@azure/msal-browser 3.4.0 → 3.5.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.4.0 2023-10-30 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -54,7 +54,6 @@ const Constants = {
     IMDS_TIMEOUT: 2000,
     AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
     REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-    REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
     KNOWN_PUBLIC_CLOUDS: [
         "login.microsoftonline.com",
         "login.windows.net",
@@ -359,13 +358,13 @@ const CacheOutcome = {
     // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
     PROACTIVELY_REFRESHED: "4",
 };
-const JsonTypes = {
+const JsonWebTokenTypes = {
     Jwt: "JWT",
     Jwk: "JWK",
     Pop: "pop",
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -382,7 +381,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -431,7 +430,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -529,7 +528,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -781,7 +780,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -814,7 +813,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1005,12 +1004,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.3.0";
+const version$1 = "14.4.0";
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1030,7 +1029,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1091,7 +1090,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1138,7 +1137,7 @@ class TimeUtils {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1355,8 +1354,24 @@ function generateScheme(credentialEntity) {
         ? credentialEntity.tokenType.toLowerCase()
         : "";
 }
+/**
+ * validates if a given cache entry is "Telemetry", parses <key,value>
+ * @param key
+ * @param entity
+ */
+function isServerTelemetryEntity(key, entity) {
+    const validateKey = key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+    let validateEntity = true;
+    if (entity) {
+        validateEntity =
+            entity.hasOwnProperty("failedRequests") &&
+                entity.hasOwnProperty("errors") &&
+                entity.hasOwnProperty("cacheHits");
+    }
+    return validateKey && validateEntity;
+}
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1410,7 +1425,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1548,7 +1563,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1645,7 +1660,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1845,7 +1860,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1885,7 +1900,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1900,7 +1915,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1913,7 +1928,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2134,7 +2149,54 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Parses hash string from given string. Returns empty string if no hash symbol is found.
+ * @param hashString
+ */
+function stripLeadingHashOrQuery(responseString) {
+    if (responseString.startsWith("#/")) {
+        return responseString.substring(2);
+    }
+    else if (responseString.startsWith("#") ||
+        responseString.startsWith("?")) {
+        return responseString.substring(1);
+    }
+    return responseString;
+}
+/**
+ * Returns URL hash as server auth code response object.
+ */
+function getDeserializedResponse(responseString) {
+    // Check if given hash is empty
+    if (!responseString || responseString.indexOf("=") < 0) {
+        return null;
+    }
+    try {
+        // Strip the # or ? symbol if present
+        const normalizedResponse = stripLeadingHashOrQuery(responseString);
+        // If # symbol was not present, above will return empty string, so give original hash value
+        const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
+        // Check for known response properties
+        if (deserializedHash.code ||
+            deserializedHash.error ||
+            deserializedHash.error_description ||
+            deserializedHash.state) {
+            return deserializedHash;
+        }
+    }
+    catch (e) {
+        throw createClientAuthError(hashNotDeserialized);
+    }
+    return null;
+}
+
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2153,7 +2215,7 @@ class UrlString {
             // Throws error if url is empty
             throw createClientConfigurationError(urlEmptyError);
         }
-        if (!this.getHash()) {
+        if (!url.includes("#")) {
             this._urlString = UrlString.canonicalizeUri(url);
         }
     }
@@ -2235,12 +2297,6 @@ class UrlString {
         }
         return UrlString.constructAuthorityUriFromObject(urlObject);
     }
-    /**
-     * Returns the anchor part(#) of the URL
-     */
-    getHash() {
-        return UrlString.parseHash(this.urlString);
-    }
     /**
      * Parses out the components from a url string.
      * @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
@@ -2288,60 +2344,6 @@ class UrlString {
         }
         return relativeUrl;
     }
-    /**
-     * Parses hash string from given string. Returns empty string if no hash symbol is found.
-     * @param hashString
-     */
-    static parseHash(hashString) {
-        const hashIndex1 = hashString.indexOf("#");
-        const hashIndex2 = hashString.indexOf("#/");
-        if (hashIndex2 > -1) {
-            return hashString.substring(hashIndex2 + 2);
-        }
-        else if (hashIndex1 > -1) {
-            return hashString.substring(hashIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
-    /**
-     * Parses query string from given string. Returns empty string if no query symbol is found.
-     * @param queryString
-     */
-    static parseQueryString(queryString) {
-        const queryIndex1 = queryString.indexOf("?");
-        const queryIndex2 = queryString.indexOf("/?");
-        if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        }
-        else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
-    /**
-     * Parses query server response string from given string.
-     * Extract hash between '?code=' and '#' if trailing '# is present.
-     * Returns empty string if no query symbol is found.
-     * @param queryString
-     */
-    static parseQueryServerResponse(queryString) {
-        const queryIndex1 = queryString.indexOf("?code");
-        const queryIndex2 = queryString.indexOf("/?code");
-        const hashIndex = queryString.indexOf("#");
-        if (queryIndex2 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex2 + 2, hashIndex);
-        }
-        else if (queryIndex2 > -1) {
-            return queryString.substring(queryIndex2 + 2);
-        }
-        else if (queryIndex1 > -1 && hashIndex > -1) {
-            return queryString.substring(queryIndex1 + 1, hashIndex);
-        }
-        else if (queryIndex1 > -1) {
-            return queryString.substring(queryIndex1 + 1);
-        }
-        return Constants.EMPTY_STRING;
-    }
     static constructAuthorityUriFromObject(urlObject) {
         return new UrlString(urlObject.Protocol +
             "//" +
@@ -2349,74 +2351,16 @@ class UrlString {
             "/" +
             urlObject.PathSegments.join("/"));
     }
-    /**
-     * Returns URL hash as server auth code response object.
