@azure/msal-browser 3.4.0 → 3.5.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v3.4.0 2023-10-30 */
+/*! @azure/msal-browser v3.5.0 2023-11-07 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -58,7 +58,6 @@
         IMDS_TIMEOUT: 2000,
         AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
-        REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
         KNOWN_PUBLIC_CLOUDS: [
             "login.microsoftonline.com",
             "login.windows.net",
@@ -363,13 +362,13 @@
         // When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed
         PROACTIVELY_REFRESHED: "4",
     };
-    const JsonTypes = {
+    const JsonWebTokenTypes = {
         Jwt: "JWT",
         Jwk: "JWK",
         Pop: "pop",
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -386,7 +385,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +434,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -533,7 +532,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -785,7 +784,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -818,7 +817,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1009,12 +1008,12 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "14.3.0";
+    const version$1 = "14.4.0";
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1034,7 +1033,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1095,7 +1094,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1142,7 +1141,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1359,8 +1358,24 @@
             ? credentialEntity.tokenType.toLowerCase()
             : "";
     }
+    /**
+     * validates if a given cache entry is "Telemetry", parses <key,value>
+     * @param key
+     * @param entity
+     */
+    function isServerTelemetryEntity(key, entity) {
+        const validateKey = key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
+        let validateEntity = true;
+        if (entity) {
+            validateEntity =
+                entity.hasOwnProperty("failedRequests") &&
+                    entity.hasOwnProperty("errors") &&
+                    entity.hasOwnProperty("cacheHits");
+        }
+        return validateKey && validateEntity;
+    }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1414,7 +1429,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1552,7 +1567,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1649,7 +1664,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1849,7 +1864,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1889,7 +1904,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1904,7 +1919,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1917,7 +1932,7 @@
         OIDC: "OIDC",
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2138,7 +2153,54 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Parses hash string from given string. Returns empty string if no hash symbol is found.
+     * @param hashString
+     */
+    function stripLeadingHashOrQuery(responseString) {
+        if (responseString.startsWith("#/")) {
+            return responseString.substring(2);
+        }
+        else if (responseString.startsWith("#") ||
+            responseString.startsWith("?")) {
+            return responseString.substring(1);
+        }
+        return responseString;
+    }
+    /**
+     * Returns URL hash as server auth code response object.
+     */
+    function getDeserializedResponse(responseString) {
+        // Check if given hash is empty
+        if (!responseString || responseString.indexOf("=") < 0) {
+            return null;
+        }
+        try {
+            // Strip the # or ? symbol if present
+            const normalizedResponse = stripLeadingHashOrQuery(responseString);
+            // If # symbol was not present, above will return empty string, so give original hash value
+            const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
+            // Check for known response properties
+            if (deserializedHash.code ||
+                deserializedHash.error ||
+                deserializedHash.error_description ||
+                deserializedHash.state) {
+                return deserializedHash;
+            }
+        }
+        catch (e) {
+            throw createClientAuthError(hashNotDeserialized);
+        }
+        return null;
+    }
+
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2157,7 +2219,7 @@
                 // Throws error if url is empty
                 throw createClientConfigurationError(urlEmptyError);
             }
-            if (!this.getHash()) {
+            if (!url.includes("#")) {
                 this._urlString = UrlString.canonicalizeUri(url);
             }
         }
@@ -2239,12 +2301,6 @@
             }
             return UrlString.constructAuthorityUriFromObject(urlObject);
         }
-        /**
-         * Returns the anchor part(#) of the URL
-         */
-        getHash() {
-            return UrlString.parseHash(this.urlString);
-        }
         /**
          * Parses out the components from a url string.
          * @returns An object with the various components. Please cache this value insted of calling this multiple times on the same url.
@@ -2292,60 +2348,6 @@
             }
             return relativeUrl;
         }
-        /**
-         * Parses hash string from given string. Returns empty string if no hash symbol is found.
-         * @param hashString
-         */
-        static parseHash(hashString) {
-            const hashIndex1 = hashString.indexOf("#");
-            const hashIndex2 = hashString.indexOf("#/");
-            if (hashIndex2 > -1) {
-                return hashString.substring(hashIndex2 + 2);
-            }
-            else if (hashIndex1 > -1) {
-                return hashString.substring(hashIndex1 + 1);
-            }
-            return Constants.EMPTY_STRING;
-        }
-        /**
-         * Parses query string from given string. Returns empty string if no query symbol is found.
-         * @param queryString
-         */
-        static parseQueryString(queryString) {
-            const queryIndex1 = queryString.indexOf("?");
-            const queryIndex2 = queryString.indexOf("/?");
-            if (queryIndex2 > -1) {
-                return queryString.substring(queryIndex2 + 2);
-            }
-            else if (queryIndex1 > -1) {
-                return queryString.substring(queryIndex1 + 1);
-            }
-            return Constants.EMPTY_STRING;
-        }
-        /**
-         * Parses query server response string from given string.
-         * Extract hash between '?code=' and '#' if trailing '# is present.
-         * Returns empty string if no query symbol is found.
-         * @param queryString
-         */
-        static parseQueryServerResponse(queryString) {
-            const queryIndex1 = queryString.indexOf("?code");
-            const queryIndex2 = queryString.indexOf("/?code");
-            const hashIndex = queryString.indexOf("#");
-            if (queryIndex2 > -1 && hashIndex > -1) {
-                return queryString.substring(queryIndex2 + 2, hashIndex);
-            }
-            else if (queryIndex2 > -1) {
-                return queryString.substring(queryIndex2 + 2);
-            }
-            else if (queryIndex1 > -1 && hashIndex > -1) {
-                return queryString.substring(queryIndex1 + 1, hashIndex);
-            }
-            else if (queryIndex1 > -1) {
-                return queryString.substring(queryIndex1 + 1);
-            }
-            return Constants.EMPTY_STRING;
-        }
         static constructAuthorityUriFromObject(urlObject) {
             return new UrlString(urlObject.Protocol +
                 "//" +
@@ -2353,74 +2355,16 @@
                 "/" +
                 urlObject.PathSegments.join("/"));
         }
-        /**
-         * Returns URL hash as server auth code response object.
-         */
-        static getDeserializedHash(hash) {
-            // Check if given hash is empty
-            if (!hash) {
-                return {};
-            }
-            // Strip the # symbol if present
-            const parsedHash = UrlString.parseHash(hash);
-            // If # symbol was not present, above will return empty string, so give original hash value
-            const deserializedHash = StringUtils.queryStringToObject(parsedHash || hash);
-            // Check if deserialization didn't work
-            if (!deserializedHash) {
-                throw createClientAuthError(hashNotDeserialized);
-            }
-            return deserializedHash;
-        }
-        /**
-         * Returns URL query string as server auth code response object.
