@azure/msal-common 16.12.0 → 16.14.0

package/lib/index.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.12.0 2026-08-04 */
+/*! @azure/msal-common v16.14.0 2026-08-28 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-3p7V__ym.js');
+var indexNode = require('./index-node-l_NIe8t5.js');
 var indexBrowser = require('./index-browser.cjs');
 
 
@@ -32,10 +32,13 @@ exports.ClientConfigurationErrorCodes = indexNode.ClientConfigurationErrorCodes;
 exports.Constants = indexNode.Constants;
 exports.DEFAULT_CRYPTO_IMPLEMENTATION = indexNode.DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = indexNode.DEFAULT_SYSTEM_OPTIONS;
+exports.DEFAULT_TOKEN_BINDING_KEY_MANAGER = indexNode.DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 exports.DefaultStorageClass = indexNode.DefaultStorageClass;
 exports.IntFields = indexNode.IntFields;
 exports.InteractionRequiredAuthError = indexNode.InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = indexNode.InteractionRequiredAuthErrorCodes;
+exports.JoseHeader = indexNode.JoseHeader;
+exports.JsonWebTokenAlgorithms = indexNode.JsonWebTokenAlgorithms;
 Object.defineProperty(exports, "LogLevel", {
 	enumerable: true,
 	get: function () { return indexNode.LogLevel; }
@@ -87,6 +90,5 @@ exports.invokeAsync = indexNode.invokeAsync;
 exports.tenantIdMatchesHomeTenant = indexNode.tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = indexNode.updateAccountTenantProfileData;
 exports.version = indexNode.version;
-exports.JoseHeader = indexBrowser.JoseHeader;
 exports.PerformanceClient = indexBrowser.PerformanceClient;
 //# sourceMappingURL=index.cjs.map

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "16.12.0",
+  "version": "16.14.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/authority/Authority.ts

@@ -141,8 +141,6 @@ export class Authority {
             switch (pathSegments[0].toLowerCase()) {
                 case Constants.ADFS:
                     return AuthorityType.Adfs;
-                case Constants.DSTS:
-                    return AuthorityType.Dsts;
                 default:
                     break;
             }

package/src/authority/AuthorityMetadata.ts

@@ -19,10 +19,7 @@ type RawMetadata = {
 // Build endpoint metadata dynamically to avoid string duplication
 const endpointHosts: Array<{ host: string; issuerHost?: string }> = [
     { host: "login.microsoftonline.com" },
-    {
-        host: "login.chinacloudapi.cn",
-        issuerHost: "login.partner.microsoftonline.cn", // Issuer differs
-    },
+    { host: "login.partner.microsoftonline.cn" },
     { host: "login.microsoftonline.us" },
     { host: "login.sovcloud-identity.fr" },
     { host: "login.sovcloud-identity.de" },
@@ -105,15 +102,6 @@ export const rawMetdataJSON: RawMetadata = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
-            {
-                preferred_network: "login.windows-ppe.net",
-                preferred_cache: "login.windows-ppe.net",
-                aliases: [
-                    "login.windows-ppe.net",
-                    "sts.windows-ppe.net",
-                    "login.microsoft-ppe.com",
-                ],
-            },
         ],
     },
 };

package/src/authority/AuthorityOptions.ts

@@ -32,9 +32,6 @@ export const AzureCloudInstance = {
     // Microsoft Azure public cloud
     AzurePublic: "https://login.microsoftonline.com",
 
-    // Microsoft PPE
-    AzurePpe: "https://login.windows-ppe.net",
-
     // Microsoft Chinese national/regional cloud
     AzureChina: "https://login.chinacloudapi.cn",
 

package/src/authority/AuthorityType.ts

@@ -9,7 +9,6 @@
 export const AuthorityType = {
     Default: 0,
     Adfs: 1,
-    Dsts: 2,
     Ciam: 3,
 } as const;
 export type AuthorityType = (typeof AuthorityType)[keyof typeof AuthorityType];

