@azure/msal-browser 4.14.0 → 4.16.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v4.14.0 2025-07-01 */
+/*! @azure/msal-browser v4.16.0 2025-07-23 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msal = {}));
 })(this, (function (exports) { 'use strict';
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -86,6 +86,10 @@
         SERVER_ERROR_RANGE_END: 599,
         MULTI_SIDED_ERROR: 600,
     };
+    const HttpMethod = {
+        GET: "GET",
+        POST: "POST",
+    };
     const OIDC_DEFAULT_SCOPES = [
         Constants.OPENID_SCOPE,
         Constants.PROFILE_SCOPE,
@@ -139,13 +143,6 @@
         CREATE: "create",
         NO_SESSION: "no_session",
     };
-    /**
-     * allowed values for codeVerifier
-     */
-    const CodeChallengeMethodValues = {
-        PLAIN: "plain",
-        S256: "S256",
-    };
     /**
      * Allowed values for response_type
      */
@@ -288,7 +285,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -305,7 +302,7 @@
         unexpectedError: unexpectedError
     });
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -354,7 +351,7 @@
             : AuthErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -452,7 +449,7 @@
         userTimeoutReached: userTimeoutReached
     });
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -704,7 +701,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -743,7 +740,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -934,12 +931,12 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "15.8.0";
+    const version$1 = "15.9.0";
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -959,7 +956,7 @@
         AzureUsGovernment: "https://login.microsoftonline.us",
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1020,7 +1017,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1075,7 +1072,7 @@
         return cachedAtSec > nowSeconds();
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1402,7 +1399,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1413,7 +1410,6 @@
     const urlParseError = "url_parse_error";
     const urlEmptyError = "empty_url_error";
     const emptyInputScopesError = "empty_input_scopes_error";
-    const invalidPromptValue = "invalid_prompt_value";
     const invalidClaims = "invalid_claims";
     const tokenRequestEmpty = "token_request_empty";
     const logoutRequestEmpty = "logout_request_empty";
@@ -1428,7 +1424,9 @@
     const invalidAuthenticationHeader = "invalid_authentication_header";
     const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
     const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
-    const authorityMismatch = "authority_mismatch";
+    const authorityMismatch = "authority_mismatch";
+    const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+    const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 
     var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -1440,10 +1438,11 @@
         emptyInputScopesError: emptyInputScopesError,
         invalidAuthenticationHeader: invalidAuthenticationHeader,
         invalidAuthorityMetadata: invalidAuthorityMetadata,
+        invalidAuthorizePostBodyParameters: invalidAuthorizePostBodyParameters,
         invalidClaims: invalidClaims,
         invalidCloudDiscoveryMetadata: invalidCloudDiscoveryMetadata,
         invalidCodeChallengeMethod: invalidCodeChallengeMethod,
-        invalidPromptValue: invalidPromptValue,
+        invalidRequestMethodForEAR: invalidRequestMethodForEAR,
         logoutRequestEmpty: logoutRequestEmpty,
         missingNonceAuthenticationHeader: missingNonceAuthenticationHeader,
         missingSshJwk: missingSshJwk,
@@ -1456,7 +1455,7 @@
         urlParseError: urlParseError
     });
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1469,7 +1468,6 @@
         [urlParseError]: "URL could not be parsed into appropriate segments.",
         [urlEmptyError]: "URL was empty or null.",
         [emptyInputScopesError]: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-        [invalidPromptValue]: "Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
         [invalidClaims]: "Given claims parameter must be a stringified JSON object.",
         [tokenRequestEmpty]: "Token request was empty and not found in cache.",
         [logoutRequestEmpty]: "The logout request was null or undefined.",
@@ -1485,6 +1483,8 @@
         [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
         [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
         [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+        [invalidAuthorizePostBodyParameters]: "Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",
+        [invalidRequestMethodForEAR]: "Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",
     };
     /**
      * ClientConfigurationErrorMessage class containing string constants used by error codes and messages.
