npm - @azure/msal-browser - Versions diffs - 5.10.1 → 5.11.0 - Mend

@azure/msal-browser 5.10.1 → 5.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (255) hide show

package/lib/custom-auth-path/msal-custom-auth.cjs CHANGED Viewed

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.10.1 2026-05-11 */
+/*! @azure/msal-browser v5.11.0 2026-05-19 */
 'use strict';
 'use strict';
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -229,7 +229,7 @@ const JsonWebTokenTypes = {
 // Token renewal offset default in seconds
 const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -281,7 +281,7 @@ const EAR_JWE_CRYPTO = "ear_jwe_crypto";
 const RESOURCE = "resource";
 const CLI_DATA = "clidata";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -312,7 +312,7 @@ function createAuthError(code, additionalMessage) {
     return new AuthError(code, additionalMessage || getDefaultErrorMessage$1(code));
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -332,7 +332,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -412,7 +412,7 @@ class StringUtils {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -435,7 +435,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -458,9 +458,10 @@ const cannotSetOIDCOptions = "cannot_set_OIDCOptions";
 const cannotAllowPlatformBroker = "cannot_allow_platform_broker";
 const authorityMismatch = "authority_mismatch";
 const invalidRequestMethodForEAR = "invalid_request_method_for_EAR";
+const invalidPlatformBrokerConfiguration = "invalid_platform_broker_configuration";
 const issuerValidationFailed = "issuer_validation_failed";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -499,7 +500,7 @@ const methodNotImplemented = "method_not_implemented";
 const resourceParameterRequired = "resource_parameter_required";
 const misplacedResourceParam = "misplaced_resource_parameter";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -694,7 +695,7 @@ class ScopeSet {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1083,7 +1084,7 @@ function addResource(parameters, resource) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1192,7 +1193,7 @@ function normalizeUrlForComparison(url) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1231,7 +1232,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1492,12 +1493,12 @@ class Logger {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "16.6.1";
+const version$1 = "16.6.2";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1506,7 +1507,7 @@ const AzureCloudInstance = {
     // AzureCloudInstance is not specified.
     None: "none"};
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1589,7 +1590,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1669,7 +1670,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1826,7 +1827,7 @@ class UrlString {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1992,7 +1993,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2000,7 +2001,7 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
 const cacheQuotaExceeded = "cache_quota_exceeded";
 const cacheErrorUnknown = "cache_error_unknown";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2038,7 +2039,7 @@ function createCacheError(e) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2076,7 +2077,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2091,7 +2092,7 @@ const AuthorityType = {
     Ciam: 3,
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2113,7 +2114,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2137,7 +2138,7 @@ const ProtocolMode = {
     EAR: "EAR",
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /**
  * Returns the AccountInfo interface for this account.
  */
@@ -2312,7 +2313,7 @@ function isAccountEntity(entity) {
         entity.hasOwnProperty("authorityType"));
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3443,7 +3444,7 @@ class DefaultStorageClass extends CacheManager {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3457,7 +3458,7 @@ class DefaultStorageClass extends CacheManager {
 const PerformanceEventStatus = {
     InProgress: 1};
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3512,7 +3513,7 @@ class StubPerformanceClient {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3607,7 +3608,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3634,7 +3635,7 @@ function isOidcProtocolMode(config) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3699,7 +3700,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3958,7 +3959,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4029,7 +4030,7 @@ const RegionDiscoveryGetCurrentVersion = "regionDiscoveryGetCurrentVersion";
 const CacheManagerGetRefreshToken = "cacheManagerGetRefreshToken";
 const SetUserData = "setUserData";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4122,7 +4123,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4202,7 +4203,7 @@ class PopTokenGenerator {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4253,7 +4254,7 @@ const badToken = "bad_token";
  */
 const interruptedUser = "interrupted_user";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4321,7 +4322,7 @@ function createInteractionRequiredAuthError(errorCode, errorMessage) {
     return new InteractionRequiredAuthError(errorCode, errorMessage);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4340,7 +4341,7 @@ class ServerError extends AuthError {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4408,7 +4409,7 @@ function parseRequestState(base64Decode, state) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4756,7 +4757,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, base64Decod
