@azure/msal-common 15.11.0 → 15.12.0

package/dist/utils/ClientAssertionUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/Constants.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 import { Constants } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/UrlUtils.d.ts

@@ -13,4 +13,12 @@ export declare function getDeserializedResponse(responseString: string): Authori
  * Utility to create a URL from the params map
  */
 export declare function mapToQueryString(parameters: Map<string, string>, encodeExtraParams?: boolean, extraQueryParameters?: StringDict): string;
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+export declare function normalizeUrlForComparison(url: string): string;
 //# sourceMappingURL=UrlUtils.d.ts.map

package/dist/utils/UrlUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UrlUtils.d.ts","sourceRoot":"","sources":["../../src/utils/UrlUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAKrE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAWtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACnC,cAAc,EAAE,MAAM,GACvB,iBAAiB,GAAG,IAAI,CA4B1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,iBAAiB,GAAE,OAAc,EACjC,oBAAoB,CAAC,EAAE,UAAU,GAClC,MAAM,CAgBR"}
+{"version":3,"file":"UrlUtils.d.ts","sourceRoot":"","sources":["../../src/utils/UrlUtils.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAKrE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA6B5C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAWtE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACnC,cAAc,EAAE,MAAM,GACvB,iBAAiB,GAAG,IAAI,CA4B1B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,iBAAiB,GAAE,OAAc,EACjC,oBAAoB,CAAC,EAAE,UAAU,GAClC,MAAM,CAgBR;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwB7D"}

package/dist/utils/UrlUtils.mjs

@@ -1,12 +1,35 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
+import { StringUtils } from './StringUtils.mjs';
 import { hashNotDeserialized } from '../error/ClientAuthErrorCodes.mjs';
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Canonicalizes a URL by making it lowercase and ensuring it ends with /
+ * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
+ * @param url - URL to canonicalize
+ * @returns Canonicalized URL
+ */
+function canonicalizeUrl(url) {
+    if (!url) {
+        return url;
+    }
+    let lowerCaseUrl = url.toLowerCase();
+    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+    }
+    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+    }
+    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+        lowerCaseUrl += "/";
+    }
+    return lowerCaseUrl;
+}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -64,7 +87,36 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
         }
     });
     return queryParameterArray.join("&");
+}
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+function normalizeUrlForComparison(url) {
+    if (!url) {
+        return url;
+    }
+    // Remove hash first
+    const urlWithoutHash = url.split("#")[0];
+    try {
+        // Parse the URL to handle encoding consistently
+        const urlObj = new URL(urlWithoutHash);
+        /*
+         * Reconstruct the URL with properly decoded query parameters
+         * This ensures that %27 and ' are treated as equivalent
+         */
+        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
+        // Apply canonicalization logic inline to avoid circular dependency
+        return canonicalizeUrl(normalizedUrl);
+    }
+    catch (e) {
+        // Fallback to original logic if URL parsing fails
+        return canonicalizeUrl(urlWithoutHash);
+    }
 }
 
-export { getDeserializedResponse, mapToQueryString, stripLeadingHashOrQuery };
+export { getDeserializedResponse, mapToQueryString, normalizeUrlForComparison, stripLeadingHashOrQuery };
 //# sourceMappingURL=UrlUtils.mjs.map