-     */
-    static getDeserializedHash(hash) {
-        // Check if given hash is empty
-        if (!hash) {
-            return {};
-        }
-        // Strip the # symbol if present
-        const parsedHash = UrlString.parseHash(hash);
-        // If # symbol was not present, above will return empty string, so give original hash value
-        const deserializedHash = StringUtils.queryStringToObject(parsedHash || hash);
-        // Check if deserialization didn't work
-        if (!deserializedHash) {
-            throw createClientAuthError(hashNotDeserialized);
-        }
-        return deserializedHash;
-    }
-    /**
-     * Returns URL query string as server auth code response object.
-     */
-    static getDeserializedQueryString(query) {
-        // Check if given query is empty
-        if (!query) {
-            return {};
-        }
-        // Strip the ? symbol if present
-        const parsedQueryString = UrlString.parseQueryString(query);
-        // If ? symbol was not present, above will return empty string, so give original query value
-        const deserializedQueryString = StringUtils.queryStringToObject(parsedQueryString || query);
-        // Check if deserialization didn't work
-        if (!deserializedQueryString) {
-            throw createClientAuthError(hashNotDeserialized);
-        }
-        return deserializedQueryString;
-    }
-    /**
-     * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
-     * as a server auth code response object.
-     */
-    static getDeserializedCodeResponse(serverResponseType, hashFragment) {
-        const hashUrlString = new UrlString(hashFragment);
-        let serverParams;
-        if (serverResponseType === ServerResponseType.QUERY) {
-            serverParams = UrlString.getDeserializedQueryString(hashFragment);
-        }
-        else {
-            serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
-        }
-        return serverParams;
-    }
     /**
      * Check if the hash of the URL string contains known properties
+     * @deprecated This API will be removed in a future version
      */
-    static hashContainsKnownProperties(hash) {
-        if (!hash || hash.indexOf("=") < 0) {
-            // Hash doesn't contain key/value pairs
-            return false;
-        }
-        const parameters = UrlString.getDeserializedHash(hash);
-        return !!(parameters.code ||
-            parameters.error_description ||
-            parameters.error ||
-            parameters.state);
+    static hashContainsKnownProperties(response) {
+        return !!getDeserializedResponse(response);
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3022,7 +2966,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3502,18 +3446,18 @@ class CacheManager {
     }
     /**
      * Retrieve the cached credentials into a cacherecord
-     * @param account
-     * @param clientId
-     * @param scopes
-     * @param environment
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param environment {string}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
-    readCacheRecord(account, request, environment) {
+    readCacheRecord(account, request, environment, performanceClient, correlationId) {
         const tokenKeys = this.getTokenKeys();
         const cachedAccount = this.readAccountFromCache(account);
-        const cachedIdToken = this.getIdToken(account, tokenKeys);
-        const cachedAccessToken = this.getAccessToken(account, request, tokenKeys);
-        const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
+        const cachedIdToken = this.getIdToken(account, tokenKeys, performanceClient, correlationId);
+        const cachedAccessToken = this.getAccessToken(account, request, tokenKeys, performanceClient, correlationId);
+        const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys, performanceClient, correlationId);
         const cachedAppMetadata = this.readAppMetadataFromCache(environment);
         if (cachedAccount && cachedIdToken) {
             cachedAccount.idTokenClaims = extractTokenClaims(cachedIdToken.secret, this.cryptoImpl.base64Decode);
@@ -3536,11 +3480,12 @@ class CacheManager {
     }
     /**
      * Retrieve IdTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param inputRealm
+     * @param account {AccountInfo}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
-    getIdToken(account, tokenKeys) {
+    getIdToken(account, tokenKeys, performanceClient, correlationId) {
         this.commonLogger.trace("CacheManager - getIdToken called");
         const idTokenFilter = {
             homeAccountId: account.homeAccountId,
@@ -3560,6 +3505,9 @@ class CacheManager {
             idTokens.forEach((idToken) => {
                 this.removeIdToken(generateCredentialKey(idToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields({ multiMatchedID: idTokens.length }, correlationId);
+            }
             return null;
         }
         this.commonLogger.info("CacheManager:getIdToken - Returning id token");
@@ -3621,12 +3569,13 @@ class CacheManager {
     }
     /**
      * Retrieve AccessTokenEntity from cache
-     * @param clientId
-     * @param account
-     * @param scopes
-     * @param authScheme
+     * @param account {AccountInfo}
+     * @param request {BaseAuthRequest}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
-    getAccessToken(account, request, tokenKeys) {
+    getAccessToken(account, request, tokenKeys, performanceClient, correlationId) {
         this.commonLogger.trace("CacheManager - getAccessToken called");
         const scopes = ScopeSet.createSearchScopes(request.scopes);
         const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -3674,6 +3623,9 @@ class CacheManager {
             accessTokens.forEach((accessToken) => {
                 void this.removeAccessToken(generateCredentialKey(accessToken));
             });
+            if (performanceClient && correlationId) {
+                performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
+            }
             return null;
         }
         this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
@@ -3742,11 +3694,13 @@ class CacheManager {
     }
     /**
      * Helper to retrieve the appropriate refresh token from cache
-     * @param clientId
-     * @param account
-     * @param familyRT
+     * @param account {AccountInfo}
+     * @param familyRT {boolean}
+     * @param tokenKeys {?TokenKeys}
+     * @param performanceClient {?IPerformanceClient}
+     * @param correlationId {?string}
      */
-    getRefreshToken(account, familyRT, tokenKeys) {
+    getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
         this.commonLogger.trace("CacheManager - getRefreshToken called");
         const id = familyRT ? THE_FAMILY_ID : undefined;
         const refreshTokenFilter = {
@@ -3776,6 +3730,9 @@ class CacheManager {
             return null;
         }
         // address the else case after remove functions address environment aliases
+        if (numRefreshTokens > 1 && performanceClient && correlationId) {
+            performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);
+        }
         this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token");
         return refreshTokens[0];
     }
@@ -4114,7 +4071,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4214,7 +4171,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4231,7 +4188,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4329,7 +4286,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4366,7 +4323,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4376,7 +4333,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4460,7 +4417,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4844,7 +4801,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4856,7 +4813,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4937,7 +4894,7 @@ class AuthorityMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4947,7 +4904,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4957,7 +4914,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5127,7 +5084,7 @@ const PerformanceEvents = {