@@ -1515,10 +1515,6 @@
             code: emptyInputScopesError,
             desc: ClientConfigurationErrorMessages[emptyInputScopesError],
         },
-        invalidPrompt: {
-            code: invalidPromptValue,
-            desc: ClientConfigurationErrorMessages[invalidPromptValue],
-        },
         invalidClaimsRequest: {
             code: invalidClaims,
             desc: ClientConfigurationErrorMessages[invalidClaims],
@@ -1579,6 +1575,14 @@
             code: authorityMismatch,
             desc: ClientConfigurationErrorMessages[authorityMismatch],
         },
+        invalidAuthorizePostBodyParameters: {
+            code: invalidAuthorizePostBodyParameters,
+            desc: ClientConfigurationErrorMessages[invalidAuthorizePostBodyParameters],
+        },
+        invalidRequestMethodForEAR: {
+            code: invalidRequestMethodForEAR,
+            desc: ClientConfigurationErrorMessages[invalidRequestMethodForEAR],
+        },
     };
     /**
      * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1594,7 +1598,7 @@
         return new ClientConfigurationError(errorCode);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1691,7 +1695,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1882,7 +1886,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1922,7 +1926,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2001,7 +2005,7 @@
         return updatedAccountInfo;
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2016,7 +2020,7 @@
         Ciam: 3,
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2038,7 +2042,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2062,7 +2066,7 @@
         EAR: "EAR",
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2305,7 +2309,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2370,7 +2374,7 @@
         return queryParameterArray.join("&");
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2534,7 +2538,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2673,7 +2677,7 @@
         return null;
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2681,7 +2685,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2726,7 +2730,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3893,7 +3897,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4405,7 +4409,7 @@
         "encryptedCacheExpiredCount",
     ]);
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4484,7 +4488,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4584,7 +4588,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4594,7 +4598,7 @@
         UPN: "UPN",
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4644,7 +4648,7 @@
     const EAR_JWK = "ear_jwk";
     const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5010,9 +5014,21 @@
         // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
         const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
         parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+    }
+    /**
+     * Adds authorize body parameters to the request parameters
+     * @param parameters
+     * @param bodyParameters
+     */
+    function addPostBodyParameters(parameters, bodyParameters) {
+        Object.entries(bodyParameters).forEach(([key, value]) => {
+            if (value) {
+                parameters.set(key, value);
+            }
+        });
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5024,7 +5040,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5034,7 +5050,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5044,7 +5060,7 @@
             response.hasOwnProperty("error_description"));
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5140,7 +5156,7 @@
         };
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5246,7 +5262,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6085,7 +6101,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6116,7 +6132,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6135,7 +6151,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6156,7 +6172,7 @@
         };
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6243,7 +6259,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6274,7 +6290,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6422,7 +6438,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6450,7 +6466,7 @@
         uxNotAllowed: uxNotAllowed
     });
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6540,7 +6556,7 @@
         return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6612,7 +6628,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6694,7 +6710,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6721,7 +6737,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7052,74 +7068,7 @@
         return baseAccount;
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * Validates server consumable params from the "request" objects
-     */
-    class RequestValidator {
-        /**
-         * Utility to check if the `redirectUri` in the request is a non-null value
-         * @param redirectUri
-         */
-        static validateRedirectUri(redirectUri) {
-            if (!redirectUri) {
-                throw createClientConfigurationError(redirectUriEmpty);
-            }
-        }
-        /**
-         * Utility to validate prompt sent by the user in the request
-         * @param prompt
-         */
-        static validatePrompt(prompt) {
-            const promptValues = [];
-            for (const value in PromptValue) {
-                promptValues.push(PromptValue[value]);
-            }
-            if (promptValues.indexOf(prompt) < 0) {
-                throw createClientConfigurationError(invalidPromptValue);
-            }
-        }
-        static validateClaims(claims) {
-            try {
-                JSON.parse(claims);
-            }
-            catch (e) {
-                throw createClientConfigurationError(invalidClaims);
-            }
-        }
-        /**
-         * Utility to validate code_challenge and code_challenge_method
-         * @param codeChallenge
-         * @param codeChallengeMethod
-         */
-        static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-            if (!codeChallenge || !codeChallengeMethod) {
-                throw createClientConfigurationError(pkceParamsMissing);
-            }
-            else {
-                this.validateCodeChallengeMethod(codeChallengeMethod);
-            }
-        }
-        /**
-         * Utility to validate code_challenge_method
-         * @param codeChallengeMethod
-         */
-        static validateCodeChallengeMethod(codeChallengeMethod) {
-            if ([
-                CodeChallengeMethodValues.PLAIN,
-                CodeChallengeMethodValues.S256,
-            ].indexOf(codeChallengeMethod) < 0) {
-                throw createClientConfigurationError(invalidCodeChallengeMethod);
-            }
-        }
-    }
-
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7137,7 +7086,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7231,7 +7180,9 @@
              */
             if (!this.includeRedirectUri) {
                 // Just validate
-                RequestValidator.validateRedirectUri(request.redirectUri);
+                if (!request.redirectUri) {
+                    throw createClientConfigurationError(redirectUriEmpty);
+                }
             }
             else {
                 // Validate and include redirect uri