package/src/cache/CacheManager.ts

@@ -13,6 +13,7 @@ import { TokenClaims } from "../account/TokenClaims.js";
 import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata.js";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { ICrypto } from "../crypto/ICrypto.js";
+import { ITokenBindingKeyManager } from "../crypto/ITokenBindingKeyManager.js";
 import { AuthError } from "../error/AuthError.js";
 import { createCacheError } from "../error/CacheError.js";
 import {
@@ -56,6 +57,7 @@ import {
 export abstract class CacheManager implements ICacheManager {
     protected clientId: string;
     protected cryptoImpl: ICrypto;
+    protected tokenBindingKeyManager: ITokenBindingKeyManager;
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
     private staticAuthorityOptions?: StaticAuthorityOptions;
@@ -66,10 +68,12 @@ export abstract class CacheManager implements ICacheManager {
         cryptoImpl: ICrypto,
         logger: Logger,
         performanceClient: IPerformanceClient,
-        staticAuthorityOptions?: StaticAuthorityOptions
+        staticAuthorityOptions: StaticAuthorityOptions | undefined,
+        tokenBindingKeyManager: ITokenBindingKeyManager
     ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.commonLogger = logger.clone(name, version);
         this.staticAuthorityOptions = staticAuthorityOptions;
         this.performanceClient = performanceClient;
@@ -909,19 +913,9 @@ export abstract class CacheManager implements ICacheManager {
             entity.credentialType ===
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME
         ) {
-            if (
-                !!filter.tokenType &&
-                !this.matchTokenType(entity, filter.tokenType)
-            ) {
+            if (!this.matchAccessTokenWithAuthScheme(entity, filter)) {
                 return false;
             }
-
-            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-            if (filter.tokenType === Constants.AuthenticationScheme.SSH) {
-                if (filter.keyId && !this.matchKeyId(entity, filter.keyId)) {
-                    return false;
-                }
-            }
         }
 
         // Additional cache key components matching (bidirectional isolation)
@@ -1117,29 +1111,34 @@ export abstract class CacheManager implements ICacheManager {
             correlationId
         );
 
-        // Remove Token Binding Key from key store for PoP Tokens Credentials
+        // Remove Token Binding Key from key store for token-bound access token credentials
         if (
             credential.credentialType.toLowerCase() ===
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()
         ) {
-            if (credential.tokenType === Constants.AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity =
-                    credential as AccessTokenEntity;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-
-                if (kid) {
-                    void this.cryptoImpl
-                        .removeTokenBindingKey(kid, correlationId)
-                        .catch(() => {
-                            this.commonLogger.error(
-                                `Failed to remove token binding key '${kid}'`,
-                                correlationId
-                            );
-                            this.performanceClient?.incrementFields(
-                                { removeTokenBindingKeyFailure: 1 },
-                                correlationId
-                            );
-                        });
+            const tokenType = credential.tokenType?.toLowerCase();
+            switch (tokenType) {
+                case Constants.AuthenticationScheme.POP:
+                case Constants.AuthenticationScheme.DPOP.toLowerCase(): {
+                    const accessTokenWithAuthSchemeEntity =
+                        credential as AccessTokenEntity;
+                    const kid = accessTokenWithAuthSchemeEntity.keyId;
+
+                    if (kid) {
+                        void this.tokenBindingKeyManager
+                            .removeTokenBindingKey(kid, correlationId)
+                            .catch(() => {
+                                this.commonLogger.error(
+                                    "Failed to remove token binding key",
+                                    correlationId
+                                );
+                                this.performanceClient?.incrementFields(
+                                    { removeTokenBindingKeyFailure: 1 },
+                                    correlationId
+                                );
+                            });
+                    }
+                    break;
                 }
             }
         }
@@ -1378,7 +1377,6 @@ export abstract class CacheManager implements ICacheManager {
                   attribute_tokens: attributeTokenPartition,
               }
             : undefined;
-
         const accessTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -1387,10 +1385,12 @@ export abstract class CacheManager implements ICacheManager {
             realm: targetRealm || account.tenantId,
             target: scopes,
             tokenType: authScheme,
-            keyId: request.sshKid,
+            keyId:
+                authScheme === Constants.AuthenticationScheme.SSH
+                    ? request.sshKid
+                    : undefined,
             additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
-
         const accessTokenKeys =
             (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
@@ -1970,7 +1970,45 @@ export abstract class CacheManager implements ICacheManager {
         entity: CredentialEntity,
         tokenType: Constants.AuthenticationScheme
     ): boolean {
-        return !!(entity.tokenType && entity.tokenType === tokenType);
+        return !!(
+            entity.tokenType &&
+            entity.tokenType.toLowerCase() === tokenType.toLowerCase()
+        );
+    }
+
+    private matchAccessTokenWithAuthScheme(
+        entity: CredentialEntity,
+        filter: CredentialFilter
+    ): boolean {
+        const normalizedFilterTokenType = (
+            filter.tokenType as string | undefined
+        )?.toLowerCase();
+
+        if (
+            !!filter.tokenType &&
+            !this.matchTokenType(entity, filter.tokenType)
+        ) {
+            return false;
+        }
+
+        switch (normalizedFilterTokenType) {
+            case "dpop":
+            case Constants.AuthenticationScheme.SSH:
+                return this.matchKeyBoundAccessToken(entity, filter);
+            default:
+                return true;
+        }
+    }
+
+    private matchKeyBoundAccessToken(
+        entity: CredentialEntity,
+        filter: CredentialFilter
+    ): boolean {
+        if (!filter.keyId) {
+            return true;
+        }
+
+        return this.matchKeyId(entity, filter.keyId);
     }
 
