@azure/msal-browser 5.8.0 → 5.10.0

package/dist/operatingcontext/NestedAppOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { BaseOperatingContext } from './BaseOperatingContext.mjs';
 import { BridgeProxy } from '../naa/BridgeProxy.mjs';

package/dist/operatingcontext/StandardOperatingContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { BaseOperatingContext } from './BaseOperatingContext.mjs';
 

package/dist/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "5.8.0";
+const version = "5.10.0";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { createClientConfigurationError, ClientConfigurationErrorCodes, invokeAsync, RequestParameterBuilder, Constants, AuthorizeProtocol, ThrottlingUtils, ResponseHandler, PerformanceEvents, TimeUtils, ProtocolMode, PopTokenGenerator, ProtocolUtils } from '@azure/msal-common/browser';
 import { GetStandardParams, HandleResponsePlatformBroker, HandleCodeResponse, DecryptEarResponse, NativeInteractionClientAcquireToken } from '../telemetry/BrowserPerformanceEvents.mjs';

package/dist/redirect_bridge/index.mjs

@@ -0,0 +1,131 @@
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
+'use strict';
+import { parseAuthResponseFromUrl, getHomepage } from '../utils/BrowserUtils.mjs';
+import { InteractionType, TemporaryCacheKeys, ApiId, INTERACTION_TYPE } from '../utils/BrowserConstants.mjs';
+import { DEFAULT_REDIRECT_TIMEOUT_MS } from '../config/Configuration.mjs';
+import { NavigationClient } from '../navigation/NavigationClient.mjs';
+import { PREFIX } from '../cache/CacheKeys.mjs';
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * Processes the authentication response from the redirect URL
+ * For SSO and popup scenarios broadcasts it to the main frame
+ * For redirect scenario navigates to the home page
+ *
+ * @param {NavigationClient} navigationClient - Optional navigation client for redirect scenario.
+ *
+ * @returns {Promise<void>} A promise that resolves when the response has been broadcast and cleanup is complete.
+ *
+ * @throws {AuthError} If no authentication payload is found in the URL (hash or query string).
+ * @throws {AuthError} If the state parameter is missing from the redirect URL.
+ * @throws {AuthError} If the state is missing required 'id' or 'meta' attributes.
+ */
+async function broadcastResponseToMainFrame(navigationClient) {
+    let parsedResponse;
+    try {
+        parsedResponse = parseAuthResponseFromUrl();
+    }
+    catch (error) {
+        // Clear hash and query string before re-throwing parse errors
+        if (typeof window.history.replaceState === "function") {
+            window.history.replaceState(null, "", `${window.location.origin}${window.location.pathname}`);
+        }
+        throw error;
+    }
+    const { payload, urlHash, urlQuery, hasResponseInHash, hasResponseInQuery, libraryState, } = parsedResponse;
+    const { id, meta } = libraryState;
+    if (meta["interactionType"] === InteractionType.Redirect) {
+        const navClient = navigationClient || new NavigationClient();
+        let navigateToUrl = "";
+        let clientId = "";
+        let interactionType = "";
+        const interactionKey = `${PREFIX}.${TemporaryCacheKeys.INTERACTION_STATUS_KEY}`;
+        /*
+         * Retrieve the clientId and original navigation URL from
+         * sessionStorage. If sessionStorage access or JSON.parse fails,
+         * we fall back to URL-based navigation below.
+         */
+        try {
+            const rawInteractionStatus = window.sessionStorage.getItem(interactionKey);
+            const interactionStatus = JSON.parse(rawInteractionStatus || "");
+            clientId = interactionStatus.clientId || "";
+            interactionType = interactionStatus.type;
+            if (clientId) {
+                const originKey = `${PREFIX}.${clientId}.${TemporaryCacheKeys.ORIGIN_URI}`;
+                navigateToUrl = window.sessionStorage.getItem(originKey) || "";
+            }
+        }
+        catch {
+            // sessionStorage access or JSON.parse failed
+        }
+        const navigationOptions = {
+            apiId: interactionType === INTERACTION_TYPE.SIGNOUT
+                ? ApiId.logout
+                : ApiId.handleRedirectPromise,
+            noHistory: true,
+            timeout: DEFAULT_REDIRECT_TIMEOUT_MS,
+        };
+        /*
+         * Cache the auth response payload in sessionStorage under the URL_HASH
+         * key, then navigate directly to the origin URL. This replicates what
+         * RedirectClient.handleRedirectPromise does when the current page is
+         * not the loginRequestUrl: it caches the response and navigates.
+         *
+         * On the target page, handleRedirectPromise will find no response in
+         * the URL but will pick up the cached payload from sessionStorage.
+         * This avoids appending the auth response to the URL, which would
+         * create malformed URLs for hash-routed SPAs (e.g. /#/route#code=...).
+         *
+         * If caching fails (clientId unavailable, quota exceeded, storage
+         * disabled), we still navigate to the origin/homepage. The target
+         * page's handleRedirectPromise will return null and the app can
+         * handle re-authentication. Appending auth params to the URL would
+         * not help because handleRedirectPromise also relies on
+         * sessionStorage to persist tokens.
+         */
+        if (clientId) {
+            try {
+                window.sessionStorage.setItem(`${PREFIX}.${clientId}.${TemporaryCacheKeys.URL_HASH}`, payload);
+            }
+            catch {
+                // sessionStorage write failed — navigate anyway; handleRedirectPromise will return null
+            }
+        }
+        const url = navigateToUrl || getHomepage();
+        // Strip bare trailing "?" (empty query string) to match canonical URL form
+        const navigationUrl = url.endsWith("?") ? url.slice(0, -1) : url;
+        await navClient.navigateInternal(navigationUrl, navigationOptions);
+        // Do NOT clear URL for redirect flow - we're navigating away anyway
+        return;
+    }
+    // Clear only the part(s) containing the auth response from redirect bridge URL
+    if (typeof window.history.replaceState === "function") {
+        let newUrl = `${window.location.origin}${window.location.pathname}`;
+        // Preserve hash if it didn't contain the response
+        if (!hasResponseInHash && urlHash) {
+            newUrl += urlHash;
+        }
+        // Preserve query if it didn't contain the response
+        if (!hasResponseInQuery && urlQuery) {
+            newUrl += urlQuery;
+        }
+        window.history.replaceState(null, "", newUrl);
+    }
+    // Send the raw URL payload to the main frame
+    const channel = new BroadcastChannel(id);
+    channel.postMessage({
+        v: 1,
+        payload,
+    });
+    channel.close();
+    try {
+        window.close();
+    }
+    catch { }
+}
+
+export { broadcastResponseToMainFrame };
+//# sourceMappingURL=index.mjs.map

