@azure/msal-browser 5.10.1 → 5.12.0

package/src/controllers/StandardController.ts

@@ -369,7 +369,8 @@ export class StandardController implements IController {
                     this.logger,
                     this.performanceClient,
                     correlationId,
-                    this.config.system.nativeBrokerHandshakeTimeout
+                    this.config.system.nativeBrokerHandshakeTimeout,
+                    this.config.experimental.allowPlatformBrokerWithDOM
                 );
             } catch (e) {
                 this.logger.verbose(e as string, correlationId);
@@ -1911,7 +1912,8 @@ export class StandardController implements IController {
             this.performanceClient,
             this.nativeInternalStorage,
             correlationId,
-            this.platformAuthProvider
+            this.platformAuthProvider,
+            this.operatingContext.getResponseHandlers()?.waitForPopupResponse
         );
     }
 
@@ -1950,7 +1952,8 @@ export class StandardController implements IController {
             this.performanceClient,
             this.nativeInternalStorage,
             correlationId,
-            this.platformAuthProvider
+            this.platformAuthProvider,
+            this.operatingContext.getResponseHandlers()?.waitForIframeResponse
         );
     }
 

package/src/custom_auth/CustomAuthConstants.ts

@@ -33,6 +33,16 @@ export const HttpHeaderKeys = {
     X_MS_REQUEST_ID: "x-ms-request-id",
 } as const;
 
+export const CustomHeaderConstants = {
+    REQUIRED_PREFIX: "x-",
+    RESERVED_PREFIXES: [
+        "x-client-",
+        "x-ms-",
+        "x-broker-",
+        "x-app-",
+    ] as ReadonlyArray<string>,
+} as const;
+
 export const DefaultPackageInfo = {
     SKU: "msal.browser",
     VERSION: version,

package/src/custom_auth/configuration/CustomAuthConfiguration.ts

@@ -7,12 +7,14 @@ import {
     BrowserConfiguration,
     Configuration,
 } from "../../config/Configuration.js";
+import { CustomAuthRequestInterceptor } from "./CustomAuthRequestInterceptor.js";
 
 export type CustomAuthOptions = {
     challengeTypes?: Array<string>;
     authApiProxyUrl: string;
     customAuthApiQueryParams?: Record<string, string>;
     capabilities?: Array<string>;
+    requestInterceptor?: CustomAuthRequestInterceptor;
 };
 
 export type CustomAuthConfiguration = Configuration & {

package/src/custom_auth/configuration/CustomAuthRequestInterceptor.ts

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Result type returned by {@link CustomAuthRequestInterceptor.addAdditionalHeaderFields}.
+ *
+ * Implementations may return either a synchronous value or a `Promise` resolving to one of
+ * the following:
+ * - A `Record<string, string>` of additional headers to add to the outgoing request.
+ * - `null` (or `undefined`) when no additional headers should be added for the request.
+ */
+export type CustomAuthAdditionalHeaderFieldsResult =
+    | Record<string, string>
+    | null
+    | undefined;
+
+/**
+ * Interface for intercepting custom auth network requests in order to attach additional
+ * headers to outgoing requests.
+ *
+ * Implementations are invoked by MSAL before each backend request used by custom auth
+ * (sign-in, sign-up, reset-password, and register endpoints). Use this hook to integrate
+ * with third-party fraud and bot-detection SDKs that require custom `x-*` headers.
+ *
+ * MSAL applies the following rules when evaluating the headers you provide:
+ * - Headers must start with `x-` (case-insensitive). Headers that don't start with `x-`
+ *   are ignored.
+ * - Headers that start with any of the following reserved prefixes are ignored:
+ *   `x-client-`, `x-ms-`, `x-broker-`, `x-app-`.
+ * - Headers that pass both rules are added to the network request. If a header you
+ *   provide has the same name as one of MSAL's own internal headers, your value takes
+ *   precedence.
+ */
+export interface CustomAuthRequestInterceptor {
+    /**
+     * Returns additional headers to add to a custom-auth network request.
+     *
+     * Scope your headers to specific endpoints by inspecting `requestUrl`. Sending
+     * headers to unrelated endpoints can degrade signal quality and increase false
+     * positives for fraud/bot-detection vendors.
+     *
+     * @param requestUrl - The full URL of the outgoing custom-auth request.
+     * @returns A record of headers to add (or `null`/`undefined` if no extra headers
+     *          are needed for the request). May be returned synchronously or as a
+     *          `Promise`.
+     */
+    addAdditionalHeaderFields(
+        requestUrl: URL
+    ):
+        | CustomAuthAdditionalHeaderFieldsResult
+        | Promise<CustomAuthAdditionalHeaderFieldsResult>;
+}