     return baseAccount;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4766,7 +4767,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4784,7 +4785,7 @@ async function getClientAssertion(clientAssertion, clientId, tokenEndpoint) {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4805,7 +4806,7 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4891,7 +4892,7 @@ class ThrottlingUtils {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4922,7 +4923,7 @@ function createNetworkError(error, httpStatus, responseHeaders, additionalError)
     return new NetworkError(error, httpStatus, responseHeaders);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5036,7 +5037,7 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     return response;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5048,7 +5049,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5058,7 +5059,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5068,7 +5069,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5173,7 +5174,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6128,7 +6129,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6162,7 +6163,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6419,7 +6420,7 @@ class AuthorizationCodeClient {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6640,7 +6641,7 @@ class RefreshTokenClient {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6756,7 +6757,7 @@ class SilentFlowClient {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6771,7 +6772,7 @@ const StubbedNetworkModule = {
     },
 };
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6994,7 +6995,7 @@ function extractLoginHint(account) {
     return account.loginHint || account.idTokenClaims?.login_hint || null;
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7027,7 +7028,7 @@ function containsResourceParam(params) {
     return Object.prototype.hasOwnProperty.call(params, "resource");
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7037,7 +7038,7 @@ function containsResourceParam(params) {
  */
 const unexpectedError = "unexpected_error";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7298,7 +7299,7 @@ class ServerTelemetryManager {
     }
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7319,7 +7320,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code);
 }
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7327,7 +7328,7 @@ function createJoseHeaderError(code) {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
-/*! @azure/msal-common v16.6.1 2026-05-11 */
+/*! @azure/msal-common v16.6.2 2026-05-19 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7762,7 +7763,7 @@ function ensureArgumentIsJSONString(argName, argValue, correlationId) {
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.10.1";
+const version = "5.11.0";
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7791,6 +7792,15 @@ const HttpHeaderKeys = {
     CONTENT_TYPE: "Content-Type",
     X_MS_REQUEST_ID: "x-ms-request-id",
 };
+const CustomHeaderConstants = {
+    REQUIRED_PREFIX: "x-",
+    RESERVED_PREFIXES: [
+        "x-client-",
+        "x-ms-",
+        "x-broker-",
+        "x-app-",
+    ],
+};
 const DefaultPackageInfo = {
     SKU: "msal.browser",
     VERSION: version,
@@ -9614,12 +9624,13 @@ class StandardInteractionClient extends BaseInteractionClient {
          * and logoutHint attribute wasn't manually set in logout request
          */
         if (logoutRequest) {
-            // If logoutHint isn't set and an account was passed in, try to extract logoutHint from ID Token Claims
+            // If logoutHint isn't set and an account was passed in, try to extract logoutHint from account loginHint or ID Token Claims
             if (!logoutRequest.logoutHint) {
                 if (logoutRequest.account) {
-                    const logoutHint = this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
+                    const logoutHint = logoutRequest.account.loginHint ||
+                        this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
                     if (logoutHint) {
-                        this.logger.verbose("0st5di", this.correlationId);
+                        this.logger.verbose("0d7s8p", this.correlationId);
                         validLogoutRequest.logoutHint = logoutHint;
                     }
                 }
@@ -9672,6 +9683,7 @@ class StandardInteractionClient extends BaseInteractionClient {
         const idTokenClaims = account.idTokenClaims;
         if (idTokenClaims) {
             if (idTokenClaims.login_hint) {
+                this.logger.verbose("0u5bmc", this.correlationId);
                 return idTokenClaims.login_hint;
             }
             else {
@@ -10963,15 +10975,67 @@ class CustomAuthInterationClientFactory {
     }
 }
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Filters the headers returned by a {@link CustomAuthRequestInterceptor},
+ * keeping only those that conform to the custom-auth header naming rules.
+ *
+ * Rules (mirrors the iOS / Android native auth implementations):
+ *  - Header names must start with `x-` (case-insensitive); others are dropped.
+ *  - Header names that start with any reserved prefix (`x-client-`, `x-ms-`,
+ *    `x-broker-`, `x-app-`) are dropped.
+ *  - Headers with empty/whitespace-only names or null/undefined values are dropped.
+ *
+ * Dropped headers are logged as warnings (PII-safe) when a logger is provided.
+ *
+ * @param headers - Raw headers returned by the interceptor.
+ * @param logger - Optional logger used to emit warnings for dropped headers.
+ * @param correlationId - Optional correlation id forwarded to the logger.
+ * @returns A new record containing only the headers that pass the filter,
+ *          preserving the original casing of header names.