package/dist/redirect_bridge/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../src/redirect_bridge/index.ts"],"sourcesContent":[null],"names":["BrowserUtils.getHomepage"],"mappings":";;;;;;;;AAAA;;;AAGG;AAeH;;;;;;;;;;;;AAYG;AACI,eAAe,4BAA4B,CAC9C,gBAAmC,EAAA;AAEnC,IAAA,IAAI,cAAc,CAAC;IACnB,IAAI;QACA,cAAc,GAAG,wBAAwB,EAAE,CAAC;AAC/C,KAAA;AAAC,IAAA,OAAO,KAAK,EAAE;;QAEZ,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,EAAE;YACnD,MAAM,CAAC,OAAO,CAAC,YAAY,CACvB,IAAI,EACJ,EAAE,EACF,CAAG,EAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAE,CAAA,CACzD,CAAC;AACL,SAAA;AACD,QAAA,MAAM,KAAK,CAAC;AACf,KAAA;AAED,IAAA,MAAM,EACF,OAAO,EACP,OAAO,EACP,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,GACf,GAAG,cAAc,CAAC;AAEnB,IAAA,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAElC,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,eAAe,CAAC,QAAQ,EAAE;AACtD,QAAA,MAAM,SAAS,GAAG,gBAAgB,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAE7D,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,CAAG,EAAA,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAA,CAAE,CAAC;AAChF;;;;AAIG;QACH,IAAI;YACA,MAAM,oBAAoB,GACtB,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;AACjE,YAAA,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC5C,YAAA,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC;AAEzC,YAAA,IAAI,QAAQ,EAAE;gBACV,MAAM,SAAS,GAAG,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,kBAAkB,CAAC,UAAU,CAAA,CAAE,CAAC;gBAC3E,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AAClE,aAAA;AACJ,SAAA;QAAC,MAAM;;AAEP,SAAA;AAED,QAAA,MAAM,iBAAiB,GAAsB;AACzC,YAAA,KAAK,EACD,eAAe,KAAK,gBAAgB,CAAC,OAAO;kBACtC,KAAK,CAAC,MAAM;kBACZ,KAAK,CAAC,qBAAqB;AACrC,YAAA,SAAS,EAAE,IAAI;AACf,YAAA,OAAO,EAAE,2BAA2B;SACvC,CAAC;AAEF;;;;;;;;;;;;;;;;;AAiBG;AACH,QAAA,IAAI,QAAQ,EAAE;YACV,IAAI;AACA,gBAAA,MAAM,CAAC,cAAc,CAAC,OAAO,CACzB,GAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,EAAI,kBAAkB,CAAC,QAAQ,EAAE,EACtD,OAAO,CACV,CAAC;AACL,aAAA;YAAC,MAAM;;AAEP,aAAA;AACJ,SAAA;QAED,MAAM,GAAG,GAAG,aAAa,IAAIA,WAAwB,EAAE,CAAC;;QAExD,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;QAEjE,MAAM,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;;QAGnE,OAAO;AACV,KAAA;;IAGD,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,KAAK,UAAU,EAAE;AACnD,QAAA,IAAI,MAAM,GAAG,CAAG,EAAA,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;;AAEpE,QAAA,IAAI,CAAC,iBAAiB,IAAI,OAAO,EAAE;YAC/B,MAAM,IAAI,OAAO,CAAC;AACrB,SAAA;;AAED,QAAA,IAAI,CAAC,kBAAkB,IAAI,QAAQ,EAAE;YACjC,MAAM,IAAI,QAAQ,CAAC;AACtB,SAAA;QACD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,KAAA;;AAGD,IAAA,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,WAAW,CAAC;AAChB,QAAA,CAAC,EAAE,CAAC;QACJ,OAAO;AACV,KAAA,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,IAAI;QACA,MAAM,CAAC,KAAK,EAAE,CAAC;AAClB,KAAA;AAAC,IAAA,MAAM,GAAE;AACd;;;;"}

