npm - @azure/msal-browser - Versions diffs - 5.10.0 → 5.11.0 - Mend

@azure/msal-browser 5.10.0 → 5.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (255) hide show

package/lib/custom-auth-path/msal-custom-auth.js CHANGED Viewed

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.10.0 2026-05-07 */
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -6,7 +6,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.msalCustomAuth = {}));
 })(this, (function (exports) { 'use strict';
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -233,7 +233,7 @@
     // Token renewal offset default in seconds
     const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -285,7 +285,7 @@
     const RESOURCE = "resource";
     const CLI_DATA = "clidata";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -316,7 +316,7 @@
         return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -336,7 +336,7 @@
         return new ClientConfigurationError(errorCode);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -416,7 +416,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -439,7 +439,7 @@
         return new ClientAuthError(errorCode, additionalMessage);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -461,9 +461,11 @@
     const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
     const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
     const authorityMismatch = "authority_mismatch";
-    const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+    const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+    const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
+    const issuerValidationFailed = "issuer_validation_failed";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -502,7 +504,7 @@
     const resourceParameterRequired = "resource_parameter_required";
     const misplacedResourceParam = "misplaced_resource_parameter";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -697,7 +699,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1086,7 +1088,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1195,7 +1197,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1234,7 +1236,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1495,12 +1497,12 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /* eslint-disable header/header */
     const name$1 = "@azure/msal-common";
-    const version$1 = "16.6.0";
+    const version$1 = "16.6.2";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1509,7 +1511,7 @@
         // AzureCloudInstance is not specified.
         None: "none"};
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1592,7 +1594,7 @@
         return updatedAccountInfo;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1672,7 +1674,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1829,7 +1831,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1915,6 +1917,15 @@
                     preferred_cache: "login.sovcloud-identity.sg",
                     aliases: ["login.sovcloud-identity.sg"],
                 },
+                {
+                    preferred_network: "login.windows-ppe.net",
+                    preferred_cache: "login.windows-ppe.net",
+                    aliases: [
+                        "login.windows-ppe.net",
+                        "sts.windows-ppe.net",
+                        "login.microsoft-ppe.com",
+                    ],
+                },
             ],
         },
     };
@@ -1986,7 +1997,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1994,7 +2005,7 @@
     const cacheQuotaExceeded = "cache_quota_exceeded";
     const cacheErrorUnknown = "cache_error_unknown";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2032,7 +2043,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2070,7 +2081,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2085,7 +2096,7 @@
         Ciam: 3,
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2107,7 +2118,7 @@
         return null;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2131,7 +2142,7 @@
         EAR: "EAR",
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /**
      * Returns the AccountInfo interface for this account.
      */
@@ -2306,7 +2317,7 @@
             entity.hasOwnProperty("authorityType"));
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3437,7 +3448,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3451,7 +3462,7 @@
     const PerformanceEventStatus = {
         InProgress: 1};
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3506,7 +3517,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3601,7 +3612,7 @@
         return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3628,7 +3639,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3693,7 +3704,7 @@
         return cachedAtSec > nowSeconds();
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3952,7 +3963,7 @@
         return metadata.expiresAt <= nowSeconds();
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4023,7 +4034,7 @@
     const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
     const SetUserData = "setUserData";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4116,7 +4127,7 @@
         };
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4196,7 +4207,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4247,7 +4258,7 @@
      */
     const interruptedUser = "interrupted_user";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4315,7 +4326,7 @@
         return new InteractionRequiredAuthError(errorCode, errorMessage);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4334,7 +4345,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4402,7 +4413,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4750,7 +4761,7 @@
         return baseAccount;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4760,7 +4771,7 @@
         UPN: "UPN",
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4778,7 +4789,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4799,7 +4810,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4885,7 +4896,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4916,7 +4927,7 @@
         return new NetworkError(error, httpStatus, responseHeaders);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5030,7 +5041,7 @@
         return response;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5042,7 +5053,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5052,7 +5063,7 @@
             response.hasOwnProperty("metadata"));
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5062,7 +5073,7 @@
             response.hasOwnProperty("error_description"));
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5167,7 +5178,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5422,7 +5433,7 @@
             }, this.correlationId);
         }
         /**
-         * Returns metadata entity from cache if it exists, otherwiser returns a new metadata entity built
+         * Returns metadata entity from cache if it exists, otherwise returns a new metadata entity built
          * from the configured canonical authority
          * @returns
          */
@@ -5491,6 +5502,8 @@
             // Get metadata from network if local sources aren't available
             let metadata = await invokeAsync(this.getEndpointMetadataFromNetwork.bind(this), AuthorityGetEndpointMetadataFromNetwork, this.logger, this.performanceClient, this.correlationId)();
             if (metadata) {
+                // Validate the issuer returned by the OIDC discovery document.