package/src/custom_auth/controller/CustomAuthStandardController.ts

@@ -125,7 +125,9 @@ export class CustomAuthStandardController
                     this.customAuthConfig.auth.clientId,
                     new FetchHttpClient(this.logger),
                     this.customAuthConfig.customAuth?.capabilities?.join(" "),
-                    this.customAuthConfig.customAuth?.customAuthApiQueryParams
+                    this.customAuthConfig.customAuth?.customAuthApiQueryParams,
+                    this.customAuthConfig.customAuth?.requestInterceptor,
+                    this.logger
                 ),
             this.authority
         );

package/src/custom_auth/core/network_client/custom_auth_api/BaseApiClient.ts

@@ -17,9 +17,12 @@ import {
 } from "../../error/CustomAuthApiError.js";
 import {
     AADServerParamKeys,
+    Logger,
     ServerTelemetryManager,
 } from "@azure/msal-common/browser";
 import { ApiErrorResponse } from "./types/ApiErrorResponseTypes.js";
+import { CustomAuthRequestInterceptor } from "../../../configuration/CustomAuthRequestInterceptor.js";
+import { filterCustomHeaders } from "../../utils/CustomHeaderUtils.js";
 
 export abstract class BaseApiClient {
     private readonly baseRequestUrl: URL;
@@ -28,7 +31,9 @@ export abstract class BaseApiClient {
         baseUrl: string,
         private readonly clientId: string,
         private httpClient: IHttpClient,
-        private customAuthApiQueryParams?: Record<string, string>
+        private customAuthApiQueryParams?: Record<string, string>,
+        private requestInterceptor?: CustomAuthRequestInterceptor,
+        private logger?: Logger
     ) {
         this.baseRequestUrl = parseUrl(
             !baseUrl.endsWith("/") ? `${baseUrl}/` : baseUrl
@@ -45,13 +50,23 @@ export abstract class BaseApiClient {
             client_id: this.clientId,
             ...data,
         });
-        const headers = this.getCommonHeaders(correlationId, telemetryManager);
+        const commonHeaders = this.getCommonHeaders(
+            correlationId,
+            telemetryManager
+        );
         const url = buildUrl(
             this.baseRequestUrl.href,
             endpoint,
             this.customAuthApiQueryParams
         );
 
+        const additionalHeaders = await this.getAdditionalHeaders(
+            url,
+            correlationId
+        );
+
+        const headers = { ...commonHeaders, ...additionalHeaders };
+
         let response: Response;
 
         try {
@@ -173,4 +188,28 @@ export abstract class BaseApiClient {
             responseError.timestamp
         );
     }
+
+    private async getAdditionalHeaders(
+        url: URL,
+        correlationId: string
+    ): Promise<Record<string, string>> {
+        if (!this.requestInterceptor) {
+            return {};
+        }
+
+        try {
+            const result = await Promise.resolve(
+                this.requestInterceptor.addAdditionalHeaderFields(url)
+            );
+
+            return filterCustomHeaders(result, this.logger, correlationId);
+        } catch (e) {
+            this.logger?.warningPii(
+                `CustomAuthRequestInterceptor.addAdditionalHeaderFields threw an error; continuing without additional headers: ${e}`,
+                correlationId
+            );
+
+            return {};
+        }
+    }
 }

package/src/custom_auth/core/network_client/custom_auth_api/CustomAuthApiClient.ts

