@azure/msal-browser 5.13.0 → 5.15.0

package/src/interaction_client/PlatformAuthInteractionClient.ts

@@ -266,7 +266,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         return {
             authority: request.authority,
             correlationId: this.correlationId,
-            scopes: ScopeSet.fromString(request.scope).asArray(),
+            scopes: ScopeSet.fromString(
+                request.scope,
+                this.correlationId
+            ).asArray(),
             account: cachedAccount,
             forceRefresh: false,
         };
@@ -287,7 +290,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 "NativeInteractionClient:acquireTokensFromCache - No nativeAccountId provided",
                 this.correlationId
             );
-            throw createClientAuthError(ClientAuthErrorCodes.noAccountFound);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.noAccountFound,
+                this.correlationId
+            );
         }
         // fetch the account from browser cache
         const account = this.browserStorage.getBaseAccountInfo(
@@ -298,7 +304,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         );
 
         if (!account) {
-            throw createClientAuthError(ClientAuthErrorCodes.noAccountFound);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.noAccountFound,
+                this.correlationId
+            );
         }
 
         // leverage silent flow for cached tokens retrieval
@@ -320,7 +329,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
 
             const idTokenClaims = AuthToken.extractTokenClaims(
                 idToken?.secret || "",
-                base64Decode
+                base64Decode,
+                this.correlationId
             );
 
             const fullAccount = updateAccountTenantProfileData(
@@ -395,7 +405,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         const redirectUri = navigateToLoginRequestUrl
             ? UrlString.getAbsoluteUrl(
                   request.redirectStartPage || window.location.href,
-                  getCurrentUri()
+                  getCurrentUri(),
+                  this.correlationId
               )
             : getRedirectUri(
                   request.redirectUri,
@@ -522,7 +533,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         // generate identifiers
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.id_token,
-            base64Decode
+            base64Decode,
+            this.correlationId
         );
 
         const homeAccountIdentifier = this.createHomeAccountIdentifier(
@@ -552,7 +564,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             response.account.id !== request.accountId
         ) {
             // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
+            throw createNativeAuthError(
+                NativeAuthErrorCodes.userSwitch,
+                this.correlationId
+            );
         }
 
         // Get the preferred_cache domain for the given authority
@@ -640,8 +655,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
      */
     generateScopes(requestScopes: string, responseScopes?: string): ScopeSet {
         return responseScopes
-            ? ScopeSet.fromString(responseScopes)
-            : ScopeSet.fromString(requestScopes);
+            ? ScopeSet.fromString(responseScopes, this.correlationId)
+            : ScopeSet.fromString(requestScopes, this.correlationId);
     }
 
     /**
@@ -689,7 +704,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
              * PopTokenGenerator to query the full key for signing
              */
             if (!request.keyId) {
-                throw createClientAuthError(ClientAuthErrorCodes.keyIdMissing);
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.keyIdMissing,
+                    this.correlationId
+                );
             }
             return popTokenGenerator.signPopToken(
                 response.access_token,
@@ -751,6 +769,13 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
          */
         if (accountInfo.nativeAccountId !== response.account.id) {
             accountInfo.nativeAccountId = response.account.id;
+            // Also update the matching tenant profile (source of truth)
+            const targetTenantId = tid || accountInfo.tenantId;
+            const tenantProfile =
+                accountInfo.tenantProfiles?.get(targetTenantId);
+            if (tenantProfile) {
+                tenantProfile.nativeAccountId = response.account.id;
+            }
         }
 
         // generate PoP token as needed
@@ -861,6 +886,7 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                 tokenExpirationSeconds,
                 0,
                 base64Decode,
+                request.correlationId,
                 undefined,
                 request.tokenType as Constants.AuthenticationScheme,
                 undefined,
@@ -994,16 +1020,13 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
 