+                this.validateIssuer(metadata.issuer);
                 // If the user prefers to use an azure region replace the global endpoints with regional information.
                 if (this.authorityOptions.azureRegionConfiguration?.azureRegion) {
                     metadata = await invokeAsync(this.updateMetadataWithRegionalInformation.bind(this), AuthorityUpdateMetadataWithRegionalInformation, this.logger, this.performanceClient, this.correlationId)(metadata);
@@ -5659,7 +5672,7 @@
             throw createClientConfigurationError(untrustedAuthority);
         }
         updateCloudDiscoveryMetadataFromLocalSources(metadataEntity) {
-            this.logger.verbose("0jhlgt", this.correlationId);
+            this.logger.verbose("1tpqlr", this.correlationId);
             this.logger.verbosePii("1fy7uz", this.correlationId);
             this.logger.verbosePii("08zabj", this.correlationId);
             this.logger.verbosePii("1o1kv3", this.correlationId);
@@ -5856,6 +5869,139 @@
         isAliasOfKnownMicrosoftAuthority(host) {
             return InstanceDiscoveryMetadataAliases.has(host);
         }
+        /**
+         * Validates the `issuer` returned by an OIDC discovery document against
+         * this authority, per
+         * https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
+         *
+         * The issuer is accepted when ANY of the following holds:
+         *  1. The issuer scheme + host + port match the authority's (path may
+         *     differ). Applies to all authorities.
+         *  2. The authority is a Microsoft cloud authority (public, sovereign,
+         *     or CIAM), the issuer is HTTPS, and the issuer host is in the known
+         *     Microsoft authority host set.
+         *  3. Same as (2), but the issuer host is a single-label regional variant
+         *     of a known Microsoft host (e.g. `westus.login.microsoftonline.com`).
+         *  4. Same as (2), but the issuer host matches the CIAM tenant pattern
+         *     `{tenant}.ciamlogin.com` with an optional `/{tenant}[.onmicrosoft.com][/v2.0]`
+         *     path.
+         *
+         * @param issuer The `issuer` value returned in the OIDC discovery document.
+         * @throws ClientConfigurationError("issuer_validation_failed") on failure.
+         */
+        validateIssuer(issuer) {
+            if (!issuer) {
+                throw createClientConfigurationError(issuerValidationFailed);
+            }
+            // Parse with the WHATWG URL API. URL normalizes scheme + host to lowercase per RFC 3986.
+            let issuerUrl;
+            try {
+                issuerUrl = new URL(issuer);
+            }
+            catch {
+                throw createClientConfigurationError(issuerValidationFailed);
+            }
+            const issuerScheme = issuerUrl.protocol;
+            const issuerHost = issuerUrl.host;
+            const authorityScheme = (this.canonicalAuthorityUrlComponents.Protocol || "").toLowerCase();
+            const authorityHost = (this.canonicalAuthorityUrlComponents.HostNameAndPort || "").toLowerCase();
+            // Rule 1: Same scheme and host
+            const matchesAuthorityOrigin = this.matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost);
+            // Rule 2: The issuer host is a well-known Microsoft authority host (HTTPS only)
+            const matchesKnownMicrosoftHost = issuerScheme === "https:" &&
+                this.isAliasOfKnownMicrosoftAuthority(issuerHost);
+            /*
+             * Rule 3: The issuer host is a regional variant ({region}.{host}) of a well-known host
+             * (HTTPS only). E.g. westus2.login.microsoft.com
+             */
+            const matchesRegionalMicrosoftHost = issuerScheme === "https:" &&
+                this.matchesRegionalMicrosoftHost(issuerHost);
+            /*
+             * Rule 4: CIAM-specific validation. In a CIAM scenario the issuer is expected to
+             * have "{tenant}.ciamlogin.com" as the host, even when using a custom domain.