      * Functions from InteractionHandler (msal-browser)
      */
     HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-    HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+    HandleCodeResponse: "handleCodeResponse",
     UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
     /**
      * APIs in Authorization Code Client (msal-common)
@@ -5145,6 +5102,7 @@ const PerformanceEvents = {
      * handleServerTokenResponse API in ResponseHandler (msal-common)
      */
     HandleServerTokenResponse: "handleServerTokenResponse",
+    DeserializeResponse: "deserializeResponse",
     /**
      * Authority functions
      */
@@ -5206,9 +5164,12 @@ const IntFields = new Set([
     "queuedTimeMs",
     "startTimeMs",
     "status",
+    "multiMatchedAT",
+    "multiMatchedID",
+    "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5294,7 +5255,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5403,7 +5364,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6131,9 +6092,8 @@ class Authority {
         const regionalMetadata = { ...metadata };
         regionalMetadata.authorization_endpoint =
             Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
-        // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
         regionalMetadata.token_endpoint =
-            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
+            Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
         if (regionalMetadata.end_session_endpoint) {
             regionalMetadata.end_session_endpoint =
                 Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
@@ -6195,7 +6155,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6245,7 +6205,7 @@ class AuthorityFactory {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6348,7 +6308,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6370,7 +6330,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     noTokensFound: noTokensFound
 });
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6449,7 +6409,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6465,7 +6425,7 @@ class CacheRecord {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6537,7 +6497,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6601,7 +6561,7 @@ class PopTokenGenerator {
      */
     async signPayload(payload, keyId, request, claims) {
         // Deconstruct request to extract SHR parameters
-        const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, } = request;
+        const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
         const resourceUrlString = resourceRequestUri
             ? new UrlString(resourceRequestUri)
             : undefined;
@@ -6618,11 +6578,11 @@ class PopTokenGenerator {
                 : undefined,
             client_claims: shrClaims || undefined,
             ...claims,
-        }, keyId, request.correlationId);
+        }, keyId, shrOptions, request.correlationId);
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6691,7 +6651,7 @@ class AppMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6718,7 +6678,7 @@ class AppMetadataEntity {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7033,7 +6993,7 @@ class ResponseHandler {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7090,22 +7050,16 @@ class AuthorizationCodeClient extends BaseClient {
      * the client to exchange for a token in acquireToken.
      * @param hashFragment
      */
-    handleFragmentResponse(hashFragment, cachedState) {
+    handleFragmentResponse(serverParams, cachedState) {
         // Handle responses.
         const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-        const serverParams = UrlString.getDeserializedCodeResponse(this.config.authOptions.authority.options.OIDCOptions
-            ?.serverResponseType, hashFragment);
         // Get code response
         responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
         // throw when there is no auth code in the response
         if (!serverParams.code) {
             throw createClientAuthError(authorizationCodeMissingFromServerResponse);
         }
-        return {
-            ...serverParams,
-            // Code param is optional in ServerAuthorizationCodeResponse but required in AuthorizationCodePaylod
-            code: serverParams.code,
-        };
+        return serverParams;
     }
     /**
      * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -7444,7 +7398,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7516,7 +7470,7 @@ class RefreshTokenClient extends BaseClient {
     async acquireTokenWithCachedRefreshToken(request, foci) {
         this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
         // fetches family RT or application RT based on FOCI value
-        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci);
+        const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
         if (!refreshToken) {
             throw createInteractionRequiredAuthError(noTokensFound);
         }
@@ -7633,7 +7587,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7696,7 +7650,7 @@ class SilentFlowClient extends BaseClient {
             throw createClientAuthError(noAccountInSilentRequest);
         }
         const environment = request.authority || this.authority.getPreferredCache();
-        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
+        const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment, this.performanceClient, request.correlationId);
         if (!cacheRecord.accessToken) {
             // must refresh due to non-existent access_token
             this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7728,7 +7682,9 @@ class SilentFlowClient extends BaseClient {
         this.performanceClient?.addFields({
             cacheOutcome: cacheOutcome,
         }, correlationId);
-        this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+        if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+            this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+        }
     }
     /**
      * Helper function to build response object from the CacheRecord
@@ -7752,37 +7708,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-class ServerTelemetryEntity {
-    constructor() {
-        this.failedRequests = [];
-        this.errors = [];
-        this.cacheHits = 0;
-    }
-    /**
-     * validates if a given cache entry is "Telemetry", parses <key,value>
-     * @param key
-     * @param entity
-     */
-    static isServerTelemetryEntity(key, entity) {
-        const validateKey = key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
-        let validateEntity = true;
-        if (entity) {
-            validateEntity =
-                entity.hasOwnProperty("failedRequests") &&
-                    entity.hasOwnProperty("errors") &&
-                    entity.hasOwnProperty("cacheHits");
-        }
-        return validateKey && validateEntity;
-    }
-}
-
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7808,7 +7734,7 @@ class ThrottlingEntity {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7823,7 +7749,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7831,7 +7757,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7856,7 +7782,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7888,7 +7814,7 @@ class JoseHeader {
         }
         const shrHeader = new JoseHeader({
             // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-            typ: shrHeaderOptions.typ || JsonTypes.Pop,
+            typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
             kid: shrHeaderOptions.kid,
             alg: shrHeaderOptions.alg,
         });
@@ -7896,7 +7822,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7954,7 +7880,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8066,7 +7992,11 @@ class ServerTelemetryManager {