-         */
-        static getDeserializedQueryString(query) {
-            // Check if given query is empty
-            if (!query) {
-                return {};
-            }
-            // Strip the ? symbol if present
-            const parsedQueryString = UrlString.parseQueryString(query);
-            // If ? symbol was not present, above will return empty string, so give original query value
-            const deserializedQueryString = StringUtils.queryStringToObject(parsedQueryString || query);
-            // Check if deserialization didn't work
-            if (!deserializedQueryString) {
-                throw createClientAuthError(hashNotDeserialized);
-            }
-            return deserializedQueryString;
-        }
-        /**
-         * Returns either deserialized query string or deserialized hash, depending on the serverResponseType
-         * as a server auth code response object.
-         */
-        static getDeserializedCodeResponse(serverResponseType, hashFragment) {
-            const hashUrlString = new UrlString(hashFragment);
-            let serverParams;
-            if (serverResponseType === ServerResponseType.QUERY) {
-                serverParams = UrlString.getDeserializedQueryString(hashFragment);
-            }
-            else {
-                serverParams = UrlString.getDeserializedHash(hashUrlString.getHash());
-            }
-            return serverParams;
-        }
         /**
          * Check if the hash of the URL string contains known properties
+         * @deprecated This API will be removed in a future version
          */
-        static hashContainsKnownProperties(hash) {
-            if (!hash || hash.indexOf("=") < 0) {
-                // Hash doesn't contain key/value pairs
-                return false;
-            }
-            const parameters = UrlString.getDeserializedHash(hash);
-            return !!(parameters.code ||
-                parameters.error_description ||
-                parameters.error ||
-                parameters.state);
+        static hashContainsKnownProperties(response) {
+            return !!getDeserializedResponse(response);
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3026,7 +2970,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3506,18 +3450,18 @@
         }
         /**
          * Retrieve the cached credentials into a cacherecord
-         * @param account
-         * @param clientId
-         * @param scopes
-         * @param environment
-         * @param authScheme
+         * @param account {AccountInfo}
+         * @param request {BaseAuthRequest}
+         * @param environment {string}
+         * @param performanceClient {?IPerformanceClient}
+         * @param correlationId {?string}
          */
-        readCacheRecord(account, request, environment) {
+        readCacheRecord(account, request, environment, performanceClient, correlationId) {
             const tokenKeys = this.getTokenKeys();
             const cachedAccount = this.readAccountFromCache(account);
-            const cachedIdToken = this.getIdToken(account, tokenKeys);
-            const cachedAccessToken = this.getAccessToken(account, request, tokenKeys);
-            const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys);
+            const cachedIdToken = this.getIdToken(account, tokenKeys, performanceClient, correlationId);
+            const cachedAccessToken = this.getAccessToken(account, request, tokenKeys, performanceClient, correlationId);
+            const cachedRefreshToken = this.getRefreshToken(account, false, tokenKeys, performanceClient, correlationId);
             const cachedAppMetadata = this.readAppMetadataFromCache(environment);
             if (cachedAccount && cachedIdToken) {
                 cachedAccount.idTokenClaims = extractTokenClaims(cachedIdToken.secret, this.cryptoImpl.base64Decode);
@@ -3540,11 +3484,12 @@
         }
         /**
          * Retrieve IdTokenEntity from cache
-         * @param clientId
-         * @param account
-         * @param inputRealm
+         * @param account {AccountInfo}
+         * @param tokenKeys {?TokenKeys}
+         * @param performanceClient {?IPerformanceClient}
+         * @param correlationId {?string}
          */
-        getIdToken(account, tokenKeys) {
+        getIdToken(account, tokenKeys, performanceClient, correlationId) {
             this.commonLogger.trace("CacheManager - getIdToken called");
             const idTokenFilter = {
                 homeAccountId: account.homeAccountId,
@@ -3564,6 +3509,9 @@
                 idTokens.forEach((idToken) => {
                     this.removeIdToken(generateCredentialKey(idToken));
                 });
+                if (performanceClient && correlationId) {
+                    performanceClient.addFields({ multiMatchedID: idTokens.length }, correlationId);
+                }
                 return null;
             }
             this.commonLogger.info("CacheManager:getIdToken - Returning id token");
@@ -3625,12 +3573,13 @@
         }
         /**
          * Retrieve AccessTokenEntity from cache
-         * @param clientId
-         * @param account
-         * @param scopes
-         * @param authScheme
+         * @param account {AccountInfo}
+         * @param request {BaseAuthRequest}
+         * @param tokenKeys {?TokenKeys}
+         * @param performanceClient {?IPerformanceClient}
+         * @param correlationId {?string}
          */
-        getAccessToken(account, request, tokenKeys) {
+        getAccessToken(account, request, tokenKeys, performanceClient, correlationId) {
             this.commonLogger.trace("CacheManager - getAccessToken called");
             const scopes = ScopeSet.createSearchScopes(request.scopes);
             const authScheme = request.authenticationScheme || AuthenticationScheme.BEARER;
@@ -3678,6 +3627,9 @@
                 accessTokens.forEach((accessToken) => {
                     void this.removeAccessToken(generateCredentialKey(accessToken));
                 });
+                if (performanceClient && correlationId) {
+                    performanceClient.addFields({ multiMatchedAT: accessTokens.length }, correlationId);
+                }
                 return null;
             }
             this.commonLogger.info("CacheManager:getAccessToken - Returning access token");
@@ -3746,11 +3698,13 @@
         }
         /**
          * Helper to retrieve the appropriate refresh token from cache
-         * @param clientId
-         * @param account
-         * @param familyRT
+         * @param account {AccountInfo}
+         * @param familyRT {boolean}
+         * @param tokenKeys {?TokenKeys}
+         * @param performanceClient {?IPerformanceClient}
+         * @param correlationId {?string}
          */
-        getRefreshToken(account, familyRT, tokenKeys) {
+        getRefreshToken(account, familyRT, tokenKeys, performanceClient, correlationId) {
             this.commonLogger.trace("CacheManager - getRefreshToken called");
             const id = familyRT ? THE_FAMILY_ID : undefined;
             const refreshTokenFilter = {
@@ -3780,6 +3734,9 @@
                 return null;
             }
             // address the else case after remove functions address environment aliases
+            if (numRefreshTokens > 1 && performanceClient && correlationId) {
+                performanceClient.addFields({ multiMatchedRT: numRefreshTokens }, correlationId);
+            }
             this.commonLogger.info("CacheManager:getRefreshToken - returning refresh token");
             return refreshTokens[0];
         }