+             */
+            const matchesCiamTenantPattern = this.matchesCiamTenantPattern(issuerUrl, authorityHost, this.canonicalAuthorityUrlComponents.PathSegments);
+            // Each rule is an independent boolean; the issuer is valid if ANY rule matches.
+            if (matchesAuthorityOrigin ||
+                matchesKnownMicrosoftHost ||
+                matchesRegionalMicrosoftHost ||
+                matchesCiamTenantPattern) {
+                return;
+            }
+            // issuer validation fails if none of the above rules are satisfied
+            throw createClientConfigurationError(issuerValidationFailed);
+        }
+        /**
+         * Rule 1: The issuer scheme + host (and port) match the authority's. Path
+         * may differ. Applies to all authorities.
+         */
+        matchesAuthorityOrigin(issuerScheme, issuerHost, authorityScheme, authorityHost) {
+            return issuerScheme === authorityScheme && issuerHost === authorityHost;
+        }
+        /**
+         * Rule 3: The issuer host is a regional variant
+         * (`{region}.{host}`) of a known Microsoft authority host.
+         * E.g. `westus2.login.microsoft.com`.
+         */
+        matchesRegionalMicrosoftHost(issuerHost) {
+            const firstDot = issuerHost.indexOf(".");
+            if (firstDot > 0 && firstDot < issuerHost.length - 1) {
+                const hostWithoutRegion = issuerHost.substring(firstDot + 1);
+                return this.isAliasOfKnownMicrosoftAuthority(hostWithoutRegion);
+            }
+            return false;
+        }
+        /**
+         * Rule 4: The issuer matches one of the well-known CIAM tenant patterns
+         * (`https://{tenant}.ciamlogin.com[/{tenant}[.onmicrosoft.com][/v2.0]]`).
+         *
+         * The bare tenant name is extracted from the authority's first path segment
+         * when available (stripping the `.onmicrosoft.com` suffix that
+         * `transformCIAMAuthority` adds), or otherwise from the leftmost label of
+         * the authority host (to support CIAM custom domain scenarios).
+         *
+         * Both `/{tenant}` and `/{tenant}.onmicrosoft.com` path forms are accepted
+         * because the OIDC issuer may use either form depending on the authority URL
+         * that was used to trigger discovery.
+         */
+        matchesCiamTenantPattern(issuerUrl, authorityHost, authorityPathSegments) {
+            /*
+             * authorityPathSegments[0] is the first path segment of the *authority
+             * URL* after transformCIAMAuthority runs (e.g. "contoso.onmicrosoft.com").
+             * Additional CIAM issuer path segments such as "/v2.0" are part of the
+             * issuer string, not the authority URL's PathSegments.
+             */
+            const pathSegment = authorityPathSegments[0];
+            /*
+             * Extract the bare tenant name: strip the .onmicrosoft.com suffix when
+             * present (introduced by transformCIAMAuthority), or fall back to the
+             * first label of the authority hostname for non-transformed/custom-domain
+             * CIAM authorities.
+             */
+            const tenantName = pathSegment
+                ? pathSegment.endsWith(AAD_TENANT_DOMAIN_SUFFIX)
+                    ? pathSegment.slice(0, -AAD_TENANT_DOMAIN_SUFFIX.length)
+                    : pathSegment
+                : authorityHost.split(".")[0];
+            if (!tenantName) {
+                return false;
+            }
+            const ciamBaseURL = `https://${tenantName}${CIAM_AUTH_URL}`;
+            const validCiamPatterns = [
+                ciamBaseURL,
+                `${ciamBaseURL}/${tenantName}`,
+                `${ciamBaseURL}/${tenantName}/v2.0`,
+                `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}`,
+                `${ciamBaseURL}/${tenantName}${AAD_TENANT_DOMAIN_SUFFIX}/v2.0`, // https://{tenant}.ciamlogin.com/{tenant}.onmicrosoft.com/v2.0
+            ];
+            /*
+             * Compose the canonical issuer string from URL components and strip any
+             * trailing slashes from the path so it can be compared to the pattern set.
