npm - @azure/msal-browser - Versions diffs - 4.14.0 → 4.16.0 - Mend

@azure/msal-browser 4.14.0 → 4.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (307) hide show

package/lib/msal-browser.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.14.0 2025-07-01 */
+/*! @azure/msal-browser v4.16.0 2025-07-23 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -82,6 +82,10 @@ const HttpStatus = {
     SERVER_ERROR_RANGE_END: 599,
     MULTI_SIDED_ERROR: 600,
 };
+const HttpMethod = {
+    GET: "GET",
+    POST: "POST",
+};
 const OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
     Constants.PROFILE_SCOPE,
@@ -135,13 +139,6 @@ const PromptValue = {
     CREATE: "create",
     NO_SESSION: "no_session",
 };
-/**
- * allowed values for codeVerifier
- */
-const CodeChallengeMethodValues = {
-    PLAIN: "plain",
-    S256: "S256",
-};
 /**
  * Allowed values for response_type
  */
@@ -284,7 +281,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -301,7 +298,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -350,7 +347,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -448,7 +445,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -700,7 +697,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -739,7 +736,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -930,12 +927,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.8.0";
+const version$1 = "15.9.0";
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -955,7 +952,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1016,7 +1013,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1071,7 +1068,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1398,7 +1395,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1409,7 +1406,6 @@ const authorityUriInsecure = "authority_uri_insecure";
 const urlParseError = "url_parse_error";
 const urlEmptyError = "empty_url_error";
 const emptyInputScopesError = "empty_input_scopes_error";
-const invalidPromptValue = "invalid_prompt_value";
 const invalidClaims = "invalid_claims";
 const tokenRequestEmpty = "token_request_empty";
 const logoutRequestEmpty = "logout_request_empty";
@@ -1424,7 +1420,9 @@ const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
-const authorityMismatch = "authority_mismatch";
+const authorityMismatch = "authority_mismatch";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -1436,10 +1434,11 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     emptyInputScopesError: emptyInputScopesError,
     invalidAuthenticationHeader: invalidAuthenticationHeader,
     invalidAuthorityMetadata: invalidAuthorityMetadata,
+    invalidAuthorizePostBodyParameters: invalidAuthorizePostBodyParameters,
     invalidClaims: invalidClaims,
     invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
     invalidCodeChallengeMethod: invalidCodeChallengeMethod,
-    invalidPromptValue: invalidPromptValue,
+    invalidRequestMethodForEAR: invalidRequestMethodForEAR,
     logoutRequestEmpty: logoutRequestEmpty,
     missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
     missingSshJwk: missingSshJwk,
@@ -1452,7 +1451,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1465,7 +1464,6 @@ const ClientConfigurationErrorMessages = {
     [urlParseError]: "URL could not be parsed into appropriate segments.",
     [urlEmptyError]: "URL was empty or null.",
     [emptyInputScopesError]: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-    [invalidPromptValue]: "Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     [invalidClaims]: "Given claims parameter must be a stringified JSON object.",
     [tokenRequestEmpty]: "Token request was empty and not found in cache.",
     [logoutRequestEmpty]: "The logout request was null or undefined.",
@@ -1481,6 +1479,8 @@ const ClientConfigurationErrorMessages = {
     [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
     [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
     [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    [invalidAuthorizePostBodyParameters]: "Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",
+    [invalidRequestMethodForEAR]: "Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",
 };
 /**
  * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
@@ -1511,10 +1511,6 @@ const ClientConfigurationErrorMessage = {
         code: emptyInputScopesError,
         desc: ClientConfigurationErrorMessages[emptyInputScopesError],
     },
-    invalidPrompt: {
-        code: invalidPromptValue,
-        desc: ClientConfigurationErrorMessages[invalidPromptValue],
-    },
     invalidClaimsRequest: {
         code: invalidClaims,
         desc: ClientConfigurationErrorMessages[invalidClaims],
@@ -1575,6 +1571,14 @@ const ClientConfigurationErrorMessage = {
         code: authorityMismatch,
         desc: ClientConfigurationErrorMessages[authorityMismatch],
     },
+    invalidAuthorizePostBodyParameters: {
+        code: invalidAuthorizePostBodyParameters,
+        desc: ClientConfigurationErrorMessages[invalidAuthorizePostBodyParameters],
+    },
+    invalidRequestMethodForEAR: {
+        code: invalidRequestMethodForEAR,
+        desc: ClientConfigurationErrorMessages[invalidRequestMethodForEAR],
+    },
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1590,7 +1594,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1687,7 +1691,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1878,7 +1882,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1918,7 +1922,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1997,7 +2001,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2012,7 +2016,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2034,7 +2038,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2058,7 +2062,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2301,7 +2305,7 @@ class AccountEntity {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2366,7 +2370,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2530,7 +2534,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2669,7 +2673,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2677,7 +2681,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2722,7 +2726,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3889,7 +3893,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4401,7 +4405,7 @@ const IntFields = new Set([