         // scopes are expected to be received by the native broker as "scope" and will be added to the request below. Other properties that should be dropped from the request to the native broker can be included in the object destructuring here.
         const { scopes, claims, ...remainingProperties } = request;
-        const scopeSet = new ScopeSet(scopes || []);
+        const scopeSet = new ScopeSet(scopes || [], this.correlationId);
         scopeSet.appendScopes(Constants.OIDC_DEFAULT_SCOPES);
 
-        const mergedClaims =
-            configClaims && configClaims.length
-                ? RequestParameterBuilder.addClientCapabilitiesToClaims(
-                      claims,
-                      configClaims
-                  )
-                : claims;
+        const mergedClaims = RequestParameterBuilder.buildMergedClaims(
+            claims,
+            configClaims?.length ? configClaims : undefined
+        );
 
         const validatedRequest: PlatformAuthRequest = {
             ...remainingProperties,
@@ -1032,7 +1055,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
         // Check for PoP token requests: signPopToken should only be set to true if popKid is not set
         if (validatedRequest.signPopToken && !!request.popKid) {
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.invalidPopTokenRequest
+                BrowserAuthErrorCodes.invalidPopTokenRequest,
+                this.correlationId
             );
         }
 
@@ -1110,7 +1134,10 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
             );
         }
 
-        const canonicalAuthority = new UrlString(requestAuthority);
+        const canonicalAuthority = new UrlString(
+            requestAuthority,
+            this.correlationId
+        );
         canonicalAuthority.validateAsUri();
         return canonicalAuthority;
     }
@@ -1154,7 +1181,8 @@ export class PlatformAuthInteractionClient extends BaseInteractionClient {
                     this.correlationId
                 );
                 throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.nativePromptNotSupported
+                    BrowserAuthErrorCodes.nativePromptNotSupported,
+                    this.correlationId
                 );
         }
     }

package/src/interaction_client/PopupClient.ts

@@ -434,7 +434,7 @@ export class PopupClient extends StandardInteractionClient {
             popupParams.popup?.close();
 
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -759,7 +759,8 @@ export class PopupClient extends StandardInteractionClient {
                         };
                         const absoluteUrl = UrlString.getAbsoluteUrl(
                             mainWindowRedirectUri,
-                            BrowserUtils.getCurrentUri()
+                            BrowserUtils.getCurrentUri(),
+                            this.correlationId
                         );
                         await this.navigationClient.navigateInternal(
                             absoluteUrl,
@@ -779,7 +780,8 @@ export class PopupClient extends StandardInteractionClient {
                 validRequest.state || "",
                 {
                     interactionType: InteractionType.Popup,
-                }
+                },
+                validRequest.correlationId
             );
 
             // Create logout string and navigate user window to logout.
@@ -818,7 +820,8 @@ export class PopupClient extends StandardInteractionClient {
                 };
                 const absoluteUrl = UrlString.getAbsoluteUrl(
                     mainWindowRedirectUri,
-                    BrowserUtils.getCurrentUri()
+                    BrowserUtils.getCurrentUri(),
+                    this.correlationId
                 );
 
                 this.logger.verbose(
@@ -844,7 +847,7 @@ export class PopupClient extends StandardInteractionClient {
             popupParams.popup?.close();
 
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             this.eventHandler.emitEvent(
@@ -886,7 +889,8 @@ export class PopupClient extends StandardInteractionClient {
             // Throw error if request URL is empty.
             this.logger.error("Navigate url is empty", this.correlationId);
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.emptyNavigateUri
+                BrowserAuthErrorCodes.emptyNavigateUri,
+                this.correlationId
             );
         }
     }
@@ -927,7 +931,8 @@ export class PopupClient extends StandardInteractionClient {
             // Popup will be null if popups are blocked
             if (!popupWindow) {
                 throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.emptyWindowError
+                    BrowserAuthErrorCodes.emptyWindowError,
+                    this.correlationId
                 );
             }
             try {
@@ -958,7 +963,8 @@ export class PopupClient extends StandardInteractionClient {
                 this.correlationId
             );
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.popupWindowError
+                BrowserAuthErrorCodes.popupWindowError,
+                this.correlationId
             );
         }
     }