+             */
+            const issuerPath = issuerUrl.pathname.replace(/\/+$/, "");
+            const normalizedIssuer = `${issuerUrl.protocol}//${issuerUrl.host}${issuerPath}`;
+            return validCiamPatterns.some((pattern) => pattern === normalizedIssuer);
+        }
         /**
          * Checks whether the provided host is that of a public cloud authority
          *
@@ -5987,7 +6133,7 @@
         };
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6021,7 +6167,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6278,7 +6424,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6499,7 +6645,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6615,7 +6761,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6630,7 +6776,7 @@
         },
     };
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6853,7 +6999,7 @@
         return account.loginHint || account.idTokenClaims?.login_hint || null;
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6886,7 +7032,7 @@
         return Object.prototype.hasOwnProperty.call(params, "resource");
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6896,7 +7042,7 @@
      */
     const unexpectedError = "unexpected_error";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7157,7 +7303,7 @@
         }
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7178,7 +7324,7 @@
         return new JoseHeaderError(code);
     }
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7186,7 +7332,7 @@
     const missingKidError = "missing_kid_error";
     const missingAlgError = "missing_alg_error";
-    /*! @azure/msal-common v16.6.0 2026-05-07 */
+    /*! @azure/msal-common v16.6.2 2026-05-19 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7621,7 +7767,7 @@
     /* eslint-disable header/header */
     const name = "@azure/msal-browser";
-    const version = "5.10.0";
+    const version = "5.11.0";
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7650,6 +7796,15 @@
         CONTENT_TYPE: "Content-Type",
         X_MS_REQUEST_ID: "x-ms-request-id",
     };
+    const CustomHeaderConstants = {
+        REQUIRED_PREFIX: "x-",
+        RESERVED_PREFIXES: [
+            "x-client-",
+            "x-ms-",
+            "x-broker-",
+            "x-app-",
+        ],
+    };
     const DefaultPackageInfo = {
         SKU: "msal.browser",
         VERSION: version,
@@ -9473,12 +9628,13 @@
              * and logoutHint attribute wasn't manually set in logout request
              */
             if (logoutRequest) {
-                // If logoutHint isn't set and an account was passed in, try to extract logoutHint from ID Token Claims
+                // If logoutHint isn't set and an account was passed in, try to extract logoutHint from account loginHint or ID Token Claims
                 if (!logoutRequest.logoutHint) {
                     if (logoutRequest.account) {
-                        const logoutHint = this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
+                        const logoutHint = logoutRequest.account.loginHint ||
+                            this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
                         if (logoutHint) {
-                            this.logger.verbose("Setting logoutHint to login_hint ID Token Claim value for the account provided", this.correlationId);
+                            this.logger.verbose("Setting logoutHint value to loginHint of the account provided", this.correlationId);
                             validLogoutRequest.logoutHint = logoutHint;
                         }
                     }
@@ -9531,6 +9687,7 @@
             const idTokenClaims = account.idTokenClaims;
             if (idTokenClaims) {
                 if (idTokenClaims.login_hint) {
+                    this.logger.verbose("Extracted login_hint claim from account ID Token Claims to be used as logoutHint", this.correlationId);
                     return idTokenClaims.login_hint;
                 }
                 else {
@@ -10822,15 +10979,67 @@
         }
     }
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * Filters the headers returned by a {@link CustomAuthRequestInterceptor},
+     * keeping only those that conform to the custom-auth header naming rules.
+     *
+     * Rules (mirrors the iOS / Android native auth implementations):
+     *  - Header names must start with `x-` (case-insensitive); others are dropped.
+     *  - Header names that start with any reserved prefix (`x-client-`, `x-ms-`,
+     *    `x-broker-`, `x-app-`) are dropped.
+     *  - Headers with empty/whitespace-only names or null/undefined values are dropped.
+     *
+     * Dropped headers are logged as warnings (PII-safe) when a logger is provided.
+     *
+     * @param headers - Raw headers returned by the interceptor.
+     * @param logger - Optional logger used to emit warnings for dropped headers.
+     * @param correlationId - Optional correlation id forwarded to the logger.
+     * @returns A new record containing only the headers that pass the filter,
+     *          preserving the original casing of header names.
