@azure/msal-browser 4.14.0 → 4.16.0

package/lib/custom-auth-path/msal-custom-auth.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v4.14.0 2025-07-01 */
+/*! @azure/msal-browser v4.16.0 2025-07-23 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -82,6 +82,10 @@ const HttpStatus = {
     SERVER_ERROR_RANGE_END: 599,
     MULTI_SIDED_ERROR: 600,
 };
+const HttpMethod$1 = {
+    GET: "GET",
+    POST: "POST",
+};
 const OIDC_DEFAULT_SCOPES = [
     Constants.OPENID_SCOPE,
     Constants.PROFILE_SCOPE,
@@ -132,16 +136,8 @@ const PromptValue = {
     SELECT_ACCOUNT: "select_account",
     CONSENT: "consent",
     NONE: "none",
-    CREATE: "create",
     NO_SESSION: "no_session",
 };
-/**
- * allowed values for codeVerifier
- */
-const CodeChallengeMethodValues = {
-    PLAIN: "plain",
-    S256: "S256",
-};
 /**
  * Allowed values for response_type
  */
@@ -282,7 +278,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -293,7 +289,7 @@ const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const unexpectedError = "unexpected_error";
 const postRequestFailed$1 = "post_request_failed";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -328,7 +324,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -378,7 +374,7 @@ const missingTenantIdError = "missing_tenant_id_error";
 const methodNotImplemented = "method_not_implemented";
 const nestedAppAuthBridgeDisabled = "nested_app_auth_bridge_disabled";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -452,7 +448,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -491,7 +487,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -682,12 +678,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "15.8.0";
+const version$1 = "15.9.0";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -696,7 +692,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -757,7 +753,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -812,7 +808,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1139,7 +1135,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1150,7 +1146,6 @@ const authorityUriInsecure = "authority_uri_insecure";
 const urlParseError = "url_parse_error";
 const urlEmptyError = "empty_url_error";
 const emptyInputScopesError = "empty_input_scopes_error";
-const invalidPromptValue = "invalid_prompt_value";
 const invalidClaims = "invalid_claims";
 const tokenRequestEmpty = "token_request_empty";
 const logoutRequestEmpty = "logout_request_empty";
@@ -1165,9 +1160,11 @@ const missingNonceAuthenticationHeader = "missing_nonce_authentication_header";
 const invalidAuthenticationHeader = "invalid_authentication_header";
 const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
-const authorityMismatch = "authority_mismatch";
+const authorityMismatch = "authority_mismatch";
+const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidAuthorizePostBodyParameters = "invalid_authorize_post_body_parameters";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1180,7 +1177,6 @@ const ClientConfigurationErrorMessages = {
     [urlParseError]: "URL could not be parsed into appropriate segments.",
     [urlEmptyError]: "URL was empty or null.",
     [emptyInputScopesError]: "Scopes cannot be passed as null, undefined or empty array because they are required to obtain an access token.",
-    [invalidPromptValue]: "Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
     [invalidClaims]: "Given claims parameter must be a stringified JSON object.",
     [tokenRequestEmpty]: "Token request was empty and not found in cache.",
     [logoutRequestEmpty]: "The logout request was null or undefined.",
@@ -1196,6 +1192,8 @@ const ClientConfigurationErrorMessages = {
     [cannotSetOIDCOptions]: "Cannot set OIDCOptions parameter. Please change the protocol mode to OIDC or use a non-Microsoft authority.",
     [cannotAllowPlatformBroker]: "Cannot set allowPlatformBroker parameter to true when not in AAD protocol mode.",
     [authorityMismatch]: "Authority mismatch error. Authority provided in login request or PublicClientApplication config does not match the environment of the provided account. Please use a matching account or make an interactive request to login to this authority.",
+    [invalidAuthorizePostBodyParameters]: "Invalid authorize post body parameters provided. If you are using authorizePostBodyParameters, the request method must be POST. Please check the request method and parameters.",
+    [invalidRequestMethodForEAR]: "Invalid request method for EAR protocol mode. The request method cannot be GET when using EAR protocol mode. Please change the request method to POST.",
 };
 /**
  * Error thrown when there is an error in configuration of the MSAL.js library.