     "encryptedCacheExpiredCount",
 ]);
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4480,7 +4484,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4580,7 +4584,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4590,7 +4594,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4640,7 +4644,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5006,9 +5010,21 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+/**
+ * Adds authorize body parameters to the request parameters
+ * @param parameters
+ * @param bodyParameters
+ */
+function addPostBodyParameters(parameters, bodyParameters) {
+    Object.entries(bodyParameters).forEach(([key, value]) => {
+        if (value) {
+            parameters.set(key, value);
+        }
+    });
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5020,7 +5036,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5030,7 +5046,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5040,7 +5056,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5136,7 +5152,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5242,7 +5258,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6081,7 +6097,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6112,7 +6128,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6131,7 +6147,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6152,7 +6168,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6239,7 +6255,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6270,7 +6286,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6418,7 +6434,7 @@ class BaseClient {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6446,7 +6462,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     uxNotAllowed: uxNotAllowed
 });
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6536,7 +6552,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6608,7 +6624,7 @@ class ProtocolUtils {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6690,7 +6706,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6717,7 +6733,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7048,74 +7064,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Validates server consumable params from the "request" objects
- */
-class RequestValidator {
-    /**
-     * Utility to check if the `redirectUri` in the request is a non-null value
-     * @param redirectUri
-     */
-    static validateRedirectUri(redirectUri) {
-        if (!redirectUri) {
-            throw createClientConfigurationError(redirectUriEmpty);
-        }
-    }
-    /**
-     * Utility to validate prompt sent by the user in the request
-     * @param prompt
-     */
-    static validatePrompt(prompt) {
-        const promptValues = [];
-        for (const value in PromptValue) {
-            promptValues.push(PromptValue[value]);
-        }
-        if (promptValues.indexOf(prompt) < 0) {
-            throw createClientConfigurationError(invalidPromptValue);
-        }
-    }
-    static validateClaims(claims) {
-        try {
-            JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    /**
-     * Utility to validate code_challenge and code_challenge_method
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (!codeChallenge || !codeChallengeMethod) {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-        else {
-            this.validateCodeChallengeMethod(codeChallengeMethod);
-        }
-    }
-    /**
-     * Utility to validate code_challenge_method
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeMethod(codeChallengeMethod) {
-        if ([
-            CodeChallengeMethodValues.PLAIN,
-            CodeChallengeMethodValues.S256,
-        ].indexOf(codeChallengeMethod) < 0) {
-            throw createClientConfigurationError(invalidCodeChallengeMethod);
-        }
-    }
-}
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7133,7 +7082,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7227,7 +7176,9 @@ class AuthorizationCodeClient extends BaseClient {
          */
         if (!this.includeRedirectUri) {
             // Just validate
-            RequestValidator.validateRedirectUri(request.redirectUri);
+            if (!request.redirectUri) {
+                throw createClientConfigurationError(redirectUriEmpty);
+            }
         }
         else {
             // Validate and include redirect uri
@@ -7366,7 +7317,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7575,7 +7526,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7673,7 +7624,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7688,7 +7639,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7912,7 +7863,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7970,7 +7921,7 @@ class AuthenticationHeaderParser {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8233,7 +8184,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8241,7 +8192,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8266,7 +8217,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8306,7 +8257,7 @@ class JoseHeader {
     }
 }
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10410,7 +10361,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.14.0";
+const version = "4.16.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13141,6 +13092,35 @@ async function initializeSilentRequest(request, account, config, performanceClie
         account: account,
         forceRefresh: request.forceRefresh || false,
     };
+}
+/**
+ * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
+ * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
+ * @param interactionRequest
+ * @param protocolMode
+ * @returns
+ */
+function validateRequestMethod(interactionRequest, protocolMode) {
+    let httpMethod;
+    const requestMethod = interactionRequest.httpMethod;
+    if (protocolMode === ProtocolMode.EAR) {
+        // Don't override httpMethod if it is already set, default to POST if not set
+        httpMethod = requestMethod || HttpMethod.POST;
+        // Validate that method is not GET if protocol mode is EAR
+        if (httpMethod !== HttpMethod.POST) {
+            throw createClientConfigurationError(invalidRequestMethodForEAR);
+        }
+    }
+    else {
+        // For non-EAR protocol modes, default to GET if httpMethod is not set
+        httpMethod = requestMethod || HttpMethod.GET;
+    }
+    // Regardless of protocolMode, if there are authorizePostBodyParameters, validate the request method is POST
+    if (interactionRequest.authorizePostBodyParameters &&
+        httpMethod !== HttpMethod.POST) {
+        throw createClientConfigurationError(invalidAuthorizePostBodyParameters);
+    }
+    return httpMethod;
 }
 /*
@@ -13317,7 +13297,7 @@ class StandardInteractionClient extends BaseInteractionClient {
         };
         const state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || Constants.EMPTY_STRING, browserState);
         const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)({ ...request, correlationId: this.correlationId }, this.config, this.performanceClient, this.logger);
-        const validatedRequest = {
+        const interactionRequest = {
             ...baseRequest,
             redirectUri: redirectUri,
             state: state,
@@ -13325,6 +13305,10 @@ class StandardInteractionClient extends BaseInteractionClient {
             responseMode: this.config.auth.OIDCOptions
                 .serverResponseType,
         };
+        const validatedRequest = {
+            ...interactionRequest,
+            httpMethod: validateRequestMethod(interactionRequest, this.config.auth.protocolMode),
+        };
         // Skip active account lookup if either login hint or session id is set
         if (request.loginHint || request.sid) {
             return validatedRequest;
@@ -14319,6 +14303,19 @@ async function getEARForm(frame, config, authority, request, logger, performance
     const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
     return createForm(frame, url, parameters);
 }
+/**
+ * Gets the form that will be posted to /authorize with request parameters when using POST method
+ */
+async function getCodeForm(frame, config, authority, request, logger, performanceClient) {
+    const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
+    addResponseType(parameters, OAuthResponseType.CODE);
+    addCodeChallengeParams(parameters, request.codeChallenge, request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD);
+    addPostBodyParameters(parameters, request.authorizePostBodyParameters || {});
+    const queryParams = new Map();
+    addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
+    const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
+    return createForm(frame, url, parameters);
+}
 /**
  * Creates form element in the provided document with auth parameters in the post body
  * @param frame
@@ -15010,9 +15007,10 @@ class PopupClient extends StandardInteractionClient {
      * @param pkceCodes
      */
     acquireToken(request, pkceCodes) {
+        let popupParams = undefined;
         try {
             const popupName = this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority);
-            const popupParams = {
+            popupParams = {
                 popupName,
                 popupWindowAttributes: request.popupWindowAttributes || {},
                 popupWindowParent: request.popupWindowParent ?? window,
@@ -15025,10 +15023,15 @@ class PopupClient extends StandardInteractionClient {
                 return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
             }
             else {
+                // Pre-validate request method to avoid opening popup if the request is invalid
+                const validatedRequest = {
+                    ...request,
+                    httpMethod: validateRequestMethod(request, this.config.auth.protocolMode),
+                };
                 // asyncPopups flag is set to false. Opens popup before acquiring token.
                 this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
                 popupParams.popup = this.openSizedPopup("about:blank", popupParams);
-                return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
+                return this.acquireTokenPopupAsync(validatedRequest, popupParams, pkceCodes);
             }
         }
         catch (e) {
@@ -15120,15 +15123,20 @@ class PopupClient extends StandardInteractionClient {
                 requestExtraQueryParameters: popupRequest.extraQueryParameters,
                 account: popupRequest.account,
             });
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
-            // Show the UI once the url has been created. Get the window handle for the popup.
-            const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
-            this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
-            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
-            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-            return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            if (popupRequest.httpMethod === HttpMethod.POST) {
+                return await this.executeCodeFlowWithPost(popupRequest, popupParams, authClient, pkce.verifier);
+            }
+            else {
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
+                // Show the UI once the url has been created. Get the window handle for the popup.