+     */
+    function filterCustomHeaders(headers, logger, correlationId) {
+        const filtered = {};
+        if (!headers) {
+            return filtered;
+        }
+        for (const [name, value] of Object.entries(headers)) {
+            if (!name || value === undefined || value === null) {
+                continue;
+            }
+            const trimmedName = name.trim();
+            if (!trimmedName) {
+                continue;
+            }
+            const lowerName = trimmedName.toLowerCase();
+            if (!lowerName.startsWith(CustomHeaderConstants.REQUIRED_PREFIX)) {
+                logger?.warningPii(`Additional header field "${trimmedName}" must start with the "${CustomHeaderConstants.REQUIRED_PREFIX}" prefix. Ignoring.`, correlationId ?? "");
+                continue;
+            }
+            const reservedPrefix = CustomHeaderConstants.RESERVED_PREFIXES.find((prefix) => lowerName.startsWith(prefix));
+            if (reservedPrefix) {
+                logger?.warningPii(`Additional header field "${trimmedName}" uses reserved prefix "${reservedPrefix}". Ignoring.`, correlationId ?? "");
+                continue;
+            }
+            filtered[trimmedName] = value;
+        }
+        return filtered;
+    }
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     class BaseApiClient {
-        constructor(baseUrl, clientId, httpClient, customAuthApiQueryParams) {
+        constructor(baseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger) {
             this.clientId = clientId;
             this.httpClient = httpClient;
             this.customAuthApiQueryParams = customAuthApiQueryParams;
+            this.requestInterceptor = requestInterceptor;
+            this.logger = logger;
             this.baseRequestUrl = parseUrl(!baseUrl.endsWith("/") ? `${baseUrl}/` : baseUrl);
         }
         async request(endpoint, data, telemetryManager, correlationId) {
@@ -10838,8 +11047,10 @@
                 client_id: this.clientId,
                 ...data,
             });
-            const headers = this.getCommonHeaders(correlationId, telemetryManager);
+            const commonHeaders = this.getCommonHeaders(correlationId, telemetryManager);
             const url = buildUrl(this.baseRequestUrl.href, endpoint, this.customAuthApiQueryParams);
+            const additionalHeaders = await this.getAdditionalHeaders(url, correlationId);
+            const headers = { ...commonHeaders, ...additionalHeaders };
             let response;
             try {
                 response = await this.httpClient.post(url, formData, headers);
@@ -10897,6 +11108,19 @@
                 : responseError.invalid_attributes ?? [];
             throw new CustomAuthApiError(responseError.error, responseError.error_description, responseError.correlation_id, responseError.error_codes, responseError.suberror, attributes, responseError.continuation_token, responseError.trace_id, responseError.timestamp);
         }
+        async getAdditionalHeaders(url, correlationId) {
+            if (!this.requestInterceptor) {
+                return {};
+            }
+            try {
+                const result = await Promise.resolve(this.requestInterceptor.addAdditionalHeaderFields(url));
+                return filterCustomHeaders(result, this.logger, correlationId);
+            }
+            catch (e) {
+                this.logger?.warningPii(`CustomAuthRequestInterceptor.addAdditionalHeaderFields threw an error; continuing without additional headers: ${e}`, correlationId);
+                return {};
+            }
+        }
     }
     /*
@@ -10904,8 +11128,8 @@
      * Licensed under the MIT License.
      */
     class ResetPasswordApiClient extends BaseApiClient {
-        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
             this.capabilities = capabilities;
         }
         /**
@@ -10988,8 +11212,8 @@
      * Licensed under the MIT License.
      */
     class SignupApiClient extends BaseApiClient {
-        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
             this.capabilities = capabilities;
         }
         /**
@@ -11058,8 +11282,8 @@
      * Licensed under the MIT License.
      */
     class SignInApiClient extends BaseApiClient {
-        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+            super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
             this.capabilities = capabilities;
         }
         /**
@@ -11226,11 +11450,11 @@
      * Licensed under the MIT License.