package/src/interaction_client/RedirectClient.ts

@@ -176,7 +176,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
             }
             window.removeEventListener("pageshow", handleBackButton);
             throw e;
@@ -260,7 +260,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                e.setCorrelationId(this.correlationId);
+                e.correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -341,6 +341,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -388,6 +389,7 @@ export class RedirectClient extends StandardInteractionClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );
@@ -530,7 +532,9 @@ export class RedirectClient extends StandardInteractionClient {
                 let processHashOnRedirect: boolean = true;
                 if (!loginRequestUrl) {
                     // Redirect to home page if login request url is empty
-                    const homepage = BrowserUtils.getHomepage();
+                    const homepage = BrowserUtils.getHomepage(
+                        this.correlationId
+                    );
                     // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
                     this.browserStorage.setTemporaryCache(
                         TemporaryCacheKeys.ORIGIN_URI,
@@ -573,7 +577,7 @@ export class RedirectClient extends StandardInteractionClient {
             return null;
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -613,7 +617,8 @@ export class RedirectClient extends StandardInteractionClient {
                 ResponseHandler.validateInteractionType(
                     response,
                     this.browserCrypto,
-                    InteractionType.Redirect
+                    InteractionType.Redirect,
+                    this.correlationId
                 );
             } catch (e) {
                 if (e instanceof AuthError) {
@@ -669,7 +674,10 @@ export class RedirectClient extends StandardInteractionClient {
     ): Promise<AuthenticationResult> {
         const state = serverParams.state;
         if (!state) {
-            throw createBrowserAuthError(BrowserAuthErrorCodes.noStateInHash);
+            throw createBrowserAuthError(
+                BrowserAuthErrorCodes.noStateInHash,
+                request.correlationId
+            );
         }
 
         const { authority, azureCloudOptions, extraQueryParameters, account } =
@@ -812,7 +820,8 @@ export class RedirectClient extends StandardInteractionClient {
                 this.correlationId
             );
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.emptyNavigateUri
+                BrowserAuthErrorCodes.emptyNavigateUri,
+                this.correlationId
             );
         }
     }
@@ -894,7 +903,8 @@ export class RedirectClient extends StandardInteractionClient {
                 validLogoutRequest.state || "",
                 {
                     interactionType: InteractionType.Redirect,
-                }
+                },
+                validLogoutRequest.correlationId
             );
 
             // Create logout string and navigate user window to logout.
@@ -955,7 +965,7 @@ export class RedirectClient extends StandardInteractionClient {
             }
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             this.eventHandler.emitEvent(
@@ -988,7 +998,8 @@ export class RedirectClient extends StandardInteractionClient {
         const redirectStartPage = requestStartPage || window.location.href;
         const absoluteRedirectStartPage = UrlString.getAbsoluteUrl(
             redirectStartPage,
-            BrowserUtils.getCurrentUri()
+            BrowserUtils.getCurrentUri(),
+            this.correlationId
         );
         // Sanity check the URL before it is cached so we never persist a malformed value (e.g. the literal string "null")
         UrlUtils.validateUrl(

package/src/interaction_client/SilentAuthCodeClient.ts

@@ -73,7 +73,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Auth code payload is required
         if (!request.code) {
             throw createBrowserAuthError(
-                BrowserAuthErrorCodes.authCodeRequired
+                BrowserAuthErrorCodes.authCodeRequired,
+                this.correlationId
             );
         }
 
@@ -168,7 +169,7 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
             );
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
             throw e;
@@ -182,7 +183,8 @@ export class SilentAuthCodeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/SilentIframeClient.ts

@@ -230,7 +230,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             )(authClient, request);
         } catch (e) {
             if (e instanceof AuthError) {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
             }
 
@@ -497,7 +497,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Validate the response - this checks for errors and validates state
         AuthorizeProtocol.validateAuthorizationResponse(
             serverParams,
-            silentRequest.state
+            silentRequest.state,
+            correlationId
         );
 