      * Get the server telemetry entity from cache or initialize a new one
      */
     getLastRequests() {
-        const initialValue = new ServerTelemetryEntity();
+        const initialValue = {
+            failedRequests: [],
+            errors: [],
+            cacheHits: 0,
+        };
         const lastRequests = this.cacheManager.getServerTelemetry(this.telemetryCacheKey);
         return lastRequests || initialValue;
     }
@@ -8083,11 +8013,11 @@ class ServerTelemetryManager {
         }
         else {
             // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
-            const serverTelemEntity = new ServerTelemetryEntity();
-            serverTelemEntity.failedRequests =
-                lastRequests.failedRequests.slice(numErrorsFlushed * 2); // failedRequests contains 2 items for each error
-            serverTelemEntity.errors =
-                lastRequests.errors.slice(numErrorsFlushed);
+            const serverTelemEntity = {
+                failedRequests: lastRequests.failedRequests.slice(numErrorsFlushed * 2),
+                errors: lastRequests.errors.slice(numErrorsFlushed),
+                cacheHits: 0,
+            };
             this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
         }
     }
@@ -8154,7 +8084,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8566,7 +8496,7 @@ class PerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.3.0 2023-10-30 */
+/*! @azure/msal-common v14.4.0 2023-11-07 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9622,7 +9552,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.4.0";
+const version = "3.5.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10640,7 +10570,7 @@ class CryptoOps {
      * @param payload
      * @param kid
      */
-    async signJwt(payload, kid, correlationId) {
+    async signJwt(payload, kid, shrOptions, correlationId) {
         const signJwtMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.CryptoOptsSignJwt, correlationId);
         const cachedKeyPair = await this.cache.asymmetricKeys.getItem(kid);
         if (!cachedKeyPair) {
@@ -10653,8 +10583,9 @@ class CryptoOps {
         const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
         // Generate header
         const shrHeader = JoseHeader.getShrHeaderString({
-            kid: encodedKeyIdThumbprint,
+            ...shrOptions?.header,
             alg: publicKeyJwk.alg,
+            kid: encodedKeyIdThumbprint,
         });
         const encodedShrHeader = urlEncode(shrHeader);
         // Generate payload
@@ -10786,34 +10717,21 @@ class BrowserStorage {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-class BrowserProtocolUtils {
-    /**
-     * Extracts the BrowserStateObject from the state string.
-     * @param browserCrypto
-     * @param state
-     */
-    static extractBrowserRequestState(browserCrypto, state) {
-        if (!state) {
-            return null;
-        }
-        try {
-            const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
-            return requestStateObj.libraryState.meta;
-        }
-        catch (e) {
-            throw createClientAuthError(invalidState);
-        }
+/**
+ * Extracts the BrowserStateObject from the state string.
+ * @param browserCrypto
+ * @param state
+ */
+function extractBrowserRequestState(browserCrypto, state) {
+    if (!state) {
+        return null;
     }
-    /**
-     * Parses properties of server response from url hash
-     * @param locationHash Hash from url
-     */
-    static parseServerResponseFromHash(locationHash) {
-        if (!locationHash) {
-            return {};
-        }
-        const hashUrlString = new UrlString(locationHash);
-        return UrlString.getDeserializedHash(hashUrlString.getHash());
+    try {
+        const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
+        return requestStateObj.libraryState.meta;
+    }
+    catch (e) {
+        throw createClientAuthError(invalidState);
     }
 }
 
@@ -11392,14 +11310,14 @@ class BrowserCacheManager extends CacheManager {
             this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
             return null;
         }
-        const parsedMetadata = this.validateAndParseJson(value);
-        if (!parsedMetadata ||
-            !ServerTelemetryEntity.isServerTelemetryEntity(serverTelemetryKey, parsedMetadata)) {
+        const parsedEntity = this.validateAndParseJson(value);
+        if (!parsedEntity ||
+            !isServerTelemetryEntity(serverTelemetryKey, parsedEntity)) {
             this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
             return null;
         }
         this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit");
-        return CacheManager.toObject(new ServerTelemetryEntity(), parsedMetadata);
+        return parsedEntity;
     }
     /**
      * set server telemetry entity to the platform cache
@@ -11892,7 +11810,7 @@ class BrowserCacheManager extends CacheManager {
                 return;
             }
             // Extract state and ensure it matches given InteractionType, then clean request cache
-            const parsedState = BrowserProtocolUtils.extractBrowserRequestState(this.cryptoImpl, stateValue);
+            const parsedState = extractBrowserRequestState(this.cryptoImpl, stateValue);
             if (parsedState &&
                 parsedState.interactionType === interactionType) {
                 this.logger.infoPii(`BrowserCacheManager.cleanRequestByInteractionType: Removing temporary cache items for state: ${stateValue}`);
@@ -12283,7 +12201,7 @@ class BaseInteractionClient {
      * @param request
      */
     async initializeBaseRequest(request, account) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, request.correlationId);
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, this.correlationId);
         const authority = request.authority || this.config.auth.authority;
         if (account) {
             await this.validateRequestAuthority(authority, account);
@@ -12367,7 +12285,6 @@ class BaseInteractionClient {
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
-     * @param requestCorrelationId
      */
     async getDiscoveredAuthority(requestAuthority) {
         this.logger.verbose("getDiscoveredAuthority called");
@@ -12455,7 +12372,7 @@ class StandardInteractionClient extends BaseInteractionClient {
      * @param request
      */
     async initializeAuthorizationCodeRequest(request) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, request.correlationId);
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.correlationId);
         const generatedPkceParams = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
         const authCodeRequest = {
             ...request,
@@ -12604,25 +12521,6 @@ class StandardInteractionClient extends BaseInteractionClient {
             telemetry: this.config.telemetry,
         };
     }
-    /**
-     * @param hash
-     * @param interactionType
-     */
-    validateAndExtractStateFromHash(serverParams, interactionType, requestCorrelationId) {
-        this.logger.verbose("validateAndExtractStateFromHash called", requestCorrelationId);
-        if (!serverParams.state) {
-            throw createBrowserAuthError(noStateInHash);
-        }
-        const platformStateObj = BrowserProtocolUtils.extractBrowserRequestState(this.browserCrypto, serverParams.state);
-        if (!platformStateObj) {
-            throw createBrowserAuthError(unableToParseState);
-        }
-        if (platformStateObj.interactionType !== interactionType) {
-            throw createBrowserAuthError(stateInteractionTypeMismatch);
-        }
-        this.logger.verbose("Returning state from hash", requestCorrelationId);
-        return serverParams.state;
-    }
     /**
      * Used to get a discovered version of the default authority.