@@ -9,6 +9,8 @@ import { SignInApiClient } from "./SignInApiClient.js";
 import { RegisterApiClient } from "./RegisterApiClient.js";
 import { ICustomAuthApiClient } from "./ICustomAuthApiClient.js";
 import { IHttpClient } from "../http_client/IHttpClient.js";
+import { Logger } from "@azure/msal-common/browser";
+import { CustomAuthRequestInterceptor } from "../../../configuration/CustomAuthRequestInterceptor.js";
 
 export class CustomAuthApiClient implements ICustomAuthApiClient {
     signInApi: SignInApiClient;
@@ -21,34 +23,44 @@ export class CustomAuthApiClient implements ICustomAuthApiClient {
         clientId: string,
         httpClient: IHttpClient,
         capabilities?: string,
-        customAuthApiQueryParams?: Record<string, string>
+        customAuthApiQueryParams?: Record<string, string>,
+        requestInterceptor?: CustomAuthRequestInterceptor,
+        logger?: Logger
     ) {
         this.signInApi = new SignInApiClient(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
             capabilities,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.signUpApi = new SignupApiClient(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
             capabilities,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.resetPasswordApi = new ResetPasswordApiClient(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
             capabilities,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.registerApi = new RegisterApiClient(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
     }
 }

package/src/custom_auth/core/network_client/custom_auth_api/ResetPasswordApiClient.ts

@@ -10,6 +10,7 @@ import {
 import { CustomAuthApiError } from "../../error/CustomAuthApiError.js";
 import { BaseApiClient } from "./BaseApiClient.js";
 import { IHttpClient } from "../http_client/IHttpClient.js";
+import { Logger } from "@azure/msal-common/browser";
 import * as CustomAuthApiEndpoint from "./CustomAuthApiEndpoint.js";
 import * as CustomAuthApiErrorCode from "./types/ApiErrorCodes.js";
 import {
@@ -26,6 +27,7 @@ import {
     ResetPasswordStartResponse,
     ResetPasswordSubmitResponse,
 } from "./types/ApiResponseTypes.js";
+import { CustomAuthRequestInterceptor } from "../../../configuration/CustomAuthRequestInterceptor.js";
 
 export class ResetPasswordApiClient extends BaseApiClient {
     private readonly capabilities?: string;
@@ -35,13 +37,17 @@ export class ResetPasswordApiClient extends BaseApiClient {
         clientId: string,
         httpClient: IHttpClient,
         capabilities?: string,
-        customAuthApiQueryParams?: Record<string, string>
+        customAuthApiQueryParams?: Record<string, string>,
+        requestInterceptor?: CustomAuthRequestInterceptor,
+        logger?: Logger
     ) {
         super(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.capabilities = capabilities;
     }

package/src/custom_auth/core/network_client/custom_auth_api/SignInApiClient.ts

@@ -3,7 +3,7 @@
  * Licensed under the MIT License.
  */
 
-import { ServerTelemetryManager } from "@azure/msal-common/browser";
+import { Logger, ServerTelemetryManager } from "@azure/msal-common/browser";
 import { GrantType } from "../../../CustomAuthConstants.js";
 import { CustomAuthApiError } from "../../error/CustomAuthApiError.js";
 import { BaseApiClient } from "./BaseApiClient.js";
@@ -24,6 +24,7 @@ import {
     SignInIntrospectResponse,
     SignInTokenResponse,
 } from "./types/ApiResponseTypes.js";
+import { CustomAuthRequestInterceptor } from "../../../configuration/CustomAuthRequestInterceptor.js";
 