         // Verify a valid authorization code is present
@@ -523,7 +524,8 @@ export class SilentIframeClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/SilentRefreshClient.ts

@@ -90,7 +90,7 @@ export class SilentRefreshClient extends StandardInteractionClient {
             request.correlationId
         )(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(
             (e: AuthError) => {
-                (e as AuthError).setCorrelationId(this.correlationId);
+                (e as AuthError).correlationId = this.correlationId;
                 serverTelemetryManager.cacheFailedRequest(e);
                 throw e;
             }
@@ -104,7 +104,8 @@ export class SilentRefreshClient extends StandardInteractionClient {
         // Synchronous so we must reject
         return Promise.reject(
             createBrowserAuthError(
-                BrowserAuthErrorCodes.silentLogoutUnsupported
+                BrowserAuthErrorCodes.silentLogoutUnsupported,
+                ""
             )
         );
     }

package/src/interaction_client/StandardInteractionClient.ts

@@ -120,7 +120,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         logoutRequest.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else if (this.config.auth.postLogoutRedirectUri === null) {
                 this.logger.verbose(
@@ -135,7 +136,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         this.config.auth.postLogoutRedirectUri,
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             } else {
                 this.logger.verbose(
@@ -145,7 +147,8 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
                 validLogoutRequest.postLogoutRedirectUri =
                     UrlString.getAbsoluteUrl(
                         BrowserUtils.getCurrentUri(),
-                        BrowserUtils.getCurrentUri()
+                        BrowserUtils.getCurrentUri(),
+                        validLogoutRequest.correlationId
                     );
             }
         } else {
@@ -349,7 +352,8 @@ export async function initializeAuthorizationRequest(
     const state = ProtocolUtils.setRequestState(
         browserCrypto,
         (request && request.state) || "",
-        browserState
+        browserState,
+        correlationId
     );
 
     const baseRequest: BaseAuthRequest = await invokeAsync(

package/src/interaction_handler/InteractionHandler.ts

@@ -64,7 +64,8 @@ export class InteractionHandler {
         try {
             authCodeResponse = AuthorizeProtocol.getAuthorizationCodePayload(
                 response,
-                request.state
+                request.state,
+                request.correlationId
             );
         } catch (e) {
             if (
@@ -73,7 +74,8 @@ export class InteractionHandler {
             ) {
                 // Translate server error caused by user closing native prompt to corresponding first class MSAL error
                 throw createBrowserAuthError(
-                    BrowserAuthErrorCodes.userCancelled
+                    BrowserAuthErrorCodes.userCancelled,
+                    request.correlationId
                 );
             } else {
                 throw e;

package/src/interaction_handler/SilentHandler.ts

@@ -30,7 +30,10 @@ export async function initiateCodeRequest(
     if (!requestUrl) {
         // Throw error if request URL is empty.
         logger.info("Navigate url is empty", correlationId);
-        throw createBrowserAuthError(BrowserAuthErrorCodes.emptyNavigateUri);
+        throw createBrowserAuthError(
+            BrowserAuthErrorCodes.emptyNavigateUri,
+            correlationId
+        );
     }
 
     frame.src = requestUrl;

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -75,7 +75,7 @@ export class NestedAppAuthAdapter {
 
         const correlationId =
             request.correlationId || this.crypto.createNewGuid();
-        const claims = RequestParameterBuilder.addClientCapabilitiesToClaims(
+        const claims = RequestParameterBuilder.buildMergedClaims(
             request.claims,
             this.clientCapabilities
         );
@@ -104,7 +104,10 @@ export class NestedAppAuthAdapter {
         reqTimestamp: number
     ): AuthenticationResult {
         if (!response.token.id_token || !response.token.access_token) {
-            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.nullOrEmptyToken,
+                request.correlationId
+            );
         }
 