package/dist/request/RequestHelpers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { invokeAsync, ProtocolMode, Constants, createClientConfigurationError, ClientConfigurationErrorCodes } from '@azure/msal-common/browser';
 import { InitializeBaseRequest } from '../telemetry/BrowserPerformanceEvents.mjs';

package/dist/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { UrlUtils } from '@azure/msal-common/browser';
 import { createBrowserAuthError } from '../error/BrowserAuthError.mjs';

package/dist/telemetry/BrowserPerformanceClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { PerformanceClient, Constants, Logger } from '@azure/msal-common/browser';
 import { name, version } from '../packageMetadata.mjs';

package/dist/telemetry/BrowserPerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/BrowserPerformanceMeasurement.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/telemetry/BrowserRootPerformanceEvents.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/BrowserConstants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { Constants } from '@azure/msal-common/browser';
 

package/dist/utils/BrowserProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { ProtocolUtils, createClientAuthError, ClientAuthErrorCodes } from '@azure/msal-common/browser';
 

package/dist/utils/BrowserUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 import { RequestParameterBuilder, ProtocolUtils, UrlString, UrlUtils } from '@azure/msal-common/browser';
 export { invoke, invokeAsync } from '@azure/msal-common/browser';

package/dist/utils/Helpers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/MsalFrameStatsUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v5.8.0 2026-04-21 */
+/*! @azure/msal-browser v5.10.0 2026-05-07 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/custom-auth-path/log-strings-mapping.json

@@ -1,7 +1,7 @@
 {
-  "timestamp": "2026-04-21T22:44:41.337Z",
-  "packageVersion": "5.8.0",
-  "totalStrings": 440,
+  "timestamp": "2026-05-07T19:04:32.592Z",
+  "packageVersion": "5.10.0",
+  "totalStrings": 439,
   "mappings": {
     "0yfud8": {
       "message": "Failed to get access token from cache.",
@@ -987,12 +987,8 @@
       "message": "BrowserCacheManager.resetRequestCache called",
       "level": "trace"
     },
-    "1qhy81": {
-      "message": "BrowserCacheManager.getTemporaryCache: No cache item found in local storage",
-      "level": "trace"
-    },
-    "1yt61y": {
-      "message": "BrowserCacheManager.getTemporaryCache: Temporary cache item found in local storage",
+    "1ordf8": {
+      "message": "BrowserCacheManager.getTemporaryCache called",
       "level": "trace"
     },
     "0wfgh6": {