 export class SignInApiClient extends BaseApiClient {
     private readonly capabilities?: string;
@@ -33,13 +34,17 @@ export class SignInApiClient extends BaseApiClient {
         clientId: string,
         httpClient: IHttpClient,
         capabilities?: string,
-        customAuthApiQueryParams?: Record<string, string>
+        customAuthApiQueryParams?: Record<string, string>,
+        requestInterceptor?: CustomAuthRequestInterceptor,
+        logger?: Logger
     ) {
         super(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.capabilities = capabilities;
     }

package/src/custom_auth/core/network_client/custom_auth_api/SignupApiClient.ts

@@ -6,6 +6,7 @@
 import { GrantType } from "../../../CustomAuthConstants.js";
 import { BaseApiClient } from "./BaseApiClient.js";
 import { IHttpClient } from "../http_client/IHttpClient.js";
+import { Logger } from "@azure/msal-common/browser";
 import * as CustomAuthApiEndpoint from "./CustomAuthApiEndpoint.js";
 import {
     SignUpChallengeRequest,
@@ -19,6 +20,7 @@ import {
     SignUpContinueResponse,
     SignUpStartResponse,
 } from "./types/ApiResponseTypes.js";
+import { CustomAuthRequestInterceptor } from "../../../configuration/CustomAuthRequestInterceptor.js";
 
 export class SignupApiClient extends BaseApiClient {
     private readonly capabilities?: string;
@@ -28,13 +30,17 @@ export class SignupApiClient extends BaseApiClient {
         clientId: string,
         httpClient: IHttpClient,
         capabilities?: string,
-        customAuthApiQueryParams?: Record<string, string>
+        customAuthApiQueryParams?: Record<string, string>,
+        requestInterceptor?: CustomAuthRequestInterceptor,
+        logger?: Logger
     ) {
         super(
             customAuthApiBaseUrl,
             clientId,
             httpClient,
-            customAuthApiQueryParams
+            customAuthApiQueryParams,
+            requestInterceptor,
+            logger
         );
         this.capabilities = capabilities;
     }

package/src/custom_auth/core/utils/CustomHeaderUtils.ts

@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { Logger } from "@azure/msal-common/browser";
+import { CustomHeaderConstants } from "../../CustomAuthConstants.js";
+
+/**
+ * Filters the headers returned by a {@link CustomAuthRequestInterceptor},
+ * keeping only those that conform to the custom-auth header naming rules.
+ *
+ * Rules (mirrors the iOS / Android native auth implementations):
+ *  - Header names must start with `x-` (case-insensitive); others are dropped.
+ *  - Header names that start with any reserved prefix (`x-client-`, `x-ms-`,
+ *    `x-broker-`, `x-app-`) are dropped.
+ *  - Headers with empty/whitespace-only names or null/undefined values are dropped.
+ *
+ * Dropped headers are logged as warnings (PII-safe) when a logger is provided.
+ *
+ * @param headers - Raw headers returned by the interceptor.
+ * @param logger - Optional logger used to emit warnings for dropped headers.
+ * @param correlationId - Optional correlation id forwarded to the logger.
+ * @returns A new record containing only the headers that pass the filter,
+ *          preserving the original casing of header names.
+ */
+export function filterCustomHeaders(
+    headers: Record<string, string> | null | undefined,
+    logger?: Logger,
+    correlationId?: string
+): Record<string, string> {
+    const filtered: Record<string, string> = {};
+
+    if (!headers) {
+        return filtered;
+    }
+
+    for (const [name, value] of Object.entries(headers)) {
+        if (!name || value === undefined || value === null) {
+            continue;
+        }
+
+        const trimmedName = name.trim();
+
+        if (!trimmedName) {
+            continue;
+        }
+
+        const lowerName = trimmedName.toLowerCase();
+
+        if (!lowerName.startsWith(CustomHeaderConstants.REQUIRED_PREFIX)) {
+            logger?.warningPii(
+                `Additional header field "${trimmedName}" must start with the "${CustomHeaderConstants.REQUIRED_PREFIX}" prefix. Ignoring.`,
+                correlationId ?? ""
+            );
+            continue;
+        }
+
+        const reservedPrefix = CustomHeaderConstants.RESERVED_PREFIXES.find(
+            (prefix) => lowerName.startsWith(prefix)
+        );
+
+        if (reservedPrefix) {
+            logger?.warningPii(
+                `Additional header field "${trimmedName}" uses reserved prefix "${reservedPrefix}". Ignoring.`,
+                correlationId ?? ""
+            );
+            continue;
+        }
+
+        filtered[trimmedName] = value;
+    }
+
+    return filtered;
+}