+ */
+function filterCustomHeaders(headers, logger, correlationId) {
+    const filtered = {};
+    if (!headers) {
+        return filtered;
+    }
+    for (const [name, value] of Object.entries(headers)) {
+        if (!name || value === undefined || value === null) {
+            continue;
+        }
+        const trimmedName = name.trim();
+        if (!trimmedName) {
+            continue;
+        }
+        const lowerName = trimmedName.toLowerCase();
+        if (!lowerName.startsWith(CustomHeaderConstants.REQUIRED_PREFIX)) {
+            logger?.warningPii("0vzpop", correlationId ?? "");
+            continue;
+        }
+        const reservedPrefix = CustomHeaderConstants.RESERVED_PREFIXES.find((prefix) => lowerName.startsWith(prefix));
+        if (reservedPrefix) {
+            logger?.warningPii("1m3lhk", correlationId ?? "");
+            continue;
+        }
+        filtered[trimmedName] = value;
+    }
+    return filtered;
+}
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
 class BaseApiClient {
-    constructor(baseUrl, clientId, httpClient, customAuthApiQueryParams) {
+    constructor(baseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger) {
         this.clientId = clientId;
         this.httpClient = httpClient;
         this.customAuthApiQueryParams = customAuthApiQueryParams;
+        this.requestInterceptor = requestInterceptor;
+        this.logger = logger;
         this.baseRequestUrl = parseUrl(!baseUrl.endsWith("/") ? `${baseUrl}/` : baseUrl);
     }
     async request(endpoint, data, telemetryManager, correlationId) {
@@ -10979,8 +11043,10 @@ class BaseApiClient {
             client_id: this.clientId,
             ...data,
         });
-        const headers = this.getCommonHeaders(correlationId, telemetryManager);
+        const commonHeaders = this.getCommonHeaders(correlationId, telemetryManager);
         const url = buildUrl(this.baseRequestUrl.href, endpoint, this.customAuthApiQueryParams);
+        const additionalHeaders = await this.getAdditionalHeaders(url, correlationId);
+        const headers = { ...commonHeaders, ...additionalHeaders };
         let response;
         try {
             response = await this.httpClient.post(url, formData, headers);
@@ -11038,6 +11104,19 @@ class BaseApiClient {
             : responseError.invalid_attributes ?? [];
         throw new CustomAuthApiError(responseError.error, responseError.error_description, responseError.correlation_id, responseError.error_codes, responseError.suberror, attributes, responseError.continuation_token, responseError.trace_id, responseError.timestamp);
     }
+    async getAdditionalHeaders(url, correlationId) {
+        if (!this.requestInterceptor) {
+            return {};
+        }
+        try {
+            const result = await Promise.resolve(this.requestInterceptor.addAdditionalHeaderFields(url));
+            return filterCustomHeaders(result, this.logger, correlationId);
+        }
+        catch (e) {
+            this.logger?.warningPii("1ptwx4", correlationId);
+            return {};
+        }
+    }
 }
 /*
@@ -11045,8 +11124,8 @@ class BaseApiClient {
  * Licensed under the MIT License.
  */
 class ResetPasswordApiClient extends BaseApiClient {
-    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
         this.capabilities = capabilities;
     }
     /**
@@ -11129,8 +11208,8 @@ class ResetPasswordApiClient extends BaseApiClient {
  * Licensed under the MIT License.
  */
 class SignupApiClient extends BaseApiClient {
-    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
         this.capabilities = capabilities;
     }
     /**
@@ -11199,8 +11278,8 @@ class SignupApiClient extends BaseApiClient {
  * Licensed under the MIT License.
  */
 class SignInApiClient extends BaseApiClient {
-    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+        super(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
         this.capabilities = capabilities;
     }
     /**
@@ -11367,11 +11446,11 @@ class RegisterApiClient extends BaseApiClient {
  * Licensed under the MIT License.