@@ -1211,7 +1209,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1308,7 +1306,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1499,7 +1497,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1539,7 +1537,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1618,7 +1616,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1633,7 +1631,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1655,7 +1653,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1679,7 +1677,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1922,7 +1920,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1987,7 +1985,7 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
     return queryParameterArray.join("&");
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2151,7 +2149,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2290,7 +2288,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2298,7 +2296,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2343,7 +2341,7 @@ function createCacheError(e) {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3509,7 +3507,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3776,7 +3774,7 @@ const PerformanceEvents = {
 const PerformanceEventStatus = {
     InProgress: 1};
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3855,7 +3853,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3955,7 +3953,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3965,7 +3963,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4015,7 +4013,7 @@ const INSTANCE_AWARE = "instance_aware";
 const EAR_JWK = "ear_jwk";
 const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4381,9 +4379,21 @@ function addEARParameters(parameters, jwk) {
     // ear_jwe_crypto will always have value: {"alg":"dir","enc":"A256GCM"} so we can hardcode this
     const jweCryptoB64Encoded = "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0";
     parameters.set(EAR_JWE_CRYPTO, jweCryptoB64Encoded);
+}
+/**
+ * Adds authorize body parameters to the request parameters
+ * @param parameters
+ * @param bodyParameters
+ */
+function addPostBodyParameters(parameters, bodyParameters) {
+    Object.entries(bodyParameters).forEach(([key, value]) => {
+        if (value) {
+            parameters.set(key, value);
+        }
+    });
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4395,7 +4405,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4405,7 +4415,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4415,7 +4425,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4511,7 +4521,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4617,7 +4627,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5456,7 +5466,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5487,7 +5497,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5506,7 +5516,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5527,7 +5537,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5614,7 +5624,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5645,7 +5655,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5793,7 +5803,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5809,7 +5819,7 @@ const consentRequired = "consent_required";
 const loginRequired = "login_required";
 const badToken = "bad_token";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5881,7 +5891,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5953,7 +5963,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6035,7 +6045,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6062,7 +6072,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6393,74 +6403,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
-
-/*
- * Copyright (c) Microsoft Corporation. All rights reserved.
- * Licensed under the MIT License.
- */
-/**
- * Validates server consumable params from the "request" objects
- */
-class RequestValidator {
-    /**
-     * Utility to check if the `redirectUri` in the request is a non-null value
-     * @param redirectUri
-     */
-    static validateRedirectUri(redirectUri) {
-        if (!redirectUri) {
-            throw createClientConfigurationError(redirectUriEmpty);
-        }
-    }
-    /**
-     * Utility to validate prompt sent by the user in the request
-     * @param prompt
-     */
-    static validatePrompt(prompt) {
-        const promptValues = [];
-        for (const value in PromptValue) {
-            promptValues.push(PromptValue[value]);
-        }
-        if (promptValues.indexOf(prompt) < 0) {
-            throw createClientConfigurationError(invalidPromptValue);
-        }
-    }
-    static validateClaims(claims) {
-        try {
-            JSON.parse(claims);
-        }
-        catch (e) {
-            throw createClientConfigurationError(invalidClaims);
-        }
-    }
-    /**
-     * Utility to validate code_challenge and code_challenge_method
-     * @param codeChallenge
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeParams(codeChallenge, codeChallengeMethod) {
-        if (!codeChallenge || !codeChallengeMethod) {
-            throw createClientConfigurationError(pkceParamsMissing);
-        }
-        else {
-            this.validateCodeChallengeMethod(codeChallengeMethod);
-        }
-    }
-    /**
-     * Utility to validate code_challenge_method
-     * @param codeChallengeMethod
-     */
-    static validateCodeChallengeMethod(codeChallengeMethod) {
-        if ([
-            CodeChallengeMethodValues.PLAIN,
-            CodeChallengeMethodValues.S256,
-        ].indexOf(codeChallengeMethod) < 0) {
-            throw createClientConfigurationError(invalidCodeChallengeMethod);
-        }
-    }
-}
-
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6478,7 +6421,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6572,7 +6515,9 @@ class AuthorizationCodeClient extends BaseClient {
          */
         if (!this.includeRedirectUri) {
             // Just validate
-            RequestValidator.validateRedirectUri(request.redirectUri);
+            if (!request.redirectUri) {
+                throw createClientConfigurationError(redirectUriEmpty);
+            }
         }
         else {
             // Validate and include redirect uri
@@ -6711,7 +6656,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6920,7 +6865,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7018,7 +6963,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7033,7 +6978,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7257,7 +7202,7 @@ function extractLoginHint(account) {
     return account.idTokenClaims?.login_hint || null;
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7520,7 +7465,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7528,7 +7473,7 @@ class ServerTelemetryManager {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7553,7 +7498,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v15.8.0 2025-07-01 */
+/*! @azure/msal-common v15.9.0 2025-07-23 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7926,7 +7871,7 @@ function ensureArgumentIsNotEmptyString(argName, argValue, correlationId) {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "4.14.0";
+const version = "4.16.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10473,6 +10418,35 @@ async function initializeSilentRequest(request, account, config, performanceClie
         account: account,
         forceRefresh: request.forceRefresh || false,
     };
+}
+/**
+ * Validates that the combination of request method, protocol mode and authorize body parameters is correct.