package/src/custom_auth/index.ts

@@ -19,6 +19,10 @@ export { ICustomAuthPublicClientApplication } from "./ICustomAuthPublicClientApp
 
 // Configuration
 export { CustomAuthConfiguration } from "./configuration/CustomAuthConfiguration.js";
+export {
+    CustomAuthRequestInterceptor,
+    CustomAuthAdditionalHeaderFieldsResult,
+} from "./configuration/CustomAuthRequestInterceptor.js";
 
 // Models
 export { CustomAuthAccountData } from "./get_account/auth_flow/CustomAuthAccountData.js";

package/src/error/NativeAuthError.ts

@@ -99,9 +99,9 @@ export function createNativeAuthError(
                 return createBrowserAuthError(
                     BrowserAuthErrorCodes.noNetworkConnectivity
                 );
-            case NativeStatusCodes.UX_NOT_ALLOWED:
+            case NativeStatusCodes.UI_NOT_ALLOWED:
                 return createInteractionRequiredAuthError(
-                    InteractionRequiredAuthErrorCodes.uxNotAllowed
+                    InteractionRequiredAuthErrorCodes.uiNotAllowed
                 );
         }
     }

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -72,6 +72,7 @@ import {
     PlatformAuthConstants,
     TemporaryCacheKeys,
 } from "../utils/BrowserConstants.js";
+import { getCurrentUri } from "../utils/BrowserUtils.js";
 import {
     BaseInteractionClient,
     getDiscoveredAuthority,
@@ -388,7 +389,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             noHistory: false,
         };
         const redirectUri = navigateToLoginRequestUrl
-            ? window.location.href
+            ? UrlString.getAbsoluteUrl(
+                  request.redirectStartPage || window.location.href,
+                  getCurrentUri()
+              )
             : getRedirectUri(
                   request.redirectUri,
                   this.config.auth.redirectUri,

package/src/interaction_client/PopupClient.ts

@@ -59,6 +59,19 @@ import {
 } from "./BaseInteractionClient.js";
 import { validateRequestMethod } from "../request/RequestHelpers.js";
 
+/**
+ * Signature of the popup-response handler supplied by
+ * {@link PublicClientApplication} to {@link PopupClient} via the operating
+ * context.
+ *
+ * @internal
+ */
+export type WaitForPopupResponseFn = (
+    request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
+    popupWindow: Window,
+    popupWindowParent: Window
+) => Promise<string>;
+
 export type PopupParams = {
     popup?: Window | null;
     popupName: string;
@@ -69,6 +82,9 @@ export type PopupParams = {
 export class PopupClient extends StandardInteractionClient {
     private currentWindow: Window | undefined;
     protected nativeStorage: BrowserCacheManager;
+    private readonly waitForPopupResponseHook:
+        | WaitForPopupResponseFn
+        | undefined;
 
     constructor(
         config: BrowserConfiguration,
@@ -80,7 +96,8 @@ export class PopupClient extends StandardInteractionClient {
         performanceClient: IPerformanceClient,
         nativeStorageImpl: BrowserCacheManager,
         correlationId: string,
-        platformAuthHandler?: IPlatformAuthHandler
+        platformAuthHandler?: IPlatformAuthHandler,
+        waitForPopupResponseHook?: WaitForPopupResponseFn
     ) {
         super(
             config,
@@ -95,6 +112,7 @@ export class PopupClient extends StandardInteractionClient {
         );
         this.nativeStorage = nativeStorageImpl;
         this.eventHandler = eventHandler;
+        this.waitForPopupResponseHook = waitForPopupResponseHook;
     }
 
