@azure/msal-common 16.13.0 → 16.14.0

package/src/authority/AuthorityMetadata.ts

@@ -102,15 +102,6 @@ export const rawMetdataJSON: RawMetadata = {
                 preferred_cache: "login.sovcloud-identity.sg",
                 aliases: ["login.sovcloud-identity.sg"],
             },
-            {
-                preferred_network: "login.windows-ppe.net",
-                preferred_cache: "login.windows-ppe.net",
-                aliases: [
-                    "login.windows-ppe.net",
-                    "sts.windows-ppe.net",
-                    "login.microsoft-ppe.com",
-                ],
-            },
         ],
     },
 };

package/src/authority/AuthorityOptions.ts

@@ -32,9 +32,6 @@ export const AzureCloudInstance = {
     // Microsoft Azure public cloud
     AzurePublic: "https://login.microsoftonline.com",
 
-    // Microsoft PPE
-    AzurePpe: "https://login.windows-ppe.net",
-
     // Microsoft Chinese national/regional cloud
     AzureChina: "https://login.chinacloudapi.cn",
 

package/src/authority/AuthorityType.ts

@@ -9,7 +9,6 @@
 export const AuthorityType = {
     Default: 0,
     Adfs: 1,
-    Dsts: 2,
     Ciam: 3,
 } as const;
 export type AuthorityType = (typeof AuthorityType)[keyof typeof AuthorityType];

package/src/cache/CacheManager.ts

@@ -13,6 +13,7 @@ import { TokenClaims } from "../account/TokenClaims.js";
 import { getAliasesFromStaticSources } from "../authority/AuthorityMetadata.js";
 import { StaticAuthorityOptions } from "../authority/AuthorityOptions.js";
 import { ICrypto } from "../crypto/ICrypto.js";
+import { ITokenBindingKeyManager } from "../crypto/ITokenBindingKeyManager.js";
 import { AuthError } from "../error/AuthError.js";
 import { createCacheError } from "../error/CacheError.js";
 import {
@@ -56,6 +57,7 @@ import {
 export abstract class CacheManager implements ICacheManager {
     protected clientId: string;
     protected cryptoImpl: ICrypto;
+    protected tokenBindingKeyManager: ITokenBindingKeyManager;
     // Instance of logger for functions defined in the msal-common layer
     private commonLogger: Logger;
     private staticAuthorityOptions?: StaticAuthorityOptions;
@@ -66,10 +68,12 @@ export abstract class CacheManager implements ICacheManager {
         cryptoImpl: ICrypto,
         logger: Logger,
         performanceClient: IPerformanceClient,
-        staticAuthorityOptions?: StaticAuthorityOptions
+        staticAuthorityOptions: StaticAuthorityOptions | undefined,
+        tokenBindingKeyManager: ITokenBindingKeyManager
     ) {
         this.clientId = clientId;
         this.cryptoImpl = cryptoImpl;
+        this.tokenBindingKeyManager = tokenBindingKeyManager;
         this.commonLogger = logger.clone(name, version);
         this.staticAuthorityOptions = staticAuthorityOptions;
         this.performanceClient = performanceClient;
@@ -1107,29 +1111,34 @@ export abstract class CacheManager implements ICacheManager {
             correlationId
         );
 