@@ -4118,7 +4075,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4218,7 +4175,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4235,7 +4192,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4333,7 +4290,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4370,7 +4327,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4380,7 +4337,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4464,7 +4421,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4848,7 +4805,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4860,7 +4817,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4941,7 +4898,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4951,7 +4908,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4961,7 +4918,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5131,7 +5088,7 @@
          * Functions from InteractionHandler (msal-browser)
          */
         HandleCodeResponseFromServer: "handleCodeResponseFromServer",
-        HandleCodeResponseFromHash: "handleCodeResponseFromHash",
+        HandleCodeResponse: "handleCodeResponse",
         UpdateTokenEndpointAuthority: "updateTokenEndpointAuthority",
         /**
          * APIs in Authorization Code Client (msal-common)
@@ -5149,6 +5106,7 @@
          * handleServerTokenResponse API in ResponseHandler (msal-common)
          */
         HandleServerTokenResponse: "handleServerTokenResponse",
+        DeserializeResponse: "deserializeResponse",
         /**
          * Authority functions
          */
@@ -5210,9 +5168,12 @@
         "queuedTimeMs",
         "startTimeMs",
         "status",
+        "multiMatchedAT",
+        "multiMatchedID",
+        "multiMatchedRT",
     ]);
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5298,7 +5259,7 @@
         };
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5407,7 +5368,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6135,9 +6096,8 @@
             const regionalMetadata = { ...metadata };
             regionalMetadata.authorization_endpoint =
                 Authority.buildRegionalAuthorityString(regionalMetadata.authorization_endpoint, azureRegion);
-            // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
             regionalMetadata.token_endpoint =
-                Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
+                Authority.buildRegionalAuthorityString(regionalMetadata.token_endpoint, azureRegion);
             if (regionalMetadata.end_session_endpoint) {
                 regionalMetadata.end_session_endpoint =
                     Authority.buildRegionalAuthorityString(regionalMetadata.end_session_endpoint, azureRegion);
@@ -6199,7 +6159,7 @@
         };
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6249,7 +6209,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6352,7 +6312,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6374,7 +6334,7 @@
         noTokensFound: noTokensFound
     });
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6453,7 +6413,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6469,7 +6429,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6541,7 +6501,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6605,7 +6565,7 @@
          */
         async signPayload(payload, keyId, request, claims) {
             // Deconstruct request to extract SHR parameters
-            const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, } = request;
+            const { resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, shrOptions, } = request;
             const resourceUrlString = resourceRequestUri
                 ? new UrlString(resourceRequestUri)
                 : undefined;
@@ -6622,11 +6582,11 @@
                     : undefined,
                 client_claims: shrClaims || undefined,
                 ...claims,
-            }, keyId, request.correlationId);
+            }, keyId, shrOptions, request.correlationId);
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6695,7 +6655,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6722,7 +6682,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7037,7 +6997,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7094,22 +7054,16 @@
          * the client to exchange for a token in acquireToken.
          * @param hashFragment
          */
-        handleFragmentResponse(hashFragment, cachedState) {
+        handleFragmentResponse(serverParams, cachedState) {
             // Handle responses.
             const responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, null, null);
-            const serverParams = UrlString.getDeserializedCodeResponse(this.config.authOptions.authority.options.OIDCOptions
-                ?.serverResponseType, hashFragment);
             // Get code response
             responseHandler.validateServerAuthorizationCodeResponse(serverParams, cachedState);
             // throw when there is no auth code in the response
             if (!serverParams.code) {
                 throw createClientAuthError(authorizationCodeMissingFromServerResponse);
             }
-            return {
-                ...serverParams,
-                // Code param is optional in ServerAuthorizationCodeResponse but required in AuthorizationCodePaylod
-                code: serverParams.code,
-            };
+            return serverParams;
         }
         /**
          * Used to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -7448,7 +7402,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7520,7 +7474,7 @@
         async acquireTokenWithCachedRefreshToken(request, foci) {
             this.performanceClient?.addQueueMeasurement(PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
             // fetches family RT or application RT based on FOCI value
-            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci);
+            const refreshToken = invoke(this.cacheManager.getRefreshToken.bind(this.cacheManager), PerformanceEvents.CacheManagerGetRefreshToken, this.logger, this.performanceClient, request.correlationId)(request.account, foci, undefined, this.performanceClient, request.correlationId);
             if (!refreshToken) {
                 throw createInteractionRequiredAuthError(noTokensFound);
             }
@@ -7637,7 +7591,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7700,7 +7654,7 @@
                 throw createClientAuthError(noAccountInSilentRequest);
             }
             const environment = request.authority || this.authority.getPreferredCache();
-            const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment);
+            const cacheRecord = this.cacheManager.readCacheRecord(request.account, request, environment, this.performanceClient, request.correlationId);
             if (!cacheRecord.accessToken) {
                 // must refresh due to non-existent access_token
                 this.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN, request.correlationId);
@@ -7732,7 +7686,9 @@
             this.performanceClient?.addFields({
                 cacheOutcome: cacheOutcome,
             }, correlationId);
-            this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+            if (cacheOutcome !== CacheOutcome.NOT_APPLICABLE) {
+                this.logger.info(`Token refresh is required due to cache outcome: ${cacheOutcome}`);
+            }
         }
         /**
          * Helper function to build response object from the CacheRecord
@@ -7756,37 +7712,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    class ServerTelemetryEntity {
-        constructor() {
-            this.failedRequests = [];
-            this.errors = [];
-            this.cacheHits = 0;
-        }
-        /**
-         * validates if a given cache entry is "Telemetry", parses <key,value>
-         * @param key
-         * @param entity
-         */
-        static isServerTelemetryEntity(key, entity) {
-            const validateKey = key.indexOf(SERVER_TELEM_CONSTANTS.CACHE_KEY) === 0;
-            let validateEntity = true;