+ * Returns the validated or defaulted HTTP method or throws if the configured combination is invalid.
+ * @param interactionRequest
+ * @param protocolMode
+ * @returns
+ */
+function validateRequestMethod(interactionRequest, protocolMode) {
+    let httpMethod;
+    const requestMethod = interactionRequest.httpMethod;
+    if (protocolMode === ProtocolMode.EAR) {
+        // Don't override httpMethod if it is already set, default to POST if not set
+        httpMethod = requestMethod || HttpMethod$1.POST;
+        // Validate that method is not GET if protocol mode is EAR
+        if (httpMethod !== HttpMethod$1.POST) {
+            throw createClientConfigurationError(invalidRequestMethodForEAR);
+        }
+    }
+    else {
+        // For non-EAR protocol modes, default to GET if httpMethod is not set
+        httpMethod = requestMethod || HttpMethod$1.GET;
+    }
+    // Regardless of protocolMode, if there are authorizePostBodyParameters, validate the request method is POST
+    if (interactionRequest.authorizePostBodyParameters &&
+        httpMethod !== HttpMethod$1.POST) {
+        throw createClientConfigurationError(invalidAuthorizePostBodyParameters);
+    }
+    return httpMethod;
 }
 
 /*
@@ -10649,7 +10623,7 @@ class StandardInteractionClient extends BaseInteractionClient {
         };
         const state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || Constants.EMPTY_STRING, browserState);
         const baseRequest = await invokeAsync(initializeBaseRequest, PerformanceEvents.InitializeBaseRequest, this.logger, this.performanceClient, this.correlationId)({ ...request, correlationId: this.correlationId }, this.config, this.performanceClient, this.logger);
-        const validatedRequest = {
+        const interactionRequest = {
             ...baseRequest,
             redirectUri: redirectUri,
             state: state,
@@ -10657,6 +10631,10 @@ class StandardInteractionClient extends BaseInteractionClient {
             responseMode: this.config.auth.OIDCOptions
                 .serverResponseType,
         };
+        const validatedRequest = {
+            ...interactionRequest,
+            httpMethod: validateRequestMethod(interactionRequest, this.config.auth.protocolMode),
+        };
         // Skip active account lookup if either login hint or session id is set
         if (request.loginHint || request.sid) {
             return validatedRequest;
@@ -15569,6 +15547,19 @@ async function getEARForm(frame, config, authority, request, logger, performance
     const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
     return createForm(frame, url, parameters);
 }
+/**
+ * Gets the form that will be posted to /authorize with request parameters when using POST method
+ */
+async function getCodeForm(frame, config, authority, request, logger, performanceClient) {
+    const parameters = await getStandardParameters(config, authority, request, logger, performanceClient);
+    addResponseType(parameters, OAuthResponseType.CODE);
+    addCodeChallengeParams(parameters, request.codeChallenge, request.codeChallengeMethod || Constants.S256_CODE_CHALLENGE_METHOD);
+    addPostBodyParameters(parameters, request.authorizePostBodyParameters || {});
+    const queryParams = new Map();
+    addExtraQueryParameters(queryParams, request.extraQueryParameters || {});
+    const url = getAuthorizeUrl(authority, queryParams, config.auth.encodeExtraQueryParams, request.extraQueryParameters);
+    return createForm(frame, url, parameters);
+}
 /**
  * Creates form element in the provided document with auth parameters in the post body
  * @param frame
@@ -16535,9 +16526,10 @@ class PopupClient extends StandardInteractionClient {
      * @param pkceCodes
      */
     acquireToken(request, pkceCodes) {
+        let popupParams = undefined;
         try {
             const popupName = this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority);
-            const popupParams = {
+            popupParams = {
                 popupName,
                 popupWindowAttributes: request.popupWindowAttributes || {},
                 popupWindowParent: request.popupWindowParent ?? window,
@@ -16550,10 +16542,15 @@ class PopupClient extends StandardInteractionClient {
                 return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
             }
             else {
+                // Pre-validate request method to avoid opening popup if the request is invalid
+                const validatedRequest = {
+                    ...request,
+                    httpMethod: validateRequestMethod(request, this.config.auth.protocolMode),
+                };
                 // asyncPopups flag is set to false. Opens popup before acquiring token.