-        // Remove Token Binding Key from key store for PoP Tokens Credentials
+        // Remove Token Binding Key from key store for token-bound access token credentials
         if (
             credential.credentialType.toLowerCase() ===
             Constants.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase()
         ) {
-            if (credential.tokenType === Constants.AuthenticationScheme.POP) {
-                const accessTokenWithAuthSchemeEntity =
-                    credential as AccessTokenEntity;
-                const kid = accessTokenWithAuthSchemeEntity.keyId;
-
-                if (kid) {
-                    void this.cryptoImpl
-                        .removeTokenBindingKey(kid, correlationId)
-                        .catch(() => {
-                            this.commonLogger.error(
-                                `Failed to remove token binding key '${kid}'`,
-                                correlationId
-                            );
-                            this.performanceClient?.incrementFields(
-                                { removeTokenBindingKeyFailure: 1 },
-                                correlationId
-                            );
-                        });
+            const tokenType = credential.tokenType?.toLowerCase();
+            switch (tokenType) {
+                case Constants.AuthenticationScheme.POP:
+                case Constants.AuthenticationScheme.DPOP.toLowerCase(): {
+                    const accessTokenWithAuthSchemeEntity =
+                        credential as AccessTokenEntity;
+                    const kid = accessTokenWithAuthSchemeEntity.keyId;
+
+                    if (kid) {
+                        void this.tokenBindingKeyManager
+                            .removeTokenBindingKey(kid, correlationId)
+                            .catch(() => {
+                                this.commonLogger.error(
+                                    "Failed to remove token binding key",
+                                    correlationId
+                                );
+                                this.performanceClient?.incrementFields(
+                                    { removeTokenBindingKeyFailure: 1 },
+                                    correlationId
+                                );
+                            });
+                    }
+                    break;
                 }
             }
         }
@@ -1368,7 +1377,6 @@ export abstract class CacheManager implements ICacheManager {
                   attribute_tokens: attributeTokenPartition,
               }
             : undefined;
-
         const accessTokenFilter: CredentialFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -1383,7 +1391,6 @@ export abstract class CacheManager implements ICacheManager {
                     : undefined,
             additionalCacheKeyComponents: additionalCacheKeyComponents,
         };
-
         const accessTokenKeys =
             (tokenKeys && tokenKeys.accessToken) ||
             this.getTokenKeys().accessToken;
@@ -1986,9 +1993,8 @@ export abstract class CacheManager implements ICacheManager {
 
         switch (normalizedFilterTokenType) {
             case "dpop":
-                return this.matchKeyBoundAccessToken(entity, filter, true);
             case Constants.AuthenticationScheme.SSH:
-                return this.matchKeyBoundAccessToken(entity, filter, false);
+                return this.matchKeyBoundAccessToken(entity, filter);
             default:
                 return true;
         }
@@ -1996,11 +2002,10 @@ export abstract class CacheManager implements ICacheManager {
 
     private matchKeyBoundAccessToken(
         entity: CredentialEntity,
-        filter: CredentialFilter,
-        requireKeyId: boolean
+        filter: CredentialFilter
     ): boolean {
         if (!filter.keyId) {
-            return !requireKeyId;
+            return true;
         }
 
         return this.matchKeyId(entity, filter.keyId);

package/src/cache/utils/AccountEntityUtils.ts

@@ -276,8 +276,8 @@ export function generateHomeAccountId(
     correlationId: string,
     idTokenClaims?: TokenClaims
 ): string {
-    // since ADFS/DSTS do not have tid and does not set client_info
-    if (!(authType === AuthorityType.Adfs || authType === AuthorityType.Dsts)) {
+    // ADFS does not have tid and does not set client_info
+    if (authType !== AuthorityType.Adfs) {
         // for cases where there is clientInfo
         if (serverClientInfo) {
             try {

package/src/client/AuthorizationCodeClient.ts

@@ -44,6 +44,7 @@ import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
 import {
+    addDpopTokenProofHeader,
     createTokenQueryParameters,
     createTokenRequestHeaders,
     executePostToTokenEndpoint,
@@ -272,6 +273,13 @@ export class AuthorizationCodeClient {
             this.config.systemOptions.preventCorsPreflight,
             ccsCredential || request.ccsCredential
         );
+        await addDpopTokenProofHeader(
+            headers,
+            request,
+            endpoint,
+            this.cryptoUtils,
+            this.config.tokenBindingKeyManager
+        );
 
         const thumbprint = getRequestThumbprint(
             this.config.authOptions.clientId,

