheme.POP) {
             const popTokenGenerator = new PopTokenGenerator(this.cryptoUtils, this.performanceClient);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+            let reqCnfData;
+            if (!request.popKid) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(request, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+            }
+            else {
+                reqCnfData = this.cryptoUtils.encodeKid(request.popKid);
+            }
             // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
-            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
+            parameterBuilder.addPopToken(reqCnfData);
         }
         else if (request.authenticationScheme === AuthenticationScheme.SSH) {
             if (request.sshJwk) {
@@ -7709,7 +7741,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7845,7 +7877,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7860,7 +7892,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7868,7 +7900,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7893,7 +7925,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7933,7 +7965,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7991,7 +8023,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8195,7 +8227,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8274,7 +8306,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.11.0 2024-06-04 */
+/*! @azure/msal-common v14.12.0 2024-06-10 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8913,6 +8945,7 @@ const nativeConnectionNotEstablished = "native_connection_not_established";
 const uninitializedPublicClientApplication = "uninitialized_public_client_application";
 const nativePromptNotSupported = "native_prompt_not_supported";
 const invalidBase64String = "invalid_base64_string";
+const invalidPopTokenRequest = "invalid_pop_token_request";
 
 var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -8935,6 +8968,7 @@ var BrowserAuthErrorCodes = /*#__PURE__*/Object.freeze({
     interactionInProgress: interactionInProgress,
     invalidBase64String: invalidBase64String,
     invalidCacheType: invalidCacheType,
+    invalidPopTokenRequest: invalidPopTokenRequest,
     monitorPopupTimeout: monitorPopupTimeout,
     monitorWindowTimeout: monitorWindowTimeout,
     nativeConnectionNotEstablished: nativeConnectionNotEstablished,
@@ -9017,6 +9051,7 @@ const BrowserAuthErrorMessages = {
     [uninitializedPublicClientApplication]: `You must call and await the initialize function before attempting to call any other MSAL API.  ${ErrorLink}`,
     [nativePromptNotSupported]: "The provided prompt is not supported by the native platform. This request should be routed to the web based flow.",
     [invalidBase64String]: "Invalid base64 encoded string.",
+    [invalidPopTokenRequest]: "Invalid PoP token request. The request should not have both a popKid value and signPopToken set to true.",
 };
 /**
  * BrowserAuthErrorMessage class containing string constants used by error codes and messages.
@@ -9207,6 +9242,10 @@ const BrowserAuthErrorMessage = {
         code: invalidBase64String,
         desc: BrowserAuthErrorMessages[invalidBase64String],
     },
+    invalidPopTokenRequest: {
+        code: invalidPopTokenRequest,
+        desc: BrowserAuthErrorMessages[invalidPopTokenRequest],
+    },
 };
 /**
  * Browser library error class thrown by the MSAL.js library for SPAs
@@ -10138,7 +10177,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.16.0";
+const version = "3.17.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10954,6 +10993,21 @@ class CryptoOps {
     base64Decode(input) {
         return base64Decode(input);
     }
+    /**
+     * Encodes input string to base64 URL safe string.