      * @param requestAuthority
@@ -13649,15 +13547,11 @@ class InteractionHandler {
      * Function to handle response parameters from hash.
      * @param locationHash
      */
-    async handleCodeResponseFromHash(locationHash, request) {
-        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromHash, request.correlationId);
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(hashEmptyError);
-        }
+    async handleCodeResponse(response, request) {
+        this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, request.state);
+            authCodeResponse = this.authModule.handleFragmentResponse(response, request.state);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -13728,6 +13622,43 @@ class InteractionHandler {
     }
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+function deserializeResponse(responseString, responseLocation, logger) {
+    // Deserialize hash fragment response parameters.
+    const serverParams = getDeserializedResponse(responseString);
+    if (!serverParams) {
+        if (!stripLeadingHashOrQuery(responseString)) {
+            // Hash or Query string is empty
+            logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
+            throw createBrowserAuthError(hashEmptyError);
+        }
+        else {
+            logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
+            logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
+            throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+        }
+    }
+    return serverParams;
+}
+/**
+ * Returns the interaction type that the response object belongs to
+ */
+function validateInteractionType(response, browserCrypto, interactionType) {
+    if (!response.state) {
+        throw createBrowserAuthError(noStateInHash);
+    }
+    const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+    if (!platformStateObj) {
+        throw createBrowserAuthError(unableToParseState);
+    }
+    if (platformStateObj.interactionType !== interactionType) {
+        throw createBrowserAuthError(stateInteractionTypeMismatch);
+    }
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -13836,9 +13767,8 @@ class PopupClient extends StandardInteractionClient {
             const popupWindow = this.initiateAuthRequest(navigateUrl, popupParameters);
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const hash = await this.monitorPopupForHash(popupWindow);
-            // Deserialize hash fragment response parameters.
-            const serverParams = UrlString.getDeserializedHash(hash);
+            const responseString = await this.monitorPopupForHash(popupWindow);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
             // Remove throttle if it exists
             ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
             if (serverParams.accountId) {
@@ -13862,7 +13792,7 @@ class PopupClient extends StandardInteractionClient {
                 });
             }
             // Handle response from hash string.
-            const result = await interactionHandler.handleCodeResponseFromHash(hash, validRequest);
+            const result = await interactionHandler.handleCodeResponse(serverParams, validRequest);
             return result;
         }
         catch (e) {
@@ -13929,7 +13859,9 @@ class PopupClient extends StandardInteractionClient {
                 popup,
             });
             this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
-            await this.waitForLogoutPopup(popupWindow);
+            await this.monitorPopupForHash(popupWindow).catch(() => {
+                // Swallow any errors related to monitoring the window. Server logout is best effort
+            });
             if (mainWindowRedirectUri) {
                 const navigationOptions = {
                     apiId: ApiId.logoutPopup,
@@ -13985,25 +13917,16 @@ class PopupClient extends StandardInteractionClient {
      */
     monitorPopupForHash(popupWindow) {
         return new Promise((resolve, reject) => {
-            /*
-             * Polling for popups needs to be tick-based,
-             * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
-             */
-            const maxTicks = this.config.system.windowHashTimeout /
-                this.config.system.pollIntervalMilliseconds;
-            let ticks = 0;
             this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
             const intervalId = setInterval(() => {
                 // Window is closed
                 if (popupWindow.closed) {
                     this.logger.error("PopupHandler.monitorPopupForHash - window closed");
-                    this.cleanPopup();
                     clearInterval(intervalId);
                     reject(createBrowserAuthError(userCancelled));
                     return;
                 }
-                let href = Constants.EMPTY_STRING;
-                let serverResponseString = Constants.EMPTY_STRING;
+                let href = "";
                 try {
                     /*
                      * Will throw if cross origin,
@@ -14011,77 +13934,28 @@ class PopupClient extends StandardInteractionClient {
                      * since we need the interval to keep running while on STS UI.
                      */
                     href = popupWindow.location.href;
-                    serverResponseString =
-                        this.extractServerResponseStringFromPopup(popupWindow, href);
                 }
                 catch (e) { }
                 // Don't process blank pages or cross domain
                 if (!href || href === "about:blank") {
                     return;
                 }
-                this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
-                /*
-                 * Only run clock when we are on same domain for popups
-                 * as popup operations can take a long time.