-            if (entity) {
-                validateEntity =
-                    entity.hasOwnProperty("failedRequests") &&
-                        entity.hasOwnProperty("errors") &&
-                        entity.hasOwnProperty("cacheHits");
-            }
-            return validateKey && validateEntity;
-        }
-    }
-
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7812,7 +7738,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7827,7 +7753,7 @@
         },
     };
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7835,7 +7761,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7860,7 +7786,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7892,7 +7818,7 @@
             }
             const shrHeader = new JoseHeader({
                 // Access Token PoP headers must have type pop, but the type header can be overriden for special cases
-                typ: shrHeaderOptions.typ || JsonTypes.Pop,
+                typ: shrHeaderOptions.typ || JsonWebTokenTypes.Pop,
                 kid: shrHeaderOptions.kid,
                 alg: shrHeaderOptions.alg,
             });
@@ -7900,7 +7826,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7958,7 +7884,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8070,7 +7996,11 @@
          * Get the server telemetry entity from cache or initialize a new one
          */
         getLastRequests() {
-            const initialValue = new ServerTelemetryEntity();
+            const initialValue = {
+                failedRequests: [],
+                errors: [],
+                cacheHits: 0,
+            };
             const lastRequests = this.cacheManager.getServerTelemetry(this.telemetryCacheKey);
             return lastRequests || initialValue;
         }
@@ -8087,11 +8017,11 @@
             }
             else {
                 // Partial data was flushed to server, construct a new telemetry cache item with errors that were not flushed
-                const serverTelemEntity = new ServerTelemetryEntity();
-                serverTelemEntity.failedRequests =
-                    lastRequests.failedRequests.slice(numErrorsFlushed * 2); // failedRequests contains 2 items for each error
-                serverTelemEntity.errors =
-                    lastRequests.errors.slice(numErrorsFlushed);
+                const serverTelemEntity = {
+                    failedRequests: lastRequests.failedRequests.slice(numErrorsFlushed * 2),
+                    errors: lastRequests.errors.slice(numErrorsFlushed),
+                    cacheHits: 0,
+                };
                 this.cacheManager.setServerTelemetry(this.telemetryCacheKey, serverTelemEntity);
             }
         }
@@ -8158,7 +8088,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8570,7 +8500,7 @@
         }
     }
 
-    /*! @azure/msal-common v14.3.0 2023-10-30 */
+    /*! @azure/msal-common v14.4.0 2023-11-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -9626,7 +9556,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "3.4.0";
+    const version = "3.5.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10644,7 +10574,7 @@
          * @param payload
          * @param kid
          */
-        async signJwt(payload, kid, correlationId) {
+        async signJwt(payload, kid, shrOptions, correlationId) {
             const signJwtMeasurement = this.performanceClient?.startMeasurement(PerformanceEvents.CryptoOptsSignJwt, correlationId);
             const cachedKeyPair = await this.cache.asymmetricKeys.getItem(kid);
             if (!cachedKeyPair) {
@@ -10657,8 +10587,9 @@
             const encodedKeyIdThumbprint = urlEncode(JSON.stringify({ kid: kid }));
             // Generate header
             const shrHeader = JoseHeader.getShrHeaderString({
-                kid: encodedKeyIdThumbprint,
+                ...shrOptions?.header,
                 alg: publicKeyJwk.alg,
+                kid: encodedKeyIdThumbprint,
             });
             const encodedShrHeader = urlEncode(shrHeader);
             // Generate payload
@@ -10790,34 +10721,21 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    class BrowserProtocolUtils {
-        /**
-         * Extracts the BrowserStateObject from the state string.
-         * @param browserCrypto
-         * @param state
-         */
-        static extractBrowserRequestState(browserCrypto, state) {
-            if (!state) {
-                return null;
-            }
-            try {
-                const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
-                return requestStateObj.libraryState.meta;
-            }
-            catch (e) {
-                throw createClientAuthError(invalidState);
-            }
+    /**
+     * Extracts the BrowserStateObject from the state string.
+     * @param browserCrypto
+     * @param state
+     */
+    function extractBrowserRequestState(browserCrypto, state) {
+        if (!state) {
+            return null;
         }
-        /**
-         * Parses properties of server response from url hash
-         * @param locationHash Hash from url
-         */
-        static parseServerResponseFromHash(locationHash) {
-            if (!locationHash) {
-                return {};
-            }
-            const hashUrlString = new UrlString(locationHash);
-            return UrlString.getDeserializedHash(hashUrlString.getHash());
+        try {
+            const requestStateObj = ProtocolUtils.parseRequestState(browserCrypto, state);
+            return requestStateObj.libraryState.meta;
+        }
+        catch (e) {
+            throw createClientAuthError(invalidState);
         }
     }
 
@@ -11396,14 +11314,14 @@
                 this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
                 return null;
             }
-            const parsedMetadata = this.validateAndParseJson(value);
-            if (!parsedMetadata ||
-                !ServerTelemetryEntity.isServerTelemetryEntity(serverTelemetryKey, parsedMetadata)) {
+            const parsedEntity = this.validateAndParseJson(value);
+            if (!parsedEntity ||
+                !isServerTelemetryEntity(serverTelemetryKey, parsedEntity)) {
                 this.logger.trace("BrowserCacheManager.getServerTelemetry: called, no cache hit");
                 return null;
             }
             this.logger.trace("BrowserCacheManager.getServerTelemetry: cache hit");
-            return CacheManager.toObject(new ServerTelemetryEntity(), parsedMetadata);
+            return parsedEntity;
         }
         /**
          * set server telemetry entity to the platform cache
@@ -11896,7 +11814,7 @@
                     return;
                 }
                 // Extract state and ensure it matches given InteractionType, then clean request cache
-                const parsedState = BrowserProtocolUtils.extractBrowserRequestState(this.cryptoImpl, stateValue);
+                const parsedState = extractBrowserRequestState(this.cryptoImpl, stateValue);
                 if (parsedState &&
                     parsedState.interactionType === interactionType) {
                     this.logger.infoPii(`BrowserCacheManager.cleanRequestByInteractionType: Removing temporary cache items for state: ${stateValue}`);
@@ -12287,7 +12205,7 @@
          * @param request
          */
         async initializeBaseRequest(request, account) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, request.correlationId);
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.InitializeBaseRequest, this.correlationId);
             const authority = request.authority || this.config.auth.authority;
             if (account) {
                 await this.validateRequestAuthority(authority, account);
@@ -12371,7 +12289,6 @@
         /**
          * Used to get a discovered version of the default authority.