package/src/client/RefreshTokenClient.ts

@@ -19,6 +19,7 @@ import * as AADServerParamKeys from "../constants/AADServerParamKeys.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { AuthenticationResult } from "../response/AuthenticationResult.js";
 import { PopTokenGenerator } from "../crypto/PopTokenGenerator.js";
+import { DpopProofGenerator } from "../crypto/DpopProofGenerator.js";
 import { NetworkResponse } from "../network/NetworkResponse.js";
 import { CommonSilentFlowRequest } from "../request/CommonSilentFlowRequest.js";
 import {
@@ -46,6 +47,7 @@ import { ClientAssertion } from "../account/ClientCredentials.js";
 import { getClientAssertion } from "../utils/ClientAssertionUtils.js";
 import { getRequestThumbprint } from "../network/RequestThumbprint.js";
 import {
+    addDpopTokenProofHeader,
     createTokenQueryParameters,
     createTokenRequestHeaders,
     executePostToTokenEndpoint,
@@ -298,6 +300,19 @@ export class RefreshTokenClient {
                 type: CcsCredentialType.HOME_ACCOUNT_ID,
             },
         };
+        if (
+            refreshTokenRequest.authenticationScheme ===
+                Constants.AuthenticationScheme.DPOP &&
+            !refreshTokenRequest.dpopJkt
+        ) {
+            const dpopProofGenerator = new DpopProofGenerator(
+                this.cryptoUtils,
+                this.config.tokenBindingKeyManager
+            );
+            refreshTokenRequest.dpopJkt = await dpopProofGenerator.generateJkt(
+                request.correlationId
+            );
+        }
 
         try {
             return await invokeAsync(
@@ -360,6 +375,13 @@ export class RefreshTokenClient {
             this.config.systemOptions.preventCorsPreflight,
             request.ccsCredential
         );
+        await addDpopTokenProofHeader(
+            headers,
+            request,
+            endpoint,
+            this.cryptoUtils,
+            this.config.tokenBindingKeyManager
+        );
 
         const thumbprint = getRequestThumbprint(
             this.config.authOptions.clientId,

package/src/client/SilentFlowClient.ts

@@ -17,7 +17,7 @@ import {
 } from "../error/ClientAuthError.js";
 import { ResponseHandler } from "../response/ResponseHandler.js";
 import { CacheRecord } from "../cache/entities/CacheRecord.js";
-import { CacheOutcome } from "../utils/Constants.js";
+import { AuthenticationScheme, CacheOutcome } from "../utils/Constants.js";
 import { IPerformanceClient } from "../telemetry/performance/IPerformanceClient.js";
 import { StringUtils } from "../utils/StringUtils.js";
 import { extractTokenClaims } from "../account/AuthToken.js";
@@ -181,6 +181,45 @@ export class SilentFlowClient {
             // don't throw ClientAuthError.createRefreshRequiredError(), return cached token instead
         }
 
+        const cachedAccessTokenType =
+            cachedAccessToken.tokenType?.toLowerCase();
+        if (cachedAccessTokenType === AuthenticationScheme.DPOP.toLowerCase()) {
+            if (!cachedAccessToken.keyId) {
+                this.logger.info(
+                    "SilentFlowClient:acquireCachedToken - Cached DPoP access token is missing keyId; refresh required",
+                    request.correlationId
+                );
+                this.setCacheOutcome(
+                    CacheOutcome.NO_CACHED_ACCESS_TOKEN,
+                    request.correlationId
+                );
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
+                );
+            }
+
+            try {
+                await this.config.tokenBindingKeyManager.getTokenBindingPublicKeyJwk(
+                    cachedAccessToken.keyId,
+                    request.correlationId
+                );
+            } catch {
+                this.logger.info(
+                    "SilentFlowClient:acquireCachedToken - Local DPoP key was not found for cached access token; refresh required",
+                    request.correlationId
+                );
+                this.setCacheOutcome(
+                    CacheOutcome.NO_CACHED_ACCESS_TOKEN,
+                    request.correlationId
+                );
+                throw createClientAuthError(
+                    ClientAuthErrorCodes.tokenRefreshRequired,
+                    request.correlationId
+                );
+            }
+        }
+
         const environment =
             request.authority || this.authority.getPreferredCache();
         const cacheRecord: CacheRecord = {