     /**

package/src/cache/utils/AccountEntityUtils.ts

@@ -276,8 +276,8 @@ export function generateHomeAccountId(
     correlationId: string,
     idTokenClaims?: TokenClaims
 ): string {
-    // since ADFS/DSTS do not have tid and does not set client_info
-    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+    // ADFS does not have tid and does not set client_info
+    if (authType !== AuthorityType.Adfs) {
         // for cases where there is clientInfo
         if (serverClientInfo) {
             try {

package/src/cache/utils/CacheHelpers.ts

@@ -98,6 +98,7 @@ export function createAccessTokenEntity(
         atEntity.refreshOn = refreshOn.toString();
     }
 
+    const normalizedTokenType = atEntity.tokenType?.toLowerCase();
     /*
      * Create Access Token With Auth Scheme instead of regular access token
      * Cast to lower to handle "bearer" from ADFS
@@ -108,7 +109,7 @@ export function createAccessTokenEntity(
     ) {
         atEntity.credentialType =
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-        switch (atEntity.tokenType) {
+        switch (normalizedTokenType) {
             case Constants.AuthenticationScheme.POP:
                 // Make sure keyId is present and add it to credential
                 const tokenClaims: TokenClaims | null = extractTokenClaims(
@@ -124,6 +125,15 @@ export function createAccessTokenEntity(
                 }
                 atEntity.keyId = tokenClaims.cnf.kid;
                 break;
+            case "dpop":
+                if (!keyId) {
+                    throw createClientAuthError(
+                        ClientAuthErrorCodes.keyIdMissing,
+                        correlationId
+                    );
+                }
+                atEntity.keyId = keyId;
+                break;
             case Constants.AuthenticationScheme.SSH:
                 atEntity.keyId = keyId;
         }

package/src/client/AuthorizationCodeClient.ts

@@ -44,6 +44,7 @@ import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
 import {
+    addDpopTokenProofHeader,
     createTokenQueryParameters,
     createTokenRequestHeaders,
     executePostToTokenEndpoint,
@@ -168,7 +169,8 @@ export class AuthorizationCodeClient {
             this.logger,
             this.performanceClient,
             this.config.serializableCache,
-            this.config.persistencePlugin
+            this.config.persistencePlugin,
+            this.config.tokenBindingKeyManager
         );
 