-                 */
-                ticks++;
-                if (serverResponseString) {
-                    this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
-                    clearInterval(intervalId);
-                    this.cleanPopup(popupWindow);
-                    if (UrlString.hashContainsKnownProperties(serverResponseString)) {
-                        this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
-                        resolve(serverResponseString);
+                clearInterval(intervalId);
+                let responseString = "";
+                const responseType = this.config.auth.OIDCOptions.serverResponseType;
+                if (popupWindow) {
+                    if (responseType === ServerResponseType.QUERY) {
+                        responseString = popupWindow.location.search;
                     }
                     else {
-                        this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
-                        this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`);
-                        reject(createBrowserAuthError(hashDoesNotContainKnownProperties));
+                        responseString = popupWindow.location.hash;
                     }
                 }
-                else if (ticks > maxTicks) {
-                    this.logger.error("PopupHandler.monitorPopupForHash - unable to find hash in url, timing out");
-                    clearInterval(intervalId);
-                    reject(createBrowserAuthError(monitorPopupTimeout));
-                }
-            }, this.config.system.pollIntervalMilliseconds);
-        });
-    }
-    /**
-     * Waits for user interaction in logout popup window
-     * @param popupWindow
-     * @returns
-     */
-    waitForLogoutPopup(popupWindow) {
-        return new Promise((resolve) => {
-            this.logger.verbose("PopupHandler.waitForLogoutPopup - polling started");
-            const intervalId = setInterval(() => {
-                // Window is closed
-                if (popupWindow.closed) {
-                    this.logger.error("PopupHandler.waitForLogoutPopup - window closed");
-                    this.cleanPopup();
-                    clearInterval(intervalId);
-                    resolve();
-                }
-                let href = Constants.EMPTY_STRING;
-                try {
-                    /*
-                     * Will throw if cross origin,
-                     * which should be caught and ignored
-                     * since we need the interval to keep running while on STS UI.
-                     */
-                    href = popupWindow.location.href;
-                }
-                catch (e) { }
-                // Don't process blank pages or cross domain
-                if (!href || href === "about:blank") {
-                    return;
-                }
-                this.logger.verbose("PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing.");
-                clearInterval(intervalId);
-                this.cleanPopup(popupWindow);
-                resolve();
+                this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
+                resolve(responseString);
             }, this.config.system.pollIntervalMilliseconds);
+        }).finally(() => {
+            this.cleanPopup(popupWindow);
         });
     }
     /**
@@ -14216,20 +14090,6 @@ class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
-    /**
-     * Extracts the server response from the popup window
-     */
-    extractServerResponseStringFromPopup(popupWindow, href) {
-        let serverResponseString;
-        if (this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY) {
-            serverResponseString = UrlString.parseQueryServerResponse(href);
-        }
-        else {
-            serverResponseString = popupWindow.location.hash;
-        }
-        return serverResponseString;
-    }
 }
 
 /*
@@ -14298,12 +14158,8 @@ class RedirectHandler {
      * Handle authorization code response in the window.
      * @param hash
      */
-    async handleCodeResponseFromHash(locationHash, state) {
+    async handleCodeResponse(response, state) {
         this.logger.verbose("RedirectHandler.handleCodeResponse called");
-        // Check that location hash isn't empty.
-        if (!locationHash) {
-            throw createBrowserAuthError(hashEmptyError);
-        }
         // Interaction is completed - remove interaction status.
         this.browserStorage.setInteractionInProgress(false);
         // Handle code response.
@@ -14314,7 +14170,7 @@ class RedirectHandler {
         }
         let authCodeResponse;
         try {
-            authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+            authCodeResponse = this.authModule.handleFragmentResponse(response, requestState);
         }
         catch (e) {
             if (e instanceof ServerError &&
@@ -14443,22 +14299,10 @@ class RedirectClient extends StandardInteractionClient {
                 this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
                 return null;
             }
-            const responseHash = this.getRedirectResponseHash(hash || window.location.hash);
-            if (!responseHash) {
+            const [serverParams, responseString] = this.getRedirectResponse(hash || "");
+            if (!serverParams) {
                 // Not a recognized server response hash or hash not associated with a redirect request
-                this.logger.info("handleRedirectPromise did not detect a response hash as a result of a redirect. Cleaning temporary cache.");
-                this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
-                return null;
-            }
-            let state;
-            try {
-                // Deserialize hash fragment response parameters.
-                const serverParams = UrlString.getDeserializedHash(responseHash);
-                state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Redirect);
-                this.logger.verbose("State extracted from hash");
-            }
-            catch (e) {
-                this.logger.info(`handleRedirectPromise was unable to extract state due to: ${e}`);
+                this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache.");
                 this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
                 return null;
             }
@@ -14469,17 +14313,17 @@ class RedirectClient extends StandardInteractionClient {
             if (loginRequestUrlNormalized === currentUrlNormalized &&
                 this.config.auth.navigateToLoginRequestUrl) {
                 // We are on the page we need to navigate to - handle hash
-                this.logger.verbose("Current page is loginRequestUrl, handling hash");
-                const handleHashResult = await this.handleHash(responseHash, state, serverTelemetryManager);
+                this.logger.verbose("Current page is loginRequestUrl, handling response");
                 if (loginRequestUrl.indexOf("#") > -1) {
                     // Replace current hash with non-msal hash, if present
                     replaceHash(loginRequestUrl);
                 }
+                const handleHashResult = await this.handleResponse(serverParams, serverTelemetryManager);
                 return handleHashResult;
             }
             else if (!this.config.auth.navigateToLoginRequestUrl) {
-                this.logger.verbose("NavigateToLoginRequestUrl set to false, handling hash");
-                return this.handleHash(responseHash, state, serverTelemetryManager);
+                this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response");
+                return this.handleResponse(serverParams, serverTelemetryManager);
             }
             else if (!isInIframe() ||
                 this.config.system.allowRedirectInIframe) {
@@ -14487,7 +14331,7 @@ class RedirectClient extends StandardInteractionClient {
                  * Returned from authority using redirect - need to perform navigation before processing response
                  * Cache the hash to be retrieved after the next redirect
                  */
-                this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseHash, true);
+                this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseString, true);
                 const navigationOptions = {
                     apiId: ApiId.handleRedirectPromise,
                     timeout: this.config.system.redirectNavigationTimeout,
@@ -14515,7 +14359,7 @@ class RedirectClient extends StandardInteractionClient {
                 }
                 // If navigateInternal implementation returns false, handle the hash now
                 if (!processHashOnRedirect) {
-                    return this.handleHash(responseHash, state, serverTelemetryManager);
+                    return this.handleResponse(serverParams, serverTelemetryManager);
                 }
             }
             return null;
@@ -14534,29 +14378,57 @@ class RedirectClient extends StandardInteractionClient {
      * Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
      * @param hash
      */
-    getRedirectResponseHash(hash) {
+    getRedirectResponse(userProvidedResponse) {
         this.logger.verbose("getRedirectResponseHash called");
         // Get current location hash from window or cache.