package/src/config/ClientConfiguration.ts

@@ -245,6 +245,8 @@ export function buildClientConfiguration({
         ...DEFAULT_LOGGER_IMPLEMENTATION,
         ...userLoggerOption,
     };
+    const resolvedTokenBindingKeyManager =
+        tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 
     return {
         authOptions: buildAuthOptions(userAuthOptions),
@@ -256,13 +258,14 @@ export function buildClientConfiguration({
                 userAuthOptions.clientId,
                 DEFAULT_CRYPTO_IMPLEMENTATION,
                 new Logger(loggerOptions, name, version),
-                new StubPerformanceClient()
+                new StubPerformanceClient(),
+                undefined,
+                resolvedTokenBindingKeyManager
             ),
         networkInterface:
             networkImplementation || DEFAULT_NETWORK_IMPLEMENTATION,
         cryptoInterface: cryptoImplementation || DEFAULT_CRYPTO_IMPLEMENTATION,
-        tokenBindingKeyManager:
-            tokenBindingKeyManager || DEFAULT_TOKEN_BINDING_KEY_MANAGER,
+        tokenBindingKeyManager: resolvedTokenBindingKeyManager,
         clientCredentials: clientCredentials || DEFAULT_CLIENT_CREDENTIALS,
         libraryInfo: { ...DEFAULT_LIBRARY_INFO, ...libraryInfo },
         telemetry: { ...DEFAULT_TELEMETRY_OPTIONS, ...telemetry },

package/src/constants/AADServerParamKeys.ts

@@ -44,6 +44,7 @@ export const CLIENT_ASSERTION = "client_assertion";
 export const CLIENT_ASSERTION_TYPE = "client_assertion_type";
 export const TOKEN_TYPE = "token_type";
 export const REQ_CNF = "req_cnf";
+export const DPOP_JKT = "dpop_jkt";
 export const OBO_ASSERTION = "assertion";
 export const REQUESTED_TOKEN_USE = "requested_token_use";
 export const ON_BEHALF_OF = "on_behalf_of";

package/src/crypto/DpopProofGenerator.ts

@@ -11,6 +11,7 @@ import {
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError.js";
 import { JoseHeader } from "./JoseHeader.js";
+import type { PublicJsonWebKey } from "./PublicJsonWebKey.js";
 
 /**
  * RFC 9449 DPoP proof JWT payload claims.
@@ -40,18 +41,25 @@ export type DpopTokenProofParams = {
  * @internal
  */
 export type DpopResourceProofParams = {
-    resourceUrl: string;
+    htu: string;
     htm: string;
     ath: string;
     nonce?: string;
 };
 
+export type GenerateDpopResourceProofParams = {
+    htu?: string;
+    htm?: string;
+    nonce?: string;
+    accessToken: string;
+};
+
 const DPOP_HTM_REGEX = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 const DPOP_TOKEN_BINDING_KEY_TYPE = "dpop";
 const DPOP_JWT_HEADER_ALGORITHM = JsonWebTokenAlgorithms.ES256;
 
 function buildProofHeader(
-    publicJwk: JsonWebKey,
+    publicJwk: PublicJsonWebKey,
     correlationId: string
 ): JoseHeader {
     return JoseHeader.getDpopHeader(
@@ -108,6 +116,18 @@ function normalizeHtu(url: string, correlationId: string): string {
     return parsedUrl.href;
 }
 
+function validateDpopNonce(
+    nonce: string | undefined,
+    correlationId: string
+): void {
+    if (nonce !== undefined && nonce.trim().length === 0) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.invalidDpopNonce,
+            correlationId
+        );
+    }
+}
+
 /**
  * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
  * resource-endpoint proof bindings.
@@ -153,6 +173,7 @@ export class DpopProofGenerator {
         params: DpopTokenProofParams,
         correlationId: string = ""
     ): DpopProofClaims {
+        validateDpopNonce(params.nonce, correlationId);
         const claims: DpopProofClaims = {
             jti: this.cryptoUtils.createNewGuid(),
             htm: "POST",
@@ -191,10 +212,11 @@ export class DpopProofGenerator {
         params: DpopResourceProofParams,
         correlationId: string = ""
     ): DpopProofClaims {
+        validateDpopNonce(params.nonce, correlationId);
         const claims: DpopProofClaims = {
             jti: this.cryptoUtils.createNewGuid(),
             htm: normalizeHtm(params.htm, correlationId),
-            htu: normalizeHtu(params.resourceUrl, correlationId),
+            htu: normalizeHtu(params.htu, correlationId),
             ath: params.ath,
             iat: TimeUtils.nowSeconds(),
         };
@@ -208,12 +230,29 @@ export class DpopProofGenerator {
      * Builds and signs a compact DPoP proof JWT for a resource request.
      */
     async generateResourceProof(
-        params: DpopResourceProofParams,
+        params: GenerateDpopResourceProofParams,
         keyId: string,
         correlationId: string = ""
     ): Promise<string> {
+        const { htu, htm, nonce } = params;
+        if (!htu || !htm) {
+            throw createClientConfigurationError(
+                ClientConfigurationErrorCodes.dpopMissingResourceContext,
+                correlationId
+            );
+        }
+
+        const ath = await this.cryptoUtils.hashString(params.accessToken);
         return this.generateProof(
-            this.buildResourceProofClaims(params, correlationId),
+            this.buildResourceProofClaims(
+                {
+                    htu,
+                    htm,
+                    ath,
+                    nonce,
+                },
+                correlationId
+            ),
             keyId,
             correlationId
         );