         // Validate response. This function throws a server error if an error is returned by the server.
@@ -271,6 +273,13 @@ export class AuthorizationCodeClient {
             this.config.systemOptions.preventCorsPreflight,
             ccsCredential || request.ccsCredential
         );
+        await addDpopTokenProofHeader(
+            headers,
+            request,
+            endpoint,
+            this.cryptoUtils,
+            this.config.tokenBindingKeyManager
+        );
 
         const thumbprint = getRequestThumbprint(
             this.config.authOptions.clientId,
@@ -422,6 +431,7 @@ export class AuthorizationCodeClient {
         ) {
             const popTokenGenerator = new PopTokenGenerator(
                 this.cryptoUtils,
+                this.config.tokenBindingKeyManager,
                 this.performanceClient
             );
 

package/src/client/RefreshTokenClient.ts

@@ -19,6 +19,7 @@ import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
+import { DpopProofGenerator } from "../crypto/DpopProofGenerator.js";
 import { NetworkResponse } from "../network/NetworkResponse.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import {
@@ -46,6 +47,7 @@ import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
 import {
+    addDpopTokenProofHeader,
     createTokenQueryParameters,
     createTokenRequestHeaders,
     executePostToTokenEndpoint,
@@ -139,7 +141,8 @@ export class RefreshTokenClient {
             this.logger,
             this.performanceClient,
             this.config.serializableCache,
-            this.config.persistencePlugin
+            this.config.persistencePlugin,
+            this.config.tokenBindingKeyManager
         );
         responseHandler.validateTokenResponse(
             response.body,
@@ -297,6 +300,19 @@ export class RefreshTokenClient {
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
         };
+        if (
+            refreshTokenRequest.authenticationScheme ===
+                Constants.AuthenticationScheme.DPOP &&
+            !refreshTokenRequest.dpopJkt
+        ) {
+            const dpopProofGenerator = new DpopProofGenerator(
+                this.cryptoUtils,
+                this.config.tokenBindingKeyManager
+            );
+            refreshTokenRequest.dpopJkt = await dpopProofGenerator.generateJkt(
+                request.correlationId
+            );
+        }
 
         try {
             return await invokeAsync(
@@ -359,6 +375,13 @@ export class RefreshTokenClient {
             this.config.systemOptions.preventCorsPreflight,
             request.ccsCredential
         );
+        await addDpopTokenProofHeader(
+            headers,
+            request,
+            endpoint,
+            this.cryptoUtils,
+            this.config.tokenBindingKeyManager
+        );
 
         const thumbprint = getRequestThumbprint(
             this.config.authOptions.clientId,
@@ -488,6 +511,7 @@ export class RefreshTokenClient {
         ) {
             const popTokenGenerator = new PopTokenGenerator(
                 this.cryptoUtils,
+                this.config.tokenBindingKeyManager,
                 this.performanceClient
             );
 

package/src/client/SilentFlowClient.ts

@@ -17,7 +17,7 @@ import {
 } from "../error/ClientAuthError.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { CacheRecord } from "../cache/entities/CacheRecord.js";
-import { CacheOutcome } from "../utils/Constants.js";
+import { AuthenticationScheme, CacheOutcome } from "../utils/Constants.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { StringUtils } from "../utils/StringUtils.js";
 import { extractTokenClaims } from "../account/AuthToken.js";
@@ -181,6 +181,45 @@ export class SilentFlowClient {
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
 
+        const cachedAccessTokenType =
+            cachedAccessToken.tokenType?.toLowerCase();
+        if (cachedAccessTokenType === AuthenticationScheme.DPOP.toLowerCase()) {
+            if (!cachedAccessToken.keyId) {
+                this.logger.info(
+                    "SilentFlowClient:acquireCachedToken - Cached DPoP access token is missing keyId; refresh required",
+                    request.correlationId
+                );
+                this.setCacheOutcome(
+                    CacheOutcome.NO_CACHED_ACCESS_TOKEN,
+                    request.correlationId
+                );
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
+                );
+            }
+
+            try {
+                await this.config.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(
+                    cachedAccessToken.keyId,
+                    request.correlationId
+                );
+            } catch {
+                this.logger.info(
+                    "SilentFlowClient:acquireCachedToken - Local DPoP key was not found for cached access token; refresh required",
+                    request.correlationId
+                );
+                this.setCacheOutcome(
+                    CacheOutcome.NO_CACHED_ACCESS_TOKEN,
+                    request.correlationId
+                );
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
+                );
+            }
+        }
+
         const environment =
             request.authority || this.authority.getPreferredCache();
         const cacheRecord: CacheRecord = {
@@ -263,7 +302,10 @@ export class SilentFlowClient {
             true,
             request,
             this.performanceClient,
-            idTokenClaims
+            {
+                idTokenClaims,
+                tokenBindingKeyManager: this.config.tokenBindingKeyManager,
+            }
         );
     }
 }