+                const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
+                this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
+                // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+                const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
+                const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+                return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            }
         }
         catch (e) {
             // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -15166,6 +15174,23 @@ class PopupClient extends StandardInteractionClient {
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
         return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
+    async executeCodeFlowWithPost(request, popupParams, authClient, pkceVerifier) {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+        const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
+        const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+        form.submit();
+        // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
+        const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+    }
     /**
      *
      * @param validRequest
@@ -15517,18 +15542,23 @@ class RedirectClient extends StandardInteractionClient {
         };
         this.browserStorage.cacheAuthorizeRequest(redirectRequest, pkceCodes.verifier);
         try {
-            // Initialize the client
-            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-                serverTelemetryManager,
-                requestAuthority: redirectRequest.authority,
-                requestAzureCloudOptions: redirectRequest.azureCloudOptions,
-                requestExtraQueryParameters: redirectRequest.extraQueryParameters,
-                account: redirectRequest.account,
-            });
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
-            // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-            return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+            if (redirectRequest.httpMethod === HttpMethod.POST) {
+                return await this.executeCodeFlowWithPost(redirectRequest);
+            }
+            else {
+                // Initialize the client
+                const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                    serverTelemetryManager,
+                    requestAuthority: redirectRequest.authority,
+                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                    requestExtraQueryParameters: redirectRequest.extraQueryParameters,
+                    account: redirectRequest.account,
+                });
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
+                // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
+                return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+            }
         }
         catch (e) {
             if (e instanceof AuthError) {
@@ -15565,6 +15595,28 @@ class RedirectClient extends StandardInteractionClient {
             }, this.config.system.redirectNavigationTimeout);
         });
     }
+    /**
+     * Executes classic Authorization Code flow with a POST request.
+     * @param request
+     */
+    async executeCodeFlowWithPost(request) {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+        this.browserStorage.cacheAuthorizeRequest(request);
+        const form = await getCodeForm(document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+        form.submit();
+        return new Promise((resolve, reject) => {
+            setTimeout(() => {
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+            }, this.config.system.redirectNavigationTimeout);
+        });
+    }
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate
@@ -15875,6 +15927,15 @@ async function initiateCodeRequest(requestUrl, performanceClient, logger, correl
     }
     return invoke(loadFrameSync, PerformanceEvents.SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
 }
+async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
+    const frame = createHiddenIframe();
+    if (!frame.contentDocument) {
+        throw "No document associated with iframe!";
+    }
+    const form = await getCodeForm(frame.contentDocument, config, authority, request, logger, performanceClient);
+    form.submit();
+    return frame;
+}
 async function initiateEarRequest(config, authority, request, logger, performanceClient) {
     const frame = createHiddenIframe();
     if (!frame.contentDocument) {
@@ -16123,10 +16184,16 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        // Create authorize request url
-        const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-        // Get the frame handle for the silent request
-        const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        let msalFrame;
+        if (request.httpMethod === HttpMethod.POST) {
+            msalFrame = await invokeAsync(initiateCodeFlowWithPost, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+        }
+        else {
+            // Create authorize request url
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            // Get the frame handle for the silent request
+            msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        }
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
@@ -18225,7 +18292,13 @@ class NestedAppAuthController {
                 ...this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp),
             };
             // cache the tokens in the response
-            await this.hydrateCache(result, request);
+            try {
+                // cache hydration can fail in JS Runtime scenario that doesn't support full crypto API
+                await this.hydrateCache(result, request);
+            }
+            catch (error) {
+                this.logger.warningPii(`Failed to hydrate cache. Error: ${error}`, validRequest.correlationId);
+            }
             // cache the account context in memory after successful token fetch
             this.currentAccountContext = {
                 homeAccountId: result.account.homeAccountId,
@@ -18282,7 +18355,13 @@ class NestedAppAuthController {
             const response = await this.bridgeProxy.getTokenSilent(naaRequest);
             const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
             // cache the tokens in the response
-            await this.hydrateCache(result, request);
+            try {
+                // cache hydration can fail in JS Runtime scenario that doesn't support full crypto API
+                await this.hydrateCache(result, request);
+            }
+            catch (error) {
+                this.logger.warningPii(`Failed to hydrate cache. Error: ${error}`, validRequest.correlationId);
+            }
             // cache the account context in memory after successful token fetch
             this.currentAccountContext = {
                 homeAccountId: result.account.homeAccountId,