                 this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
                 popupParams.popup = this.openSizedPopup("about:blank", popupParams);
-                return this.acquireTokenPopupAsync(request, popupParams, pkceCodes);
+                return this.acquireTokenPopupAsync(validatedRequest, popupParams, pkceCodes);
             }
         }
         catch (e) {
@@ -16645,15 +16642,20 @@ class PopupClient extends StandardInteractionClient {
                 requestExtraQueryParameters: popupRequest.extraQueryParameters,
                 account: popupRequest.account,
             });
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
-            // Show the UI once the url has been created. Get the window handle for the popup.
-            const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
-            this.eventHandler.emitEvent(EventType.POPUP_OPENED, InteractionType.Popup, { popupWindow }, null);
-            // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
-            const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
-            const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
-            return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            if (popupRequest.httpMethod === HttpMethod$1.POST) {
+                return await this.executeCodeFlowWithPost(popupRequest, popupParams, authClient, pkce.verifier);
+            }
+            else {
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, popupRequest, this.logger, this.performanceClient);
+                // Show the UI once the url has been created. Get the window handle for the popup.
+                const popupWindow = this.initiateAuthRequest(navigateUrl, popupParams);
+                this.eventHandler.emitEvent(EventType.POPUP_OPENED, InteractionType.Popup, { popupWindow }, null);
+                // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+                const responseString = await this.monitorPopupForHash(popupWindow, popupParams.popupWindowParent);
+                const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+                return await invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkce.verifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+            }
         }
         catch (e) {
             // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -16691,6 +16693,23 @@ class PopupClient extends StandardInteractionClient {
         const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
         return invokeAsync(handleResponseEAR, PerformanceEvents.HandleResponseEar, this.logger, this.performanceClient, correlationId)(popupRequest, serverParams, ApiId.acquireTokenPopup, this.config, discoveredAuthority, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
     }
+    async executeCodeFlowWithPost(request, popupParams, authClient, pkceVerifier) {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+        const popupWindow = popupParams.popup || this.openPopup("about:blank", popupParams);
+        const form = await getCodeForm(popupWindow.document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+        form.submit();
+        // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
+        const responseString = await invokeAsync(this.monitorPopupForHash.bind(this), PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(popupWindow, popupParams.popupWindowParent);
+        const serverParams = invoke(deserializeResponse, PerformanceEvents.DeserializeResponse, this.logger, this.performanceClient, this.correlationId)(responseString, this.config.auth.OIDCOptions.serverResponseType, this.logger);
+        return invokeAsync(handleResponseCode, PerformanceEvents.HandleResponseCode, this.logger, this.performanceClient, correlationId)(request, serverParams, pkceVerifier, ApiId.acquireTokenPopup, this.config, authClient, this.browserStorage, this.nativeStorage, this.eventHandler, this.logger, this.performanceClient, this.platformAuthProvider);
+    }
     /**
      *
      * @param validRequest
@@ -17042,18 +17061,23 @@ class RedirectClient extends StandardInteractionClient {
         };
         this.browserStorage.cacheAuthorizeRequest(redirectRequest, pkceCodes.verifier);
         try {
-            // Initialize the client
-            const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
-                serverTelemetryManager,
-                requestAuthority: redirectRequest.authority,
-                requestAzureCloudOptions: redirectRequest.azureCloudOptions,
-                requestExtraQueryParameters: redirectRequest.extraQueryParameters,
-                account: redirectRequest.account,
-            });
-            // Create acquire token url.