@@ -7370,7 +7321,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7579,7 +7530,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7677,7 +7628,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7692,7 +7643,7 @@
         },
     };
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7916,7 +7867,7 @@
         return account.idTokenClaims?.login_hint || null;
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7974,7 +7925,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8237,7 +8188,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8245,7 +8196,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8270,7 +8221,7 @@
         return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8310,7 +8261,7 @@
         }
     }
 
-    /*! @azure/msal-common v15.8.0 2025-07-01 */
+    /*! @azure/msal-common v15.9.0 2025-07-23 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10414,7 +10365,7 @@
 
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "4.14.0";
+    const version = "4.16.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -13145,6 +13096,35 @@
             account: account,
             forceRefresh: request.forceRefresh || false,
         };
+    }
+    /**
+     * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
+     * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
+     * @param interactionRequest
+     * @param protocolMode
+     * @returns
+     */
+    function validateRequestMethod(interactionRequest, protocolMode) {
+        let httpMethod;
+        const requestMethod = interactionRequest.httpMethod;
+        if (protocolMode === ProtocolMode.EAR) {
+            // Don't override httpMethod if it is already set, default to POST if not set
+            httpMethod = requestMethod || HttpMethod.POST;
+            // Validate that method is not GET if protocol mode is EAR
+            if (httpMethod !== HttpMethod.POST) {
+                throw createClientConfigurationError(invalidRequestMethodForEAR);
+            }
+        }
+        else {
+            // For non-EAR protocol modes, default to GET if httpMethod is not set
+            httpMethod = requestMethod || HttpMethod.GET;
+        }
+        // Regardless of protocolMode, if there are authorizePostBodyParameters, validate the request method is POST
+        if (interactionRequest.authorizePostBodyParameters &&
+            httpMethod !== HttpMethod.POST) {
+            throw createClientConfigurationError(invalidAuthorizePostBodyParameters);
+        }
+        return httpMethod;
     }
 
     /*
@@ -13321,7 +13301,7 @@
             };
             const state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || Constants.EMPTY_STRING, browserState);
             const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)({ ...request, correlationId: this.correlationId }, this.config, this.performanceClient, this.logger);
-            const validatedRequest = {
+            const interactionRequest = {
                 ...baseRequest,
                 redirectUri: redirectUri,
                 state: state,
@@ -13329,6 +13309,10 @@
                 responseMode: this.config.auth.OIDCOptions
                     .serverResponseType,
             };
+            const validatedRequest = {
+                ...interactionRequest,
+                httpMethod: validateRequestMethod(interactionRequest, this.config.auth.protocolMode),
+            };
             // Skip active account lookup if either login hint or session id is set
             if (request.loginHint || request.sid) {
                 return validatedRequest;
@@ -14323,6 +14307,19 @@
         const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
         return createForm(frame, url, parameters);
     }
+    /**
+     * Gets the form that will be posted to /authorize with request parameters when using POST method
+     */
+    async function getCodeForm(frame, config, authority, request, logger, performanceClient) {
+        const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
+        addResponseType(parameters, OAuthResponseType.CODE);
+        addCodeChallengeParams(parameters, request.codeChallenge, request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD);
+        addPostBodyParameters(parameters, request.authorizePostBodyParameters || {});
+        const queryParams = new Map();
+        addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
+        const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
+        return createForm(frame, url, parameters);
+    }
     /**
      * Creates form element in the provided document with auth parameters in the post body
      * @param frame
@@ -15014,9 +15011,10 @@
          * @param pkceCodes
          */
         acquireToken(request, pkceCodes) {
+            let popupParams = undefined;
             try {
                 const popupName = this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority);
-                const popupParams = {
+                popupParams = {
                     popupName,
                     popupWindowAttributes: request.popupWindowAttributes || {},
                     popupWindowParent: request.popupWindowParent ?? window,
@@ -15029,10 +15027,15 @@
                     return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
                 }
                 else {
+                    // Pre-validate request method to avoid opening popup if the request is invalid
+                    const validatedRequest = {
+                        ...request,
+                        httpMethod: validateRequestMethod(request, this.config.auth.protocolMode),
+                    };
                     // asyncPopups flag is set to false. Opens popup before acquiring token.
                     this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
                     popupParams.popup = this.openSizedPopup("about:blank", popupParams);
-                    return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
+                    return this.acquireTokenPopupAsync(validatedRequest, popupParams, pkceCodes);
                 }
             }
             catch (e) {
@@ -15124,15 +15127,20 @@
                     requestExtraQueryParameters: popupRequest.extraQueryParameters,
                     account: popupRequest.account,
                 });
-                // Create acquire token url.
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
-                // Show the UI once the url has been created. Get the window handle for the popup.
-                const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
-                this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
-                // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-                const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
-                const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-                return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+                if (popupRequest.httpMethod === HttpMethod.POST) {
+                    return await this.executeCodeFlowWithPost(popupRequest, popupParams, authClient, pkce.verifier);
+                }
+                else {
+                    // Create acquire token url.
+                    const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
+                    // Show the UI once the url has been created. Get the window handle for the popup.