      */
     class CustomAuthApiClient {
-        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-            this.signInApi = new SignInApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-            this.signUpApi = new SignupApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-            this.resetPasswordApi = new ResetPasswordApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-            this.registerApi = new RegisterApiClient(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+        constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+            this.signInApi = new SignInApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+            this.signUpApi = new SignupApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+            this.resetPasswordApi = new ResetPasswordApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+            this.registerApi = new RegisterApiClient(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
         }
     }
@@ -14241,7 +14465,6 @@
     const ACCOUNT_SCHEMA_VERSION = 3;
     const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
     const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
-    const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
     const VERSION_CACHE_KEY = `${PREFIX}.version`;
     const ACCOUNT_KEYS = "account.keys";
     const TOKEN_KEYS = "token.keys";
@@ -17775,6 +17998,7 @@
         };
         const DEFAULT_EXPERIMENTAL_OPTIONS = {
             iframeTimeoutTelemetry: false,
+            allowPlatformBrokerWithDOM: false,
         };
         // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
         if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
@@ -18219,9 +18443,8 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout) {
+    async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
         logger.trace("getPlatformAuthProvider called", correlationId);
-        const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
         logger.trace(`Has client allowed platform auth via DOM API: '${enablePlatformBrokerDOMSupport}'`, correlationId);
         let platformAuthProvider;
         try {
@@ -18245,22 +18468,6 @@
         }
         return platformAuthProvider;
     }
-    /**
-     * Returns true if the DOM API support for platform auth is enabled in session storage
-     * @returns boolean
-     * @deprecated
-     */
-    function isDomEnabledForPlatformAuth() {
-        let sessionStorage;
-        try {
-            sessionStorage = window[BrowserCacheLocation.SessionStorage];
-            // Mute errors if it's a non-browser environment or cookies are blocked.
-            return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
-        }
-        catch (e) {
-            return false;
-        }
-    }
     /**
      * Returns boolean indicating whether or not the request should attempt to use platform broker
      * @param logger
@@ -18271,6 +18478,11 @@
      */
     function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvider, authenticationScheme) {
         logger.trace("isPlatformAuthAllowed called", correlationId);
+        // throw an error if allowPlatformBroker is not enabled and allowPlatformBrokerWithDOM is enabled
+        if (!config.system.allowPlatformBroker &&
+            config.experimental.allowPlatformBrokerWithDOM) {
+            throw createClientConfigurationError(invalidPlatformBrokerConfiguration);
+        }
         if (!config.system.allowPlatformBroker) {
             logger.trace("isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false", correlationId);
             // Developer disabled WAM
@@ -19718,7 +19930,7 @@
             if (allowPlatformBroker) {
                 try {
                     // check if platform authentication is available via DOM or browser extension and create relevant handlers
-                    this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, correlationId, this.config.system.nativeBrokerHandshakeTimeout);
+                    this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, correlationId, this.config.system.nativeBrokerHandshakeTimeout, this.config.experimental.allowPlatformBrokerWithDOM);
                 }
                 catch (e) {
                     this.logger.verbose(e, correlationId);
@@ -21100,7 +21312,7 @@
             this.customAuthConfig = operatingContext.getCustomAuthConfig();
             this.authority = new CustomAuthAuthority(this.customAuthConfig.auth.authority, this.customAuthConfig, this.networkClient, this.browserStorage, this.logger, this.performanceClient, this.customAuthConfig.customAuth?.authApiProxyUrl);
             const interactionClientFactory = new CustomAuthInterationClientFactory(this.customAuthConfig, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, customAuthApiClient ??
-                new CustomAuthApiClient(this.authority.getCustomAuthApiDomain(), this.customAuthConfig.auth.clientId, new FetchHttpClient(this.logger), this.customAuthConfig.customAuth?.capabilities?.join(" "), this.customAuthConfig.customAuth?.customAuthApiQueryParams), this.authority);
+                new CustomAuthApiClient(this.authority.getCustomAuthApiDomain(), this.customAuthConfig.auth.clientId, new FetchHttpClient(this.logger), this.customAuthConfig.customAuth?.capabilities?.join(" "), this.customAuthConfig.customAuth?.customAuthApiQueryParams, this.customAuthConfig.customAuth?.requestInterceptor, this.logger), this.authority);
             this.signInClient = interactionClientFactory.create(SignInClient);
             this.signUpClient = interactionClientFactory.create(SignUpClient);
             this.resetPasswordClient =