package/dist/utils/UrlUtils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"UrlUtils.mjs","sources":["../../src/utils/UrlUtils.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.hashNotDeserialized"],"mappings":";;;;;AAAA;;;AAGG;AASH;;;AAGG;AACG,SAAU,uBAAuB,CAAC,cAAsB,EAAA;AAC1D,IAAA,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,KAAA;AAAM,SAAA,IACH,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;AAC9B,QAAA,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAChC;AACE,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,KAAA;AAED,IAAA,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;AAEG;AACG,SAAU,uBAAuB,CACnC,cAAsB,EAAA;;IAGtB,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;AACpD,QAAA,OAAO,IAAI,CAAC;AACf,KAAA;IACD,IAAI;;AAEA,QAAA,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;;AAEnE,QAAA,MAAM,gBAAgB,GAAsB,MAAM,CAAC,WAAW,CAC1D,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAC1C,CAAC;;QAGF,IACI,gBAAgB,CAAC,IAAI;AACrB,YAAA,gBAAgB,CAAC,OAAO;AACxB,YAAA,gBAAgB,CAAC,KAAK;AACtB,YAAA,gBAAgB,CAAC,iBAAiB;YAClC,gBAAgB,CAAC,KAAK,EACxB;AACE,YAAA,OAAO,gBAAgB,CAAC;AAC3B,SAAA;AACJ,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CAACA,mBAAwC,CAAC,CAAC;AACzE,KAAA;AAED,IAAA,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;AAEG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,iBAA6B,GAAA,IAAI,EACjC,oBAAiC,EAAA;AAEjC,IAAA,MAAM,mBAAmB,GAAkB,IAAI,KAAK,EAAU,CAAC;IAE/D,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,KAAI;AAC9B,QAAA,IACI,CAAC,iBAAiB;YAClB,oBAAoB;YACpB,GAAG,IAAI,oBAAoB,EAC7B;YACE,mBAAmB,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAI,CAAA,EAAA,KAAK,CAAE,CAAA,CAAC,CAAC;AAC/C,SAAA;AAAM,aAAA;AACH,YAAA,mBAAmB,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,kBAAkB,CAAC,KAAK,CAAC,CAAE,CAAA,CAAC,CAAC;AACnE,SAAA;AACL,KAAC,CAAC,CAAC;AAEH,IAAA,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC;;;;"}
+{"version":3,"file":"UrlUtils.mjs","sources":["../../src/utils/UrlUtils.ts"],"sourcesContent":[null],"names":["ClientAuthErrorCodes.hashNotDeserialized"],"mappings":";;;;;;AAAA;;;AAGG;AAUH;;;;;AAKG;AACH,SAAS,eAAe,CAAC,GAAW,EAAA;IAChC,IAAI,CAAC,GAAG,EAAE;AACN,QAAA,OAAO,GAAG,CAAC;AACd,KAAA;AAED,IAAA,IAAI,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAErC,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;QACzC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,KAAA;SAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE;QACjD,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,KAAA;IAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE;QAC1C,YAAY,IAAI,GAAG,CAAC;AACvB,KAAA;AAED,IAAA,OAAO,YAAY,CAAC;AACxB,CAAC;AAED;;;AAGG;AACG,SAAU,uBAAuB,CAAC,cAAsB,EAAA;AAC1D,IAAA,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACjC,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,KAAA;AAAM,SAAA,IACH,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;AAC9B,QAAA,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAChC;AACE,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,KAAA;AAED,IAAA,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;AAEG;AACG,SAAU,uBAAuB,CACnC,cAAsB,EAAA;;IAGtB,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;AACpD,QAAA,OAAO,IAAI,CAAC;AACf,KAAA;IACD,IAAI;;AAEA,QAAA,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;;AAEnE,QAAA,MAAM,gBAAgB,GAAsB,MAAM,CAAC,WAAW,CAC1D,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAC1C,CAAC;;QAGF,IACI,gBAAgB,CAAC,IAAI;AACrB,YAAA,gBAAgB,CAAC,OAAO;AACxB,YAAA,gBAAgB,CAAC,KAAK;AACtB,YAAA,gBAAgB,CAAC,iBAAiB;YAClC,gBAAgB,CAAC,KAAK,EACxB;AACE,YAAA,OAAO,gBAAgB,CAAC;AAC3B,SAAA;AACJ,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;AACR,QAAA,MAAM,qBAAqB,CAACA,mBAAwC,CAAC,CAAC;AACzE,KAAA;AAED,IAAA,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;AAEG;AACG,SAAU,gBAAgB,CAC5B,UAA+B,EAC/B,iBAA6B,GAAA,IAAI,EACjC,oBAAiC,EAAA;AAEjC,IAAA,MAAM,mBAAmB,GAAkB,IAAI,KAAK,EAAU,CAAC;IAE/D,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,KAAI;AAC9B,QAAA,IACI,CAAC,iBAAiB;YAClB,oBAAoB;YACpB,GAAG,IAAI,oBAAoB,EAC7B;YACE,mBAAmB,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAI,CAAA,EAAA,KAAK,CAAE,CAAA,CAAC,CAAC;AAC/C,SAAA;AAAM,aAAA;AACH,YAAA,mBAAmB,CAAC,IAAI,CAAC,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,kBAAkB,CAAC,KAAK,CAAC,CAAE,CAAA,CAAC,CAAC;AACnE,SAAA;AACL,KAAC,CAAC,CAAC;AAEH,IAAA,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;AAMG;AACG,SAAU,yBAAyB,CAAC,GAAW,EAAA;IACjD,IAAI,CAAC,GAAG,EAAE;AACN,QAAA,OAAO,GAAG,CAAC;AACd,KAAA;;IAGD,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,IAAI;;AAEA,QAAA,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAEvC;;;AAGG;AACH,QAAA,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;;AAGtE,QAAA,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;AACzC,KAAA;AAAC,IAAA,OAAO,CAAC,EAAE;;AAER,QAAA,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;AAC1C,KAAA;AACL;;;;"}