+                    const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
+                    this.eventHandler.emitEvent(EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow }, null);
+                    // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+                    const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
+                    const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+                    return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+                }
             }
             catch (e) {
                 // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -15170,6 +15178,23 @@
             const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
             return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
         }
+        async executeCodeFlowWithPost(request, popupParams, authClient, pkceVerifier) {
+            const correlationId = request.correlationId;
+            // Get the frame handle for the silent request
+            const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+            });
+            const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
+            const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+            form.submit();
+            // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+            const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
+            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+            return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+        }
         /**
          *
          * @param validRequest
@@ -15521,18 +15546,23 @@
             };
             this.browserStorage.cacheAuthorizeRequest(redirectRequest, pkceCodes.verifier);
             try {
-                // Initialize the client
-                const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-                    serverTelemetryManager,
-                    requestAuthority: redirectRequest.authority,
-                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
-                    requestExtraQueryParameters: redirectRequest.extraQueryParameters,
-                    account: redirectRequest.account,
-                });
-                // Create acquire token url.
-                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
-                // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-                return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+                if (redirectRequest.httpMethod === HttpMethod.POST) {
+                    return await this.executeCodeFlowWithPost(redirectRequest);
+                }
+                else {
+                    // Initialize the client
+                    const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                        serverTelemetryManager,
+                        requestAuthority: redirectRequest.authority,
+                        requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                        requestExtraQueryParameters: redirectRequest.extraQueryParameters,
+                        account: redirectRequest.account,
+                    });
+                    // Create acquire token url.
+                    const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
+                    // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
+                    return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+                }
             }
             catch (e) {
                 if (e instanceof AuthError) {
@@ -15569,6 +15599,28 @@
                 }, this.config.system.redirectNavigationTimeout);
             });
         }
+        /**
+         * Executes classic Authorization Code flow with a POST request.
+         * @param request
+         */
+        async executeCodeFlowWithPost(request) {
+            const correlationId = request.correlationId;
+            // Get the frame handle for the silent request
+            const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+            });
+            this.browserStorage.cacheAuthorizeRequest(request);
+            const form = await getCodeForm(document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+            form.submit();
+            return new Promise((resolve, reject) => {
+                setTimeout(() => {
+                    reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+                }, this.config.system.redirectNavigationTimeout);
+            });
+        }
         /**
          * Checks if navigateToLoginRequestUrl is set, and:
          * - if true, performs logic to cache and navigate
@@ -15879,6 +15931,15 @@
         }
         return invoke(loadFrameSync, PerformanceEvents.SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
     }
+    async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
+        const frame = createHiddenIframe();
+        if (!frame.contentDocument) {
+            throw "No document associated with iframe!";
+        }
+        const form = await getCodeForm(frame.contentDocument, config, authority, request, logger, performanceClient);
+        form.submit();
+        return frame;
+    }
     async function initiateEarRequest(config, authority, request, logger, performanceClient) {
         const frame = createHiddenIframe();
         if (!frame.contentDocument) {
@@ -16127,10 +16188,16 @@
                 ...request,
                 codeChallenge: pkceCodes.challenge,
             };
-            // Create authorize request url
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-            // Get the frame handle for the silent request
-            const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+            let msalFrame;
+            if (request.httpMethod === HttpMethod.POST) {
+                msalFrame = await invokeAsync(initiateCodeFlowWithPost, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            }
+            else {
+                // Create authorize request url
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+                // Get the frame handle for the silent request
+                msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+            }
             const responseType = this.config.auth.OIDCOptions.serverResponseType;
             // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
             const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);
@@ -18229,7 +18296,13 @@
                     ...this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp),
                 };
                 // cache the tokens in the response
-                await this.hydrateCache(result, request);
+                try {
+                    // cache hydration can fail in JS Runtime scenario that doesn't support full crypto API
+                    await this.hydrateCache(result, request);
+                }
+                catch (error) {
+                    this.logger.warningPii(`Failed to hydrate cache. Error: ${error}`, validRequest.correlationId);
+                }
                 // cache the account context in memory after successful token fetch
                 this.currentAccountContext = {
                     homeAccountId: result.account.homeAccountId,
@@ -18286,7 +18359,13 @@
                 const response = await this.bridgeProxy.getTokenSilent(naaRequest);
                 const result = this.nestedAppAuthAdapter.fromNaaTokenResponse(naaRequest, response, reqTimestamp);
                 // cache the tokens in the response
-                await this.hydrateCache(result, request);
+                try {
+                    // cache hydration can fail in JS Runtime scenario that doesn't support full crypto API
+                    await this.hydrateCache(result, request);
+                }
+                catch (error) {
+                    this.logger.warningPii(`Failed to hydrate cache. Error: ${error}`, validRequest.correlationId);
+                }
                 // cache the account context in memory after successful token fetch
                 this.currentAccountContext = {
                     homeAccountId: result.account.homeAccountId,