     /**
@@ -369,12 +387,10 @@ export class PopupClient extends StandardInteractionClient {
                 );
 
                 // Wait for the redirect bridge response
-                const responseString = await BrowserUtils.waitForBridgeResponse(
-                    this.config.system.popupBridgeTimeout,
-                    this.logger,
-                    this.browserCrypto,
+                const responseString = await this.waitForPopupResponse(
                     request,
-                    this.performanceClient
+                    popupWindow,
+                    popupParams.popupWindowParent
                 );
 
                 const serverParams = invoke(
@@ -494,18 +510,12 @@ export class PopupClient extends StandardInteractionClient {
 
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
+            this.waitForPopupResponse.bind(this),
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
-        )(
-            this.config.system.popupBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            popupRequest,
-            this.performanceClient
-        );
+        )(popupRequest, popupWindow, popupParams.popupWindowParent);
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -623,18 +633,12 @@ export class PopupClient extends StandardInteractionClient {
 
         // Monitor the popup for the hash. Return the string value and close the popup when the hash is received. Default timeout is 60 seconds.
         const responseString = await invokeAsync(
-            BrowserUtils.waitForBridgeResponse,
+            this.waitForPopupResponse.bind(this),
             BrowserPerformanceEvents.SilentHandlerMonitorIframeForHash,
             this.logger,
             this.performanceClient,
             correlationId
-        )(
-            this.config.system.popupBridgeTimeout,
-            this.logger,
-            this.browserCrypto,
-            request,
-            this.performanceClient
-        );
+        )(request, popupWindow, popupParams.popupWindowParent);
 
         const serverParams = invoke(
             ResponseHandler.deserializeResponse,
@@ -792,12 +796,10 @@ export class PopupClient extends StandardInteractionClient {
                 null
             );
 
-            await BrowserUtils.waitForBridgeResponse(
-                this.config.system.popupBridgeTimeout,
-                this.logger,
-                this.browserCrypto,
+            await this.waitForPopupResponse(
                 validRequest,
-                this.performanceClient
+                popupWindow,
+                popupParams.popupWindowParent
             ).catch(() => {
                 // Swallow any errors related to monitoring the window. Server logout is best effort
             });
@@ -922,6 +924,22 @@ export class PopupClient extends StandardInteractionClient {
                     BrowserAuthErrorCodes.emptyWindowError
                 );
             }
+            try {
+                popupWindow.document.title = "Microsoft Authentication";
+            } catch (e) {
+                if (
+                    typeof DOMException !== "undefined" &&
+                    e instanceof DOMException &&
+                    e.name === "SecurityError"
+                ) {
+                    // Cross-origin - title cannot be set
+                } else {
+                    this.logger.verbose(
+                        "Could not set document.title on popup window",
+                        this.correlationId
+                    );
+                }
+            }
             if (popupWindow.focus) {
                 popupWindow.focus();
             }
@@ -1043,4 +1061,24 @@ export class PopupClient extends StandardInteractionClient {
         const homeAccountId = request.account && request.account.homeAccountId;
         return `${BrowserConstants.POPUP_NAME_PREFIX}.${this.config.auth.clientId}.${homeAccountId}.${this.correlationId}`;
     }
+
+    protected async waitForPopupResponse(
+        request: CommonAuthorizationUrlRequest | CommonEndSessionRequest,
+        popupWindow: Window,
+        popupWindowParent: Window
+    ): Promise<string> {
+        if (this.waitForPopupResponseHook) {
+            return this.waitForPopupResponseHook(
+                request,
+                popupWindow,
+                popupWindowParent
+            );
+        }
+        return BrowserUtils.waitForBridgeResponse(
+            this.config.system.popupBridgeTimeout,
+            this.logger,
+            request,
+            this.performanceClient
+        );
+    }
 }