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-CtW_2rqJ.js');
+var indexNode = require('./index-node-C8h2xZEM.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-CtW_2rqJ.js → index-node-C8h2xZEM.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v15.11.0 2025-08-12 */
+/*! @azure/msal-common v15.12.0 2025-08-19 */
 'use strict';
 'use strict';
 
@@ -1120,6 +1120,28 @@ class StringUtils {
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+/**
+ * Canonicalizes a URL by making it lowercase and ensuring it ends with /
+ * Inlined version of UrlString.canonicalizeUri to avoid circular dependency
+ * @param url - URL to canonicalize
+ * @returns Canonicalized URL
+ */
+function canonicalizeUrl(url) {
+    if (!url) {
+        return url;
+    }
+    let lowerCaseUrl = url.toLowerCase();
+    if (StringUtils.endsWith(lowerCaseUrl, "?")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -1);
+    }
+    else if (StringUtils.endsWith(lowerCaseUrl, "?/")) {
+        lowerCaseUrl = lowerCaseUrl.slice(0, -2);
+    }
+    if (!StringUtils.endsWith(lowerCaseUrl, "/")) {
+        lowerCaseUrl += "/";
+    }
+    return lowerCaseUrl;
+}
 /**
  * Parses hash string from given string. Returns empty string if no hash symbol is found.
  * @param hashString
@@ -1177,12 +1199,42 @@ function mapToQueryString(parameters, encodeExtraParams = true, extraQueryParame
         }
     });
     return queryParameterArray.join("&");
+}
+/**
+ * Normalizes URLs for comparison by removing hash, canonicalizing,
+ * and ensuring consistent URL encoding in query parameters.
+ * This fixes redirect loops when URLs contain encoded characters like apostrophes (%27).
+ * @param url - URL to normalize
+ * @returns Normalized URL string for comparison
+ */
+function normalizeUrlForComparison(url) {
+    if (!url) {
+        return url;
+    }
+    // Remove hash first
+    const urlWithoutHash = url.split("#")[0];
+    try {
+        // Parse the URL to handle encoding consistently
+        const urlObj = new URL(urlWithoutHash);
+        /*
+         * Reconstruct the URL with properly decoded query parameters
+         * This ensures that %27 and ' are treated as equivalent
+         */
+        const normalizedUrl = urlObj.origin + urlObj.pathname + urlObj.search;
+        // Apply canonicalization logic inline to avoid circular dependency
+        return canonicalizeUrl(normalizedUrl);
+    }
+    catch (e) {
+        // Fallback to original logic if URL parsing fails
+        return canonicalizeUrl(urlWithoutHash);
+    }
 }
 
 var UrlUtils = /*#__PURE__*/Object.freeze({
     __proto__: null,
     getDeserializedResponse: getDeserializedResponse,
     mapToQueryString: mapToQueryString,
+    normalizeUrlForComparison: normalizeUrlForComparison,
     stripLeadingHashOrQuery: stripLeadingHashOrQuery
 });
 
@@ -3853,7 +3905,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "15.11.0";
+const version = "15.12.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3897,7 +3949,11 @@ class ScopeSet {
      * @returns
      */
     static createSearchScopes(inputScopeString) {
-        const scopeSet = new ScopeSet(inputScopeString);
+        // Handle empty scopes by using default OIDC scopes for cache lookup
+        const scopesToUse = inputScopeString && inputScopeString.length > 0
+            ? inputScopeString
+            : [...OIDC_DEFAULT_SCOPES];
+        const scopeSet = new ScopeSet(scopesToUse);
         if (!scopeSet.containsOnlyOIDCScopes()) {
             scopeSet.removeOIDCScopes();
         }
@@ -8346,4 +8402,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-CtW_2rqJ.js.map
+//# sourceMappingURL=index-node-C8h2xZEM.js.map