  */
 class CustomAuthApiClient {
-    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams) {
-        this.signInApi = new SignInApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-        this.signUpApi = new SignupApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-        this.resetPasswordApi = new ResetPasswordApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams);
-        this.registerApi = new RegisterApiClient(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams);
+    constructor(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger) {
+        this.signInApi = new SignInApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+        this.signUpApi = new SignupApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+        this.resetPasswordApi = new ResetPasswordApiClient(customAuthApiBaseUrl, clientId, httpClient, capabilities, customAuthApiQueryParams, requestInterceptor, logger);
+        this.registerApi = new RegisterApiClient(customAuthApiBaseUrl, clientId, httpClient, customAuthApiQueryParams, requestInterceptor, logger);
     }
 }
@@ -14382,7 +14461,6 @@ const CREDENTIAL_SCHEMA_VERSION = 3;
 const ACCOUNT_SCHEMA_VERSION = 3;
 const LOG_LEVEL_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.level`;
 const LOG_PII_CACHE_KEY = `${PREFIX}.${BROWSER_PREFIX}.log.pii`;
-const PLATFORM_AUTH_DOM_SUPPORT = `${PREFIX}.${BROWSER_PREFIX}.platform.auth.dom`;
 const VERSION_CACHE_KEY = `${PREFIX}.version`;
 const ACCOUNT_KEYS = "account.keys";
 const TOKEN_KEYS = "token.keys";
@@ -17916,6 +17994,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
     };
     const DEFAULT_EXPERIMENTAL_OPTIONS = {
         iframeTimeoutTelemetry: false,
+        allowPlatformBrokerWithDOM: false,
     };
     // Throw an error if user has set OIDCOptions without being in OIDC protocol mode
     if (userInputSystem?.protocolMode !== ProtocolMode.OIDC &&
@@ -18360,9 +18439,8 @@ class PlatformAuthDOMHandler {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout) {
+async function getPlatformAuthProvider(logger, performanceClient, correlationId, nativeBrokerHandshakeTimeout, enablePlatformBrokerDOMSupport) {
     logger.trace("134j0v", correlationId);
-    const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
     logger.trace("04c81g", correlationId);
     let platformAuthProvider;
     try {
@@ -18386,22 +18464,6 @@ async function getPlatformAuthProvider(logger, performanceClient, correlationId,
     }
     return platformAuthProvider;
 }
-/**
- * Returns true if the DOM API support for platform auth is enabled in session storage
- * @returns boolean
- * @deprecated
- */
-function isDomEnabledForPlatformAuth() {
-    let sessionStorage;
-    try {
-        sessionStorage = window[BrowserCacheLocation.SessionStorage];
-        // Mute errors if it's a non-browser environment or cookies are blocked.
-        return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
-    }
-    catch (e) {
-        return false;
-    }
-}
 /**
  * Returns boolean indicating whether or not the request should attempt to use platform broker
  * @param logger
@@ -18412,6 +18474,11 @@ function isDomEnabledForPlatformAuth() {
  */
 function isPlatformAuthAllowed(config, logger, correlationId, platformAuthProvider, authenticationScheme) {
     logger.trace("0uko3r", correlationId);
+    // throw an error if allowPlatformBroker is not enabled and allowPlatformBrokerWithDOM is enabled
+    if (!config.system.allowPlatformBroker &&
+        config.experimental.allowPlatformBrokerWithDOM) {
+        throw createClientConfigurationError(invalidPlatformBrokerConfiguration);
+    }
     if (!config.system.allowPlatformBroker) {
         logger.trace("04hozs", correlationId);
         // Developer disabled WAM
@@ -19859,7 +19926,7 @@ class StandardController {
         if (allowPlatformBroker) {
             try {
                 // check if platform authentication is available via DOM or browser extension and create relevant handlers
-                this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, correlationId, this.config.system.nativeBrokerHandshakeTimeout);
+                this.platformAuthProvider = await getPlatformAuthProvider(this.logger, this.performanceClient, correlationId, this.config.system.nativeBrokerHandshakeTimeout, this.config.experimental.allowPlatformBrokerWithDOM);
             }
             catch (e) {
                 this.logger.verbose(e, correlationId);
@@ -21241,7 +21308,7 @@ class CustomAuthStandardController extends StandardController {
         this.customAuthConfig = operatingContext.getCustomAuthConfig();
         this.authority = new CustomAuthAuthority(this.customAuthConfig.auth.authority, this.customAuthConfig, this.networkClient, this.browserStorage, this.logger, this.performanceClient, this.customAuthConfig.customAuth?.authApiProxyUrl);
         const interactionClientFactory = new CustomAuthInterationClientFactory(this.customAuthConfig, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.performanceClient, customAuthApiClient ??
-            new CustomAuthApiClient(this.authority.getCustomAuthApiDomain(), this.customAuthConfig.auth.clientId, new FetchHttpClient(this.logger), this.customAuthConfig.customAuth?.capabilities?.join(" "), this.customAuthConfig.customAuth?.customAuthApiQueryParams), this.authority);
+            new CustomAuthApiClient(this.authority.getCustomAuthApiDomain(), this.customAuthConfig.auth.clientId, new FetchHttpClient(this.logger), this.customAuthConfig.customAuth?.capabilities?.join(" "), this.customAuthConfig.customAuth?.customAuthApiQueryParams, this.customAuthConfig.customAuth?.requestInterceptor, this.logger), this.authority);
         this.signInClient = interactionClientFactory.create(SignInClient);
         this.signUpClient = interactionClientFactory.create(SignUpClient);
         this.resetPasswordClient =