package/src/crypto/ITokenBindingKeyManager.ts

@@ -7,6 +7,7 @@ import {
     ClientAuthErrorCodes,
     createClientAuthError,
 } from "../error/ClientAuthError.js";
+import type { PublicJsonWebKey } from "./PublicJsonWebKey.js";
 
 /**
  * Parameters used by token-binding key managers to provision browser-managed
@@ -46,7 +47,7 @@ export interface ITokenBindingKeyManager {
     getTokenBindingPublicKeyJwk(
         kid: string,
         correlationId: string
-    ): Promise<JsonWebKey>;
+    ): Promise<PublicJsonWebKey>;
 }
 
 /**
@@ -75,7 +76,7 @@ export const DEFAULT_TOKEN_BINDING_KEY_MANAGER: ITokenBindingKeyManager = {
     async getTokenBindingPublicKeyJwk(
         _kid: string,
         correlationId: string
-    ): Promise<JsonWebKey> {
+    ): Promise<PublicJsonWebKey> {
         throw createClientAuthError(
             ClientAuthErrorCodes.methodNotImplemented,
             correlationId

package/src/crypto/JoseHeader.ts

@@ -9,12 +9,13 @@ import {
 } from "../error/JoseHeaderError.js";
 import { isPlainObject } from "../utils/ObjectUtils.js";
 import { JsonWebTokenTypes } from "../utils/Constants.js";
+import type { PublicJsonWebKey } from "./PublicJsonWebKey.js";
 
 export type JoseHeaderOptions = {
     typ?: JsonWebTokenTypes;
     alg?: string;
     kid?: string;
-    jwk?: JsonWebKey;
+    jwk?: PublicJsonWebKey;
 };
 
 /** @internal */
@@ -22,7 +23,7 @@ export class JoseHeader {
     public typ?: JsonWebTokenTypes;
     public alg: string;
     public kid?: string;
-    public jwk?: JsonWebKey;
+    public jwk?: PublicJsonWebKey;
 
     constructor(
         options: JoseHeaderOptions & { alg: string },

package/src/crypto/PublicJsonWebKey.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * Environment-neutral representation of the public asymmetric JWK fields
+ * used by token-binding implementations.
+ *
+ * @internal
+ */
+export type PublicJsonWebKey = {
+    alg?: string;
+    crv?: string;
+    e?: string;
+    ext?: boolean;
+    key_ops?: string[];
+    kid?: string;
+    kty?: string;
+    n?: string;
+    use?: string;
+    x?: string;
+    y?: string;
+};

package/src/error/ClientAuthErrorCodes.ts

@@ -27,6 +27,7 @@ export const invalidCacheEnvironment = "invalid_cache_environment";
 export const noAccountFound = "no_account_found";
 export const noCryptoObject = "no_crypto_object";
 export const unexpectedCredentialType = "unexpected_credential_type";
+export const dpopTokenTypeMismatch = "dpop_token_type_mismatch";
 export const tokenRefreshRequired = "token_refresh_required";
 export const tokenClaimsCnfRequiredForSignedJwt =
     "token_claims_cnf_required_for_signedjwt";

package/src/error/ClientConfigurationErrorCodes.ts

@@ -34,3 +34,5 @@ export const issuerValidationFailed = "issuer_validation_failed";
 export const invalidResponseMode = "invalid_response_mode";
 export const invalidDpopHtm = "invalid_dpop_htm";
 export const invalidDpopHtu = "invalid_dpop_htu";
+export const invalidDpopNonce = "invalid_dpop_nonce";
+export const dpopMissingResourceContext = "dpop_missing_resource_context";

package/src/exports-common.ts

@@ -111,6 +111,7 @@ export {
     DEFAULT_TOKEN_BINDING_KEY_MANAGER,
     TokenBindingKeyProvisioningParameters,
 } from "./crypto/ITokenBindingKeyManager.js";
+export { PublicJsonWebKey } from "./crypto/PublicJsonWebKey.js";
 
 export * as AuthorizeProtocol from "./protocol/Authorize.js";
 export * as TokenProtocol from "./protocol/Token.js";