-        const isResponseHash = UrlString.hashContainsKnownProperties(hash);
-        if (isResponseHash) {
+        let responseString = userProvidedResponse;
+        if (!responseString) {
+            if (this.config.auth.OIDCOptions.serverResponseType ===
+                ServerResponseType.QUERY) {
+                responseString = window.location.search;
+            }
+            else {
+                responseString = window.location.hash;
+            }
+        }
+        let response = getDeserializedResponse(responseString);
+        if (response) {
+            try {
+                validateInteractionType(response, this.browserCrypto, exports.InteractionType.Redirect);
+            }
+            catch (e) {
+                if (e instanceof AuthError) {
+                    this.logger.error(`Interaction type validation failed due to ${e.errorCode}: ${e.errorMessage}`);
+                }
+                return [null, ""];
+            }
             clearHash(window);
             this.logger.verbose("Hash contains known properties, returning response hash");
-            return hash;
+            return [response, responseString];
         }
         const cachedHash = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.URL_HASH, true);
         this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH));
-        this.logger.verbose("Hash does not contain known properties, returning cached hash");
-        return cachedHash;
+        if (cachedHash) {
+            response = getDeserializedResponse(cachedHash);
+            if (response) {
+                this.logger.verbose("Hash does not contain known properties, returning cached hash");
+                return [response, cachedHash];
+            }
+        }
+        return [null, ""];
     }
     /**
      * Checks if hash exists and handles in window.
      * @param hash
      * @param state
      */
-    async handleHash(hash, state, serverTelemetryManager) {
+    async handleResponse(serverParams, serverTelemetryManager) {
+        const state = serverParams.state;
+        if (!state) {
+            throw createBrowserAuthError(noStateInHash);
+        }
         const cachedRequest = this.browserStorage.getCachedRequest(state);
-        this.logger.verbose("handleHash called, retrieved cached request");
-        const serverParams = UrlString.getDeserializedHash(hash);
+        this.logger.verbose("handleResponse called, retrieved cached request");
         if (serverParams.accountId) {
             this.logger.verbose("Account id found in hash, calling WAM for token");
             if (!this.nativeMessageHandler) {
@@ -14582,7 +14454,7 @@ class RedirectClient extends StandardInteractionClient {
         const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)(serverTelemetryManager, currentAuthority);
         ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, cachedRequest);
         const interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.performanceClient);
-        return await interactionHandler.handleCodeResponseFromHash(hash, state);
+        return await interactionHandler.handleCodeResponse(serverParams, state);
     }
     /**
      * Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -14693,7 +14565,7 @@ async function initiateAuthRequest(requestUrl, performanceClient, logger, correl
  * @param iframe
  * @param timeout
  */
-async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId) {
+async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
     performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
     return new Promise((resolve, reject) => {
         if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
@@ -14722,12 +14594,18 @@ async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, p
             if (!href || href === "about:blank") {
                 return;
             }
-            const contentHash = contentWindow
-                ? contentWindow.location.hash
-                : "";
+            let responseString = "";
+            if (contentWindow) {
+                if (responseType === ServerResponseType.QUERY) {
+                    responseString = contentWindow.location.search;
+                }
+                else {
+                    responseString = contentWindow.location.hash;
+                }
+            }
             window.clearTimeout(timeoutId);
             window.clearInterval(intervalId);
-            resolve(contentHash);
+            resolve(responseString);
         }, pollIntervalMilliseconds);
     }).finally(() => {
         invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
@@ -14870,20 +14748,10 @@ class SilentIframeClient extends StandardInteractionClient {
         const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
         // Get the frame handle for the silent request
         const msalFrame = await invokeAsync(initiateAuthRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-        const hash = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId);
-        if (!hash) {
-            // No hash is present
-            this.logger.error("The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page.");
-            throw createBrowserAuthError(hashEmptyError);
-        }
-        else if (!UrlString.hashContainsKnownProperties(hash)) {
-            this.logger.error("A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page.");
-            this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
-            throw createBrowserAuthError(hashDoesNotContainKnownProperties);
-        }
-        // Deserialize hash fragment response parameters.