+     * @param input
+     */
+    base64UrlEncode(input) {
+        return urlEncode(input);
+    }
+    /**
+     * Stringifies and base64Url encodes input public key
+     * @param inputKid
+     * @returns Base64Url encoded public key
+     */
+    encodeKid(inputKid) {
+        return this.base64UrlEncode(JSON.stringify({ kid: inputKid }));
+    }
     /**
      * Generates a keypair, stores it and returns a thumbprint
      * @param request
@@ -13294,10 +13348,11 @@ class NativeInteractionClient extends BaseInteractionClient {
             // continue with a native call for any and all errors
             this.logger.info("MSAL internal Cache does not contain tokens, proceed to make a native call");
         }
+        const { ...nativeTokenRequest } = nativeRequest;
         // fall back to native calls
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         const response = await this.nativeMessageHandler.sendMessage(messageBody);
         const validatedResponse = this.validateNativeResponse(response);
@@ -13379,9 +13434,10 @@ class NativeInteractionClient extends BaseInteractionClient {
     async acquireTokenRedirect(request, rootMeasurement) {
         this.logger.trace("NativeInteractionClient - acquireTokenRedirect called.");
         const nativeRequest = await this.initializeNativeRequest(request);
+        const { ...nativeTokenRequest } = nativeRequest;
         const messageBody = {
             method: NativeExtensionMethod.GetToken,
-            request: nativeRequest,
+            request: nativeTokenRequest,
         };
         try {
             const response = await this.nativeMessageHandler.sendMessage(messageBody);
@@ -13484,7 +13540,7 @@ class NativeInteractionClient extends BaseInteractionClient {
         const result = await this.generateAuthenticationResult(response, request, idTokenClaims, baseAccount, authority.canonicalAuthority, reqTimestamp);
         // cache accounts and tokens in the appropriate storage
         this.cacheAccount(baseAccount);
-        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, result.accessToken, result.tenantId, reqTimestamp);
+        this.cacheNativeTokens(response, request, homeAccountIdentifier, idTokenClaims, response.access_token, result.tenantId, reqTimestamp);
         return result;
     }
     /**
@@ -13515,7 +13571,8 @@ class NativeInteractionClient extends BaseInteractionClient {
      * @param response
      */
     async generatePopAccessToken(response, request) {
-        if (request.tokenType === AuthenticationScheme.POP) {
+        if (request.tokenType === AuthenticationScheme.POP &&
+            request.signPopToken) {
             /**
              * This code prioritizes SHR returned from the native layer. In case of error/SHR not calculated from WAM and the AT
              * is still received, SHR is calculated locally
@@ -13635,7 +13692,7 @@ class NativeInteractionClient extends BaseInteractionClient {
                 : response.expires_in) || 0;
         const tokenExpirationSeconds = reqTimestamp + expiresIn;
         const responseScopes = this.generateScopes(response, request);
-        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode);
+        const cachedAccessToken = createAccessTokenEntity(homeAccountIdentifier, request.authority, responseAccessToken, request.clientId, idTokenClaims.tid || tenantId, responseScopes.printScopes(), tokenExpirationSeconds, 0, base64Decode, undefined, request.tokenType, undefined, request.keyId);
         const nativeCacheRecord = new CacheRecord(undefined, cachedIdToken, cachedAccessToken);
         void this.nativeStorageManager.saveCacheRecord(nativeCacheRecord, request.storeInCache);
     }
@@ -13765,8 +13822,13 @@ class NativeInteractionClient extends BaseInteractionClient {
                 ...request.extraQueryParameters,
                 ...request.tokenQueryParameters,
             },
-            extendedExpiryToken: false, // Make this configurable?
+            extendedExpiryToken: false,
+            keyId: request.popKid,
         };
+        // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
+        if (validatedRequest.signPopToken && !!request.popKid) {
+            throw createBrowserAuthError(invalidPopTokenRequest);
+        }
         this.handleExtraBrokerParams(validatedRequest);
         validatedRequest.extraParameters =
             validatedRequest.extraParameters || {};
@@ -13781,10 +13843,20 @@ class NativeInteractionClient extends BaseInteractionClient {
                 shrNonce: request.shrNonce,
             };
             const popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
-            const reqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, this.correlationId)(shrParameters, this.logger);
-            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-            validatedRequest.reqCnf = reqCnfData.reqCnfHash;
-            validatedRequest.keyId = reqCnfData.kid;
+            // generate reqCnf if not provided in the request
+            let reqCnfData;
+            if (!validatedRequest.keyId) {
+                const generatedReqCnfData = await invokeAsync(popTokenGenerator.generateCnf.bind(popTokenGenerator), PerformanceEvents.PopTokenGenerateCnf, this.logger, this.performanceClient, request.correlationId)(shrParameters, this.logger);
+                reqCnfData = generatedReqCnfData.reqCnfString;
+                validatedRequest.keyId = generatedReqCnfData.kid;
+                validatedRequest.signPopToken = true;
+            }
+            else {
+                reqCnfData = this.browserCrypto.base64UrlEncode(JSON.stringify({ kid: validatedRequest.keyId }));
+                validatedRequest.signPopToken = false;
+            }
+            // SPAs require whole string to be passed to broker
+            validatedRequest.reqCnf = reqCnfData;
         }
         return validatedRequest;
     }