          * @param requestAuthority
-         * @param requestCorrelationId
          */
         async getDiscoveredAuthority(requestAuthority) {
             this.logger.verbose("getDiscoveredAuthority called");
@@ -12459,7 +12376,7 @@
          * @param request
          */
         async initializeAuthorizationCodeRequest(request) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, request.correlationId);
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.StandardInteractionClientInitializeAuthorizationCodeRequest, this.correlationId);
             const generatedPkceParams = await invokeAsync(generatePkceCodes, PerformanceEvents.GeneratePkceCodes, this.logger, this.performanceClient, this.correlationId)(this.performanceClient, this.logger, this.correlationId);
             const authCodeRequest = {
                 ...request,
@@ -12608,25 +12525,6 @@
                 telemetry: this.config.telemetry,
             };
         }
-        /**
-         * @param hash
-         * @param interactionType
-         */
-        validateAndExtractStateFromHash(serverParams, interactionType, requestCorrelationId) {
-            this.logger.verbose("validateAndExtractStateFromHash called", requestCorrelationId);
-            if (!serverParams.state) {
-                throw createBrowserAuthError(noStateInHash);
-            }
-            const platformStateObj = BrowserProtocolUtils.extractBrowserRequestState(this.browserCrypto, serverParams.state);
-            if (!platformStateObj) {
-                throw createBrowserAuthError(unableToParseState);
-            }
-            if (platformStateObj.interactionType !== interactionType) {
-                throw createBrowserAuthError(stateInteractionTypeMismatch);
-            }
-            this.logger.verbose("Returning state from hash", requestCorrelationId);
-            return serverParams.state;
-        }
         /**
          * Used to get a discovered version of the default authority.
          * @param requestAuthority
@@ -13653,15 +13551,11 @@
          * Function to handle response parameters from hash.
          * @param locationHash
          */
-        async handleCodeResponseFromHash(locationHash, request) {
-            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponseFromHash, request.correlationId);
-            // Check that location hash isn't empty.
-            if (!locationHash) {
-                throw createBrowserAuthError(hashEmptyError);
-            }
+        async handleCodeResponse(response, request) {
+            this.performanceClient.addQueueMeasurement(PerformanceEvents.HandleCodeResponse, request.correlationId);
             let authCodeResponse;
             try {
-                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, request.state);
+                authCodeResponse = this.authModule.handleFragmentResponse(response, request.state);
             }
             catch (e) {
                 if (e instanceof ServerError &&
@@ -13732,6 +13626,43 @@
         }
     }
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    function deserializeResponse(responseString, responseLocation, logger) {
+        // Deserialize hash fragment response parameters.
+        const serverParams = getDeserializedResponse(responseString);
+        if (!serverParams) {
+            if (!stripLeadingHashOrQuery(responseString)) {
+                // Hash or Query string is empty
+                logger.error(`The request has returned to the redirectUri but a ${responseLocation} is not present. It's likely that the ${responseLocation} has been removed or the page has been redirected by code running on the redirectUri page.`);
+                throw createBrowserAuthError(hashEmptyError);
+            }
+            else {
+                logger.error(`A ${responseLocation} is present in the iframe but it does not contain known properties. It's likely that the ${responseLocation} has been replaced by code running on the redirectUri page.`);
+                logger.errorPii(`The ${responseLocation} detected is: ${responseString}`);
+                throw createBrowserAuthError(hashDoesNotContainKnownProperties);
+            }
+        }
+        return serverParams;
+    }
+    /**
+     * Returns the interaction type that the response object belongs to
+     */
+    function validateInteractionType(response, browserCrypto, interactionType) {
+        if (!response.state) {
+            throw createBrowserAuthError(noStateInHash);
+        }
+        const platformStateObj = extractBrowserRequestState(browserCrypto, response.state);
+        if (!platformStateObj) {
+            throw createBrowserAuthError(unableToParseState);
+        }
+        if (platformStateObj.interactionType !== interactionType) {
+            throw createBrowserAuthError(stateInteractionTypeMismatch);
+        }
+    }
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -13840,9 +13771,8 @@
                 const popupWindow = this.initiateAuthRequest(navigateUrl, popupParameters);
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
                 // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-                const hash = await this.monitorPopupForHash(popupWindow);
-                // Deserialize hash fragment response parameters.
-                const serverParams = UrlString.getDeserializedHash(hash);
+                const responseString = await this.monitorPopupForHash(popupWindow);
+                const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
                 // Remove throttle if it exists
                 ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
                 if (serverParams.accountId) {
@@ -13866,7 +13796,7 @@
                     });
                 }
                 // Handle response from hash string.
-                const result = await interactionHandler.handleCodeResponseFromHash(hash, validRequest);
+                const result = await interactionHandler.handleCodeResponse(serverParams, validRequest);
                 return result;
             }
             catch (e) {
@@ -13933,7 +13863,9 @@
                     popup,
                 });
                 this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
-                await this.waitForLogoutPopup(popupWindow);
+                await this.monitorPopupForHash(popupWindow).catch(() => {
+                    // Swallow any errors related to monitoring the window. Server logout is best effort
+                });
                 if (mainWindowRedirectUri) {
                     const navigationOptions = {
                         apiId: ApiId.logoutPopup,
@@ -13989,25 +13921,16 @@
          */
         monitorPopupForHash(popupWindow) {
             return new Promise((resolve, reject) => {
-                /*
-                 * Polling for popups needs to be tick-based,
-                 * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
-                 */
-                const maxTicks = this.config.system.windowHashTimeout /
-                    this.config.system.pollIntervalMilliseconds;
-                let ticks = 0;
                 this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
                 const intervalId = setInterval(() => {
                     // Window is closed
                     if (popupWindow.closed) {
                         this.logger.error("PopupHandler.monitorPopupForHash - window closed");
-                        this.cleanPopup();
                         clearInterval(intervalId);
                         reject(createBrowserAuthError(userCancelled));
                         return;
                     }
-                    let href = Constants.EMPTY_STRING;
-                    let serverResponseString = Constants.EMPTY_STRING;
+                    let href = "";
                     try {
                         /*
                          * Will throw if cross origin,
@@ -14015,77 +13938,28 @@
                          * since we need the interval to keep running while on STS UI.
                          */
                         href = popupWindow.location.href;
-                        serverResponseString =
-                            this.extractServerResponseStringFromPopup(popupWindow, href);
                     }
                     catch (e) { }
                     // Don't process blank pages or cross domain
                     if (!href || href === "about:blank") {
                         return;
                     }
-                    this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
-                    /*
-                     * Only run clock when we are on same domain for popups
-                     * as popup operations can take a long time.