-        const serverParams = UrlString.getDeserializedHash(hash);
+        const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+        const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, responseType, this.logger);
         if (serverParams.accountId) {
             this.logger.verbose("Account id found in hash, calling WAM for token");
             if (!this.nativeMessageHandler) {
@@ -14898,7 +14766,7 @@ class SilentIframeClient extends StandardInteractionClient {
             });
         }
         // Handle response from hash string
-        return invokeAsync(interactionHandler.handleCodeResponseFromHash.bind(interactionHandler), PerformanceEvents.HandleCodeResponseFromHash, this.logger, this.performanceClient, correlationId)(hash, silentRequest);
+        return invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, this.logger, this.performanceClient, correlationId)(serverParams, silentRequest);
     }
 }
 
@@ -15369,12 +15237,6 @@ class StandardController {
         this.logger.verbose("handleRedirectPromise called");
         // Block token acquisition before initialize has been called
         blockAPICallsBeforeInitialize(this.initialized);
-        let foundServerResponse = hash;
-        if (this.config.auth.OIDCOptions?.serverResponseType ===
-            ServerResponseType.QUERY) {
-            const url = window.location.href;
-            foundServerResponse = UrlString.parseQueryServerResponse(url);
-        }
         const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
@@ -15382,7 +15244,7 @@ class StandardController {
              * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
              * several times concurrently.
              */
-            const redirectResponseKey = foundServerResponse || Constants.EMPTY_STRING;
+            const redirectResponseKey = hash || "";
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
                 this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
@@ -15392,7 +15254,7 @@ class StandardController {
                 if (request &&
                     NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                     this.nativeExtensionProvider &&
-                    !foundServerResponse) {
+                    !hash) {
                     this.logger.trace("handleRedirectPromise - acquiring token from native platform");
                     const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                     redirectResponse = nativeClient.handleRedirectPromise();
@@ -15402,7 +15264,7 @@ class StandardController {
                     const correlationId = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
                     const redirectClient = this.createRedirectClient(correlationId);
                     redirectResponse =
-                        redirectClient.handleRedirectPromise(foundServerResponse);
+                        redirectClient.handleRedirectPromise(hash);
                 }
                 response = redirectResponse
                     .then((result) => {
@@ -15467,19 +15329,19 @@ class StandardController {
         }
         let result;
         if (this.nativeExtensionProvider && this.canUseNative(request)) {
-            const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
+            const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
             result = nativeClient
                 .acquireTokenRedirect(request)
                 .catch((e) => {
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
                     this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                    const redirectClient = this.createRedirectClient(request.correlationId);
+                    const redirectClient = this.createRedirectClient(correlationId);
                     return redirectClient.acquireToken(request);
                 }
                 else if (e instanceof InteractionRequiredAuthError) {
                     this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
-                    const redirectClient = this.createRedirectClient(request.correlationId);
+                    const redirectClient = this.createRedirectClient(correlationId);
                     return redirectClient.acquireToken(request);
                 }
                 this.getBrowserStorage().setInteractionInProgress(false);
@@ -15487,7 +15349,7 @@ class StandardController {
             });
         }
         else {
-            const redirectClient = this.createRedirectClient(request.correlationId);
+            const redirectClient = this.createRedirectClient(correlationId);
             result = redirectClient.acquireToken(request);
         }
         return result.catch((e) => {
@@ -15531,7 +15393,10 @@ class StandardController {
         }
         let result;
         if (this.canUseNative(request)) {
-            result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
+            result = this.acquireTokenNative({
+                ...request,
+                correlationId,
+            }, ApiId.acquireTokenPopup)
                 .then((response) => {
                 this.getBrowserStorage().setInteractionInProgress(false);
                 atPopupMeasurement.end({
@@ -15545,12 +15410,12 @@ class StandardController {
                 if (e instanceof NativeAuthError &&
                     isFatalNativeAuthError(e)) {
                     this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                    const popupClient = this.createPopupClient(request.correlationId);
+                    const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request);
                 }
                 else if (e instanceof InteractionRequiredAuthError) {
                     this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow");
-                    const popupClient = this.createPopupClient(request.correlationId);
+                    const popupClient = this.createPopupClient(correlationId);
                     return popupClient.acquireToken(request);
                 }
                 this.getBrowserStorage().setInteractionInProgress(false);
@@ -15558,7 +15423,7 @@ class StandardController {
             });
         }
         else {
-            const popupClient = this.createPopupClient(request.correlationId);
+            const popupClient = this.createPopupClient(correlationId);
             result = popupClient.acquireToken(request);
         }
         return result
@@ -15701,7 +15566,7 @@ class StandardController {
         this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
         this.logger.trace("acquireTokenByCode called", correlationId);
         this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
-        const atbcMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCode, request.correlationId);
+        const atbcMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCode, correlationId);
         try {
             if (request.code && request.nativeAccountId) {
                 // Throw error in case server returns both spa_code and spa_accountid in exchange for auth code.
@@ -15743,14 +15608,17 @@ class StandardController {
                     this.hybridAuthCodeResponses.set(hybridAuthCode, response);
                 }
                 else {
-                    this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
+                    this.logger.verbose("Existing acquireTokenByCode request found", correlationId);
                     atbcMeasurement.discard();
                 }
                 return response;
             }
             else if (request.nativeAccountId) {
                 if (this.canUseNative(request, request.nativeAccountId)) {
-                    return this.acquireTokenNative(request, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                    return this.acquireTokenNative({
+                        ...request,
+                        correlationId,
+                    }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
                         // If native token acquisition fails for availability reasons fallback to standard flow
                         if (e instanceof NativeAuthError &&
                             isFatalNativeAuthError(e)) {
@@ -16391,6 +16259,7 @@ class StandardController {
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
             sshKid: request.sshKid,
+            shrOptions: request.shrOptions,
         };
         const silentRequestKey = JSON.stringify(thumbprint);
         const cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
@@ -18550,6 +18419,7 @@ exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
 exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
 exports.InteractionStatus = InteractionStatus;
+exports.JsonWebTokenTypes = JsonWebTokenTypes;
 exports.Logger = Logger;
 exports.MemoryStorage = MemoryStorage;
 exports.NavigationClient = NavigationClient;