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.13.0";
+export const version = "16.14.0";

package/src/protocol/Token.ts

@@ -5,9 +5,14 @@
 
 import { CcsCredential, CcsCredentialType } from "../account/CcsCredential.js";
 import { buildClientInfoFromHomeAccountId } from "../account/ClientInfo.js";
+import { DpopProofGenerator } from "../crypto/DpopProofGenerator.js";
 import { Logger } from "../logger/Logger.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
-import { HeaderNames, URL_FORM_CONTENT_TYPE } from "../utils/Constants.js";
+import {
+    AuthenticationScheme,
+    HeaderNames,
+    URL_FORM_CONTENT_TYPE,
+} from "../utils/Constants.js";
 import * as RequestParameterBuilder from "../request/RequestParameterBuilder.js";
 import * as UrlUtils from "../utils/UrlUtils.js";
 import { IPerformanceClient } from "../exports-browser-only.js";
@@ -29,6 +34,8 @@ import { invokeAsync } from "../utils/FunctionWrappers.js";
 import * as PerformanceEvents from "../telemetry/performance/PerformanceEvents.js";
 import { CacheManager } from "../cache/CacheManager.js";
 import { ServerTelemetryManager } from "../telemetry/server/ServerTelemetryManager.js";
+import { ICrypto } from "../crypto/ICrypto.js";
+import { ITokenBindingKeyManager } from "../crypto/ITokenBindingKeyManager.js";
 
 /**
  * Creates default headers for requests to token endpoint
@@ -65,6 +72,42 @@ export function createTokenRequestHeaders(
     return headers;
 }
 
+/**
+ * Adds the DPoP proof header for token endpoint requests when DPoP is requested.
+ * @internal
+ */
+export async function addDpopTokenProofHeader(
+    headers: Record<string, string>,
+    request: BaseAuthRequest,
+    tokenEndpoint: string,
+    cryptoUtils: ICrypto,
+    tokenBindingKeyManager: ITokenBindingKeyManager
+): Promise<void> {
+    if (request.authenticationScheme !== AuthenticationScheme.DPOP) {
+        return;
+    }
+
+    const dpopProofGenerator = new DpopProofGenerator(
+        cryptoUtils,
+        tokenBindingKeyManager
+    );
+    const keyId = request.dpopJkt;
+    if (!keyId?.trim()) {
+        throw createClientAuthError(
+            ClientAuthErrorCodes.keyIdMissing,
+            request.correlationId
+        );
+    }
+
+    headers[HeaderNames.DPOP] = await dpopProofGenerator.generateTokenProof(
+        {
+            tokenEndpoint,
+        },
+        keyId,
+        request.correlationId
+    );
+}
+
 /**
  * Creates query string for the /token request
  * @param request

package/src/request/BaseAuthRequest.ts

@@ -87,6 +87,11 @@ export type BaseAuthRequest = {
      * Key ID to identify the public key for PoP token request
      */
     popKid?: string;
+    /**
+     * JWK thumbprint for the browser-managed DPoP key bound to this request.
+     * @internal
+     */
+    dpopJkt?: string;
     /**
      * Embedded client id. When specified, broker client id (brk_client_id) and redirect uri (brk_redirect_uri) params are set with values from the config, overriding the corresponding extra parameters, if present.
      */

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -73,4 +73,9 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
      * Indicates whether this authorization request is being initiated by a platform authentication broker instead of a standard web flow.
      */
     platformBroker?: boolean;
+    /**
+     * Precomputed req_cnf value for platform-broker PoP authorization requests.
+     * @internal
+     */
+    reqCnf?: string;
 };