-                     */
-                    ticks++;
-                    if (serverResponseString) {
-                        this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
-                        clearInterval(intervalId);
-                        this.cleanPopup(popupWindow);
-                        if (UrlString.hashContainsKnownProperties(serverResponseString)) {
-                            this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
-                            resolve(serverResponseString);
+                    clearInterval(intervalId);
+                    let responseString = "";
+                    const responseType = this.config.auth.OIDCOptions.serverResponseType;
+                    if (popupWindow) {
+                        if (responseType === ServerResponseType.QUERY) {
+                            responseString = popupWindow.location.search;
                         }
                         else {
-                            this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
-                            this.logger.errorPii(`PopupHandler.monitorPopupForHash - hash found: ${serverResponseString}`);
-                            reject(createBrowserAuthError(hashDoesNotContainKnownProperties));
+                            responseString = popupWindow.location.hash;
                         }
                     }
-                    else if (ticks > maxTicks) {
-                        this.logger.error("PopupHandler.monitorPopupForHash - unable to find hash in url, timing out");
-                        clearInterval(intervalId);
-                        reject(createBrowserAuthError(monitorPopupTimeout));
-                    }
-                }, this.config.system.pollIntervalMilliseconds);
-            });
-        }
-        /**
-         * Waits for user interaction in logout popup window
-         * @param popupWindow
-         * @returns
-         */
-        waitForLogoutPopup(popupWindow) {
-            return new Promise((resolve) => {
-                this.logger.verbose("PopupHandler.waitForLogoutPopup - polling started");
-                const intervalId = setInterval(() => {
-                    // Window is closed
-                    if (popupWindow.closed) {
-                        this.logger.error("PopupHandler.waitForLogoutPopup - window closed");
-                        this.cleanPopup();
-                        clearInterval(intervalId);
-                        resolve();
-                    }
-                    let href = Constants.EMPTY_STRING;
-                    try {
-                        /*
-                         * Will throw if cross origin,
-                         * which should be caught and ignored
-                         * since we need the interval to keep running while on STS UI.
-                         */
-                        href = popupWindow.location.href;
-                    }
-                    catch (e) { }
-                    // Don't process blank pages or cross domain
-                    if (!href || href === "about:blank") {
-                        return;
-                    }
-                    this.logger.verbose("PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing.");
-                    clearInterval(intervalId);
-                    this.cleanPopup(popupWindow);
-                    resolve();
+                    this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
+                    resolve(responseString);
                 }, this.config.system.pollIntervalMilliseconds);
+            }).finally(() => {
+                this.cleanPopup(popupWindow);
             });
         }
         /**
@@ -14220,20 +14094,6 @@
             const homeAccountId = request.account && request.account.homeAccountId;
             return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
         }
-        /**
-         * Extracts the server response from the popup window
-         */
-        extractServerResponseStringFromPopup(popupWindow, href) {
-            let serverResponseString;
-            if (this.config.auth.OIDCOptions?.serverResponseType ===
-                ServerResponseType.QUERY) {
-                serverResponseString = UrlString.parseQueryServerResponse(href);
-            }
-            else {
-                serverResponseString = popupWindow.location.hash;
-            }
-            return serverResponseString;
-        }
     }
 
     /*
@@ -14302,12 +14162,8 @@
          * Handle authorization code response in the window.
          * @param hash
          */
-        async handleCodeResponseFromHash(locationHash, state) {
+        async handleCodeResponse(response, state) {
             this.logger.verbose("RedirectHandler.handleCodeResponse called");
-            // Check that location hash isn't empty.
-            if (!locationHash) {
-                throw createBrowserAuthError(hashEmptyError);
-            }
             // Interaction is completed - remove interaction status.
             this.browserStorage.setInteractionInProgress(false);
             // Handle code response.
@@ -14318,7 +14174,7 @@
             }
             let authCodeResponse;
             try {
-                authCodeResponse = this.authModule.handleFragmentResponse(locationHash, requestState);
+                authCodeResponse = this.authModule.handleFragmentResponse(response, requestState);
             }
             catch (e) {
                 if (e instanceof ServerError &&
@@ -14447,22 +14303,10 @@
                     this.logger.info("handleRedirectPromise called but there is no interaction in progress, returning null.");
                     return null;
                 }
-                const responseHash = this.getRedirectResponseHash(hash || window.location.hash);
-                if (!responseHash) {
+                const [serverParams, responseString] = this.getRedirectResponse(hash || "");
+                if (!serverParams) {
                     // Not a recognized server response hash or hash not associated with a redirect request
-                    this.logger.info("handleRedirectPromise did not detect a response hash as a result of a redirect. Cleaning temporary cache.");
-                    this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
-                    return null;
-                }
-                let state;
-                try {
-                    // Deserialize hash fragment response parameters.
-                    const serverParams = UrlString.getDeserializedHash(responseHash);
-                    state = this.validateAndExtractStateFromHash(serverParams, exports.InteractionType.Redirect);
-                    this.logger.verbose("State extracted from hash");
-                }
-                catch (e) {
-                    this.logger.info(`handleRedirectPromise was unable to extract state due to: ${e}`);
+                    this.logger.info("handleRedirectPromise did not detect a response as a result of a redirect. Cleaning temporary cache.");
                     this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
                     return null;
                 }
@@ -14473,17 +14317,17 @@
                 if (loginRequestUrlNormalized === currentUrlNormalized &&
                     this.config.auth.navigateToLoginRequestUrl) {
                     // We are on the page we need to navigate to - handle hash
-                    this.logger.verbose("Current page is loginRequestUrl, handling hash");
-                    const handleHashResult = await this.handleHash(responseHash, state, serverTelemetryManager);
+                    this.logger.verbose("Current page is loginRequestUrl, handling response");
                     if (loginRequestUrl.indexOf("#") > -1) {
                         // Replace current hash with non-msal hash, if present
                         replaceHash(loginRequestUrl);
                     }
+                    const handleHashResult = await this.handleResponse(serverParams, serverTelemetryManager);
                     return handleHashResult;
                 }
                 else if (!this.config.auth.navigateToLoginRequestUrl) {
-                    this.logger.verbose("NavigateToLoginRequestUrl set to false, handling hash");
-                    return this.handleHash(responseHash, state, serverTelemetryManager);
+                    this.logger.verbose("NavigateToLoginRequestUrl set to false, handling response");
+                    return this.handleResponse(serverParams, serverTelemetryManager);
                 }
                 else if (!isInIframe() ||
                     this.config.system.allowRedirectInIframe) {
@@ -14491,7 +14335,7 @@
                      * Returned from authority using redirect - need to perform navigation before processing response
                      * Cache the hash to be retrieved after the next redirect
                      */
-                    this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseHash, true);
+                    this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseString, true);
                     const navigationOptions = {
                         apiId: ApiId.handleRedirectPromise,
                         timeout: this.config.system.redirectNavigationTimeout,
@@ -14519,7 +14363,7 @@
                     }
                     // If navigateInternal implementation returns false, handle the hash now
                     if (!processHashOnRedirect) {
-                        return this.handleHash(responseHash, state, serverTelemetryManager);
+                        return this.handleResponse(serverParams, serverTelemetryManager);
                     }
                 }
                 return null;
@@ -14538,29 +14382,57 @@
          * Returns null if interactionType in the state value is not "redirect" or the hash does not contain known properties
          * @param hash
          */
-        getRedirectResponseHash(hash) {
+        getRedirectResponse(userProvidedResponse) {
             this.logger.verbose("getRedirectResponseHash called");
             // Get current location hash from window or cache.