package/src/config/ClientConfiguration.ts

@@ -5,6 +5,10 @@
 
 import { INetworkModule } from "../network/INetworkModule.js";
 import { DEFAULT_CRYPTO_IMPLEMENTATION, ICrypto } from "../crypto/ICrypto.js";
+import {
+    DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+    ITokenBindingKeyManager,
+} from "../crypto/ITokenBindingKeyManager.js";
 import { ILoggerCallback, Logger, LogLevel } from "../logger/Logger.js";
 import {
     DEFAULT_COMMON_TENANT,
@@ -32,6 +36,7 @@ import { StubPerformanceClient } from "../telemetry/performance/StubPerformanceC
  * This object allows you to configure important elements of MSAL functionality:
  * - authOptions                - Authentication for application
  * - cryptoInterface            - Implementation of crypto functions
+ * - tokenBindingKeyManager     - Implementation of token-binding key lifecycle functions
  * - libraryInfo                - Library metadata
  * - telemetry                  - Telemetry options and data
  * - loggerOptions              - Logging for application
@@ -48,6 +53,7 @@ export type ClientConfiguration = {
     storageInterface?: CacheManager;
     networkInterface?: INetworkModule;
     cryptoInterface?: ICrypto;
+    tokenBindingKeyManager?: ITokenBindingKeyManager;
     clientCredentials?: ClientCredentials;
     libraryInfo?: LibraryInfo;
     telemetry?: TelemetryOptions;
@@ -66,6 +72,7 @@ export type CommonClientConfiguration = {
     storageInterface: CacheManager;
     networkInterface: INetworkModule;
     cryptoInterface: Required<ICrypto>;
+    tokenBindingKeyManager: ITokenBindingKeyManager;
     libraryInfo: LibraryInfo;
     telemetry: Required<TelemetryOptions>;
     serverTelemetryManager: ServerTelemetryManager | null;
@@ -226,6 +233,7 @@ export function buildClientConfiguration({
     storageInterface: storageImplementation,
     networkInterface: networkImplementation,
     cryptoInterface: cryptoImplementation,
+    tokenBindingKeyManager: tokenBindingKeyManager,
     clientCredentials: clientCredentials,
     libraryInfo: libraryInfo,
     telemetry: telemetry,
@@ -237,6 +245,8 @@ export function buildClientConfiguration({
         ...DEFAULT_LOGGER_IMPLEMENTATION,
         ...userLoggerOption,
     };
+    const resolvedTokenBindingKeyManager =
+        tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 
     return {
         authOptions: buildAuthOptions(userAuthOptions),
@@ -248,11 +258,14 @@ export function buildClientConfiguration({
                 userAuthOptions.clientId,
                 DEFAULT_CRYPTO_IMPLEMENTATION,
                 new Logger(loggerOptions, name, version),
-                new StubPerformanceClient()
+                new StubPerformanceClient(),
+                undefined,
+                resolvedTokenBindingKeyManager
             ),
         networkInterface:
             networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
+        tokenBindingKeyManager: resolvedTokenBindingKeyManager,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },

package/src/constants/AADServerParamKeys.ts

@@ -44,6 +44,7 @@ export const CLIENT_ASSERTION = "client_assertion";
 export const CLIENT_ASSERTION_TYPE = "client_assertion_type";
 export const TOKEN_TYPE = "token_type";
 export const REQ_CNF = "req_cnf";
+export const DPOP_JKT = "dpop_jkt";
 export const OBO_ASSERTION = "assertion";
 export const REQUESTED_TOKEN_USE = "requested_token_use";
 export const ON_BEHALF_OF = "on_behalf_of";