-            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
-            // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
-            return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+            if (redirectRequest.httpMethod === HttpMethod$1.POST) {
+                return await this.executeCodeFlowWithPost(redirectRequest);
+            }
+            else {
+                // Initialize the client
+                const authClient = await invokeAsync(this.createAuthCodeClient.bind(this), PerformanceEvents.StandardInteractionClientCreateAuthCodeClient, this.logger, this.performanceClient, this.correlationId)({
+                    serverTelemetryManager,
+                    requestAuthority: redirectRequest.authority,
+                    requestAzureCloudOptions: redirectRequest.azureCloudOptions,
+                    requestExtraQueryParameters: redirectRequest.extraQueryParameters,
+                    account: redirectRequest.account,
+                });
+                // Create acquire token url.
+                const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, request.correlationId)(this.config, authClient.authority, redirectRequest, this.logger, this.performanceClient);
+                // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
+                return await this.initiateAuthRequest(navigateUrl, onRedirectNavigate);
+            }
         }
         catch (e) {
             if (e instanceof AuthError) {
@@ -17090,6 +17114,28 @@ class RedirectClient extends StandardInteractionClient {
             }, this.config.system.redirectNavigationTimeout);
         });
     }
+    /**
+     * Executes classic Authorization Code flow with a POST request.
+     * @param request
+     */
+    async executeCodeFlowWithPost(request) {
+        const correlationId = request.correlationId;
+        // Get the frame handle for the silent request
+        const discoveredAuthority = await invokeAsync(this.getDiscoveredAuthority.bind(this), PerformanceEvents.StandardInteractionClientGetDiscoveredAuthority, this.logger, this.performanceClient, correlationId)({
+            requestAuthority: request.authority,
+            requestAzureCloudOptions: request.azureCloudOptions,
+            requestExtraQueryParameters: request.extraQueryParameters,
+            account: request.account,
+        });
+        this.browserStorage.cacheAuthorizeRequest(request);
+        const form = await getCodeForm(document, this.config, discoveredAuthority, request, this.logger, this.performanceClient);
+        form.submit();
+        return new Promise((resolve, reject) => {
+            setTimeout(() => {
+                reject(createBrowserAuthError(timedOut, "failed_to_redirect"));
+            }, this.config.system.redirectNavigationTimeout);
+        });
+    }
     /**
      * Checks if navigateToLoginRequestUrl is set, and:
      * - if true, performs logic to cache and navigate
@@ -17400,6 +17446,15 @@ async function initiateCodeRequest(requestUrl, performanceClient, logger, correl
     }
     return invoke(loadFrameSync, PerformanceEvents.SilentHandlerLoadFrameSync, logger, performanceClient, correlationId)(requestUrl);
 }
+async function initiateCodeFlowWithPost(config, authority, request, logger, performanceClient) {
+    const frame = createHiddenIframe();
+    if (!frame.contentDocument) {
+        throw "No document associated with iframe!";
+    }
+    const form = await getCodeForm(frame.contentDocument, config, authority, request, logger, performanceClient);
+    form.submit();
+    return frame;
+}
 async function initiateEarRequest(config, authority, request, logger, performanceClient) {
     const frame = createHiddenIframe();
     if (!frame.contentDocument) {
@@ -17648,10 +17703,16 @@ class SilentIframeClient extends StandardInteractionClient {
             ...request,
             codeChallenge: pkceCodes.challenge,
         };
-        // Create authorize request url
-        const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
-        // Get the frame handle for the silent request
-        const msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        let msalFrame;
+        if (request.httpMethod === HttpMethod$1.POST) {
+            msalFrame = await invokeAsync(initiateCodeFlowWithPost, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+        }
+        else {
+            // Create authorize request url
+            const navigateUrl = await invokeAsync(getAuthCodeRequestUrl, PerformanceEvents.GetAuthCodeUrl, this.logger, this.performanceClient, correlationId)(this.config, authClient.authority, silentRequest, this.logger, this.performanceClient);
+            // Get the frame handle for the silent request
+            msalFrame = await invokeAsync(initiateCodeRequest, PerformanceEvents.SilentHandlerInitiateAuthRequest, this.logger, this.performanceClient, correlationId)(navigateUrl, this.performanceClient, this.logger, correlationId, this.config.system.navigateFrameWait);
+        }
         const responseType = this.config.auth.OIDCOptions.serverResponseType;
         // Monitor the window for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(monitorIframeForHash, PerformanceEvents.SilentHandlerMonitorIframeForHash, this.logger, this.performanceClient, correlationId)(msalFrame, this.config.system.iframeHashTimeout, this.config.system.pollIntervalMilliseconds, this.performanceClient, this.logger, correlationId, responseType);