-            const isResponseHash = UrlString.hashContainsKnownProperties(hash);
-            if (isResponseHash) {
+            let responseString = userProvidedResponse;
+            if (!responseString) {
+                if (this.config.auth.OIDCOptions.serverResponseType ===
+                    ServerResponseType.QUERY) {
+                    responseString = window.location.search;
+                }
+                else {
+                    responseString = window.location.hash;
+                }
+            }
+            let response = getDeserializedResponse(responseString);
+            if (response) {
+                try {
+                    validateInteractionType(response, this.browserCrypto, exports.InteractionType.Redirect);
+                }
+                catch (e) {
+                    if (e instanceof AuthError) {
+                        this.logger.error(`Interaction type validation failed due to ${e.errorCode}: ${e.errorMessage}`);
+                    }
+                    return [null, ""];
+                }
                 clearHash(window);
                 this.logger.verbose("Hash contains known properties, returning response hash");
-                return hash;
+                return [response, responseString];
             }
             const cachedHash = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.URL_HASH, true);
             this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH));
-            this.logger.verbose("Hash does not contain known properties, returning cached hash");
-            return cachedHash;
+            if (cachedHash) {
+                response = getDeserializedResponse(cachedHash);
+                if (response) {
+                    this.logger.verbose("Hash does not contain known properties, returning cached hash");
+                    return [response, cachedHash];
+                }
+            }
+            return [null, ""];
         }
         /**
          * Checks if hash exists and handles in window.
          * @param hash
          * @param state
          */
-        async handleHash(hash, state, serverTelemetryManager) {
+        async handleResponse(serverParams, serverTelemetryManager) {
+            const state = serverParams.state;
+            if (!state) {
+                throw createBrowserAuthError(noStateInHash);
+            }
             const cachedRequest = this.browserStorage.getCachedRequest(state);
-            this.logger.verbose("handleHash called, retrieved cached request");
-            const serverParams = UrlString.getDeserializedHash(hash);
+            this.logger.verbose("handleResponse called, retrieved cached request");
             if (serverParams.accountId) {
                 this.logger.verbose("Account id found in hash, calling WAM for token");
                 if (!this.nativeMessageHandler) {
@@ -14586,7 +14458,7 @@
             const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)(serverTelemetryManager, currentAuthority);
             ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, cachedRequest);
             const interactionHandler = new RedirectHandler(authClient, this.browserStorage, cachedRequest, this.logger, this.performanceClient);
-            return await interactionHandler.handleCodeResponseFromHash(hash, state);
+            return await interactionHandler.handleCodeResponse(serverParams, state);
         }
         /**
          * Use to log out the current user, and redirect the user to the postLogoutRedirectUri.
@@ -14697,7 +14569,7 @@
      * @param iframe
      * @param timeout
      */
-    async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId) {
+    async function monitorIframeForHash(iframe, timeout, pollIntervalMilliseconds, performanceClient, logger, correlationId, responseType) {
         performanceClient.addQueueMeasurement(PerformanceEvents.SilentHandlerMonitorIframeForHash, correlationId);
         return new Promise((resolve, reject) => {
             if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
@@ -14726,12 +14598,18 @@
                 if (!href || href === "about:blank") {
                     return;
                 }
-                const contentHash = contentWindow
-                    ? contentWindow.location.hash
-                    : "";
+                let responseString = "";
+                if (contentWindow) {
+                    if (responseType === ServerResponseType.QUERY) {
+                        responseString = contentWindow.location.search;
+                    }
+                    else {
+                        responseString = contentWindow.location.hash;
+                    }
+                }
                 window.clearTimeout(timeoutId);
                 window.clearInterval(intervalId);
-                resolve(contentHash);
+                resolve(responseString);
             }, pollIntervalMilliseconds);
         }).finally(() => {
             invoke(removeHiddenIframe, PerformanceEvents.RemoveHiddenIframe, logger, performanceClient, correlationId)(iframe);
@@ -14874,20 +14752,10 @@
             const interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.performanceClient);
             // Get the frame handle for the silent request
             const msalFrame = await invokeAsync(initiateAuthRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+            const responseType = this.config.auth.OIDCOptions.serverResponseType;
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const hash = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId);
-            if (!hash) {
-                // No hash is present
-                this.logger.error("The request has returned to the redirectUri but a hash is not present in the iframe. It's likely that the hash has been removed or the page has been redirected by code running on the redirectUri page.");
-                throw createBrowserAuthError(hashEmptyError);
-            }
-            else if (!UrlString.hashContainsKnownProperties(hash)) {
-                this.logger.error("A hash is present in the iframe but it does not contain known properties. It's likely that the hash has been replaced by code running on the redirectUri page.");
-                this.logger.errorPii(`The hash detected in the iframe is: ${hash}`);
-                throw createBrowserAuthError(hashDoesNotContainKnownProperties);
-            }
-            // Deserialize hash fragment response parameters.