         // Request timestamp and AuthResult expires_in are in seconds, converting to Date for AuthenticationResult
@@ -113,7 +116,8 @@ export class NestedAppAuthAdapter {
         );
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.token.id_token,
-            this.crypto.base64Decode
+            this.crypto.base64Decode,
+            request.correlationId
         );
         const account = this.fromNaaAccountInfo(
             response.account,
@@ -196,7 +200,8 @@ export class NestedAppAuthAdapter {
         const environment = fromAccount.environment;
         if (!environment) {
             throw createClientAuthError(
-                ClientAuthErrorCodes.invalidCacheEnvironment
+                ClientAuthErrorCodes.invalidCacheEnvironment,
+                ""
             );
         }
 
@@ -225,6 +230,7 @@ export class NestedAppAuthAdapter {
             homeAccountId,
             localAccountId,
             tenantId,
+            fromAccount.platformBrokerId,
             effectiveIdTokenClaims
         );
         tenantProfiles.set(tenantId, tenantProfile);
@@ -239,6 +245,7 @@ export class NestedAppAuthAdapter {
             loginHint,
             idToken: idToken,
             idTokenClaims: effectiveIdTokenClaims,
+            nativeAccountId: fromAccount.platformBrokerId,
             tenantProfiles,
         };
 
@@ -262,39 +269,57 @@ export class NestedAppAuthAdapter {
             switch (error.status) {
                 case BridgeStatusCode.UserCancel:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.userCanceled
+                        ClientAuthErrorCodes.userCanceled,
+                        ""
                     );
                 case BridgeStatusCode.NoNetwork:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.noNetworkConnectivity
+                        ClientAuthErrorCodes.noNetworkConnectivity,
+                        ""
                     );
                 case BridgeStatusCode.AccountUnavailable:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.noAccountFound
+                        ClientAuthErrorCodes.noAccountFound,
+                        ""
                     );
                 case BridgeStatusCode.Disabled:
                     return new ClientAuthError(
-                        ClientAuthErrorCodes.nestedAppAuthBridgeDisabled
+                        ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+                        ""
                     );
                 case BridgeStatusCode.NestedAppAuthUnavailable:
                     return new ClientAuthError(
                         error.code ||
                             ClientAuthErrorCodes.nestedAppAuthBridgeDisabled,
+                        "",
                         error.description
                     );
                 case BridgeStatusCode.TransientError:
                 case BridgeStatusCode.PersistentError:
-                    return new ServerError(error.code, error.description);
+                    return new ServerError(
+                        error.code || "",
+                        "",
+                        error.description
+                    );
                 case BridgeStatusCode.UserInteractionRequired:
                     return new InteractionRequiredAuthError(
-                        error.code,
+                        error.code || "",
+                        "",
                         error.description
                     );
                 default:
-                    return new AuthError(error.code, error.description);
+                    return new AuthError(
+                        error.code || "",
+                        "",
+                        error.description
+                    );
             }
         } else {
-            return new AuthError("unknown_error", "An unknown error occurred");
+            return new AuthError(
+                "unknown_error",
+                "",
+                "An unknown error occurred"
+            );
         }
     }
 
@@ -315,12 +340,16 @@ export class NestedAppAuthAdapter {
         correlationId: string
     ): AuthenticationResult {
         if (!idToken || !accessToken) {
-            throw createClientAuthError(ClientAuthErrorCodes.nullOrEmptyToken);
+            throw createClientAuthError(
+                ClientAuthErrorCodes.nullOrEmptyToken,
+                correlationId
+            );
         }
 
         const idTokenClaims = AuthToken.extractTokenClaims(
             idToken.secret,
-            this.crypto.base64Decode
+            this.crypto.base64Decode,
+            correlationId
         );
 
         const scopes = accessToken.target || request.scopes.join(" ");

package/src/navigation/NavigationClient.ts

@@ -55,6 +55,7 @@ export class NavigationClient implements INavigationClient {
                 reject(
                     createBrowserAuthError(
                         BrowserAuthErrorCodes.timedOut,
+                        "",
                         "failed_to_redirect"
                     )
                 );