-            const serverParams = UrlString.getDeserializedHash(hash);
+            const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, responseType, this.logger);
             if (serverParams.accountId) {
                 this.logger.verbose("Account id found in hash, calling WAM for token");
                 if (!this.nativeMessageHandler) {
@@ -14902,7 +14770,7 @@
                 });
             }
             // Handle response from hash string
-            return invokeAsync(interactionHandler.handleCodeResponseFromHash.bind(interactionHandler), PerformanceEvents.HandleCodeResponseFromHash, this.logger, this.performanceClient, correlationId)(hash, silentRequest);
+            return invokeAsync(interactionHandler.handleCodeResponse.bind(interactionHandler), PerformanceEvents.HandleCodeResponse, this.logger, this.performanceClient, correlationId)(serverParams, silentRequest);
         }
     }
 
@@ -15373,12 +15241,6 @@
             this.logger.verbose("handleRedirectPromise called");
             // Block token acquisition before initialize has been called
             blockAPICallsBeforeInitialize(this.initialized);
-            let foundServerResponse = hash;
-            if (this.config.auth.OIDCOptions?.serverResponseType ===
-                ServerResponseType.QUERY) {
-                const url = window.location.href;
-                foundServerResponse = UrlString.parseQueryServerResponse(url);
-            }
             const loggedInAccounts = this.getAllAccounts();
             if (this.isBrowserEnvironment) {
                 /**
@@ -15386,7 +15248,7 @@
                  * otherwise return the promise from the first invocation. Prevents race conditions when handleRedirectPromise is called
                  * several times concurrently.
                  */
-                const redirectResponseKey = foundServerResponse || Constants.EMPTY_STRING;
+                const redirectResponseKey = hash || "";
                 let response = this.redirectResponse.get(redirectResponseKey);
                 if (typeof response === "undefined") {
                     this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
@@ -15396,7 +15258,7 @@
                     if (request &&
                         NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
                         this.nativeExtensionProvider &&
-                        !foundServerResponse) {
+                        !hash) {
                         this.logger.trace("handleRedirectPromise - acquiring token from native platform");
                         const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
                         redirectResponse = nativeClient.handleRedirectPromise();
@@ -15406,7 +15268,7 @@
                         const correlationId = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || Constants.EMPTY_STRING;
                         const redirectClient = this.createRedirectClient(correlationId);
                         redirectResponse =
-                            redirectClient.handleRedirectPromise(foundServerResponse);
+                            redirectClient.handleRedirectPromise(hash);
                     }
                     response = redirectResponse
                         .then((result) => {
@@ -15471,19 +15333,19 @@
             }
             let result;
             if (this.nativeExtensionProvider && this.canUseNative(request)) {
-                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, request.correlationId);
+                const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.acquireTokenRedirect, this.performanceClient, this.nativeExtensionProvider, this.getNativeAccountId(request), this.nativeInternalStorage, correlationId);
                 result = nativeClient
                     .acquireTokenRedirect(request)
                     .catch((e) => {
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const redirectClient = this.createRedirectClient(request.correlationId);
+                        const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
                     else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose("acquireTokenRedirect - Resolving interaction required error thrown by native broker by falling back to web flow");
-                        const redirectClient = this.createRedirectClient(request.correlationId);
+                        const redirectClient = this.createRedirectClient(correlationId);
                         return redirectClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
@@ -15491,7 +15353,7 @@
                 });
             }
             else {
-                const redirectClient = this.createRedirectClient(request.correlationId);
+                const redirectClient = this.createRedirectClient(correlationId);
                 result = redirectClient.acquireToken(request);
             }
             return result.catch((e) => {
@@ -15535,7 +15397,10 @@
             }
             let result;
             if (this.canUseNative(request)) {
-                result = this.acquireTokenNative(request, ApiId.acquireTokenPopup)
+                result = this.acquireTokenNative({
+                    ...request,
+                    correlationId,
+                }, ApiId.acquireTokenPopup)
                     .then((response) => {
                     this.getBrowserStorage().setInteractionInProgress(false);
                     atPopupMeasurement.end({
@@ -15549,12 +15414,12 @@
                     if (e instanceof NativeAuthError &&
                         isFatalNativeAuthError(e)) {
                         this.nativeExtensionProvider = undefined; // If extension gets uninstalled during session prevent future requests from continuing to attempt
-                        const popupClient = this.createPopupClient(request.correlationId);
+                        const popupClient = this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     }
                     else if (e instanceof InteractionRequiredAuthError) {
                         this.logger.verbose("acquireTokenPopup - Resolving interaction required error thrown by native broker by falling back to web flow");
-                        const popupClient = this.createPopupClient(request.correlationId);
+                        const popupClient = this.createPopupClient(correlationId);
                         return popupClient.acquireToken(request);
                     }
                     this.getBrowserStorage().setInteractionInProgress(false);
@@ -15562,7 +15427,7 @@
                 });
             }
             else {
-                const popupClient = this.createPopupClient(request.correlationId);
+                const popupClient = this.createPopupClient(correlationId);
                 result = popupClient.acquireToken(request);
             }
             return result
@@ -15705,7 +15570,7 @@
             this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
             this.logger.trace("acquireTokenByCode called", correlationId);
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_BY_CODE_START, exports.InteractionType.Silent, request);
-            const atbcMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCode, request.correlationId);
+            const atbcMeasurement = this.performanceClient.startMeasurement(PerformanceEvents.AcquireTokenByCode, correlationId);
             try {
                 if (request.code && request.nativeAccountId) {
                     // Throw error in case server returns both spa_code and spa_accountid in exchange for auth code.
@@ -15747,14 +15612,17 @@
                         this.hybridAuthCodeResponses.set(hybridAuthCode, response);
                     }
                     else {
-                        this.logger.verbose("Existing acquireTokenByCode request found", request.correlationId);
+                        this.logger.verbose("Existing acquireTokenByCode request found", correlationId);
                         atbcMeasurement.discard();
                     }
                     return response;
                 }
                 else if (request.nativeAccountId) {
                     if (this.canUseNative(request, request.nativeAccountId)) {
-                        return this.acquireTokenNative(request, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
+                        return this.acquireTokenNative({
+                            ...request,
+                            correlationId,
+                        }, ApiId.acquireTokenByCode, request.nativeAccountId).catch((e) => {
                             // If native token acquisition fails for availability reasons fallback to standard flow
                             if (e instanceof NativeAuthError &&
                                 isFatalNativeAuthError(e)) {
@@ -16395,6 +16263,7 @@
                 resourceRequestUri: request.resourceRequestUri,
                 shrClaims: request.shrClaims,
                 sshKid: request.sshKid,
+                shrOptions: request.shrOptions,
             };
             const silentRequestKey = JSON.stringify(thumbprint);
             const cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
@@ -18554,6 +18423,7 @@
     exports.InteractionRequiredAuthErrorCodes = InteractionRequiredAuthErrorCodes;
     exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
     exports.InteractionStatus = InteractionStatus;
+    exports.JsonWebTokenTypes = JsonWebTokenTypes;
     exports.Logger = Logger;
     exports.MemoryStorage = MemoryStorage;
     exports.NavigationClient = NavigationClient;