@azure/msal-common 16.14.0 → 16.14.1

package/dist/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ObjectUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';

package/dist-browser/account/AccountInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { isKmsi } from './AuthToken.mjs';
 

package/dist-browser/account/AuthToken.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { tokenParsingError, nullOrEmptyToken } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/account/CcsCredential.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/account/ClientInfo.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { CLIENT_INFO_SEPARATOR } from '../utils/Constants.mjs';

package/dist-browser/account/TokenClaims.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/Authority.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthorityType } from './AuthorityType.mjs';
 import { isOpenIdConfigResponse } from './OpenIdConfigResponse.mjs';

package/dist-browser/authority/AuthorityFactory.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { Authority, formatAuthorityUri } from './Authority.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/authority/AuthorityMetadata.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { UrlString } from '../url/UrlString.mjs';
 import { AuthorityMetadataSource } from '../utils/Constants.mjs';

package/dist-browser/authority/AuthorityOptions.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/AuthorityType.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/CloudInstanceDiscoveryErrorResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/CloudInstanceDiscoveryResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/OpenIdConfigResponse.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/ProtocolMode.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/authority/RegionDiscovery.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { IMDS_VERSION, HTTP_SUCCESS, RegionDiscoverySources, HTTP_BAD_REQUEST, IMDS_ENDPOINT, IMDS_TIMEOUT } from '../utils/Constants.mjs';
 import { RegionDiscoveryGetRegionFromIMDS, RegionDiscoveryGetCurrentVersion } from '../telemetry/performance/PerformanceEvents.mjs';

package/dist-browser/cache/CacheManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { updateAccountTenantProfileData } from '../account/AccountInfo.mjs';
 import { extractTokenClaims } from '../account/AuthToken.mjs';

package/dist-browser/cache/persistence/TokenCacheContext.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/cache/utils/AccountEntityUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { CACHE_ACCOUNT_TYPE_GENERIC, CACHE_KEY_SEPARATOR, CACHE_ACCOUNT_TYPE_ADFS, CACHE_ACCOUNT_TYPE_MSSTS } from '../../utils/Constants.mjs';
 import { buildClientInfo } from '../../account/ClientInfo.mjs';

package/dist-browser/cache/utils/CacheHelpers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { extractTokenClaims } from '../../account/AuthToken.mjs';
 import { createClientAuthError } from '../../error/ClientAuthError.mjs';

package/dist-browser/client/AuthorizationCodeClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { addClientId, addRedirectUri, addScopes, addResource, addAttributeTokens, addAuthorizationCode, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addCodeVerifier, addClientSecret, addClientAssertion, addClientAssertionType, addGrantType, addClientInfo, addPopToken, addSshJwk, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams, addClaims, addPostLogoutRedirectUri, addCorrelationId, addIdTokenHint, addState, addLogoutHint, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { mapToQueryString } from '../utils/UrlUtils.mjs';

package/dist-browser/client/RefreshTokenClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { buildClientConfiguration, isOidcProtocolMode } from '../config/ClientConfiguration.mjs';
 import { addClientId, addRedirectUri, addScopes, addGrantType, addClientInfo, addLibraryInfo, addApplicationTelemetry, addThrottling, addServerTelemetry, addRefreshToken, addAttributeTokens, addClientSecret, addClientAssertion, addClientAssertionType, addPopToken, addSshJwk, addCcsUpn, addCcsOid, addBrokerParameters, addExtraParameters, instrumentBrokerParams, addClaims } from '../request/RequestParameterBuilder.mjs';

package/dist-browser/client/SilentFlowClient.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { buildClientConfiguration } from '../config/ClientConfiguration.mjs';
 import { wasClockTurnedBack, isTokenExpired } from '../utils/TimeUtils.mjs';

package/dist-browser/config/ClientConfiguration.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { DEFAULT_CRYPTO_IMPLEMENTATION } from '../crypto/ICrypto.mjs';
 import { DEFAULT_TOKEN_BINDING_KEY_MANAGER } from '../crypto/ITokenBindingKeyManager.mjs';

package/dist-browser/constants/AADServerParamKeys.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/crypto/DpopProofGenerator.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { JsonWebTokenAlgorithms } from './ICrypto.mjs';
 import { nowSeconds } from '../utils/TimeUtils.mjs';

package/dist-browser/crypto/ICrypto.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/crypto/ITokenBindingKeyManager.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/crypto/JoseHeader.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createJoseHeaderError } from '../error/JoseHeaderError.mjs';
 import { isPlainObject } from '../utils/ObjectUtils.mjs';

package/dist-browser/crypto/PopTokenGenerator.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { JsonWebTokenAlgorithms } from './ICrypto.mjs';
 import { nowSeconds } from '../utils/TimeUtils.mjs';

package/dist-browser/error/AuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/AuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/CacheError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { cacheErrorUnknown, cacheQuotaExceeded } from './CacheErrorCodes.mjs';
 import * as CacheErrorCodes from './CacheErrorCodes.mjs';

package/dist-browser/error/CacheErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/ClientAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/ClientConfigurationError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ClientConfigurationErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/InteractionRequiredAuthError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 import { interactionRequired, consentRequired, loginRequired, badToken, uiNotAllowed, interruptedUser } from './InteractionRequiredAuthErrorCodes.mjs';

package/dist-browser/error/InteractionRequiredAuthErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/JoseHeaderError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/JoseHeaderErrorCodes.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/error/NetworkError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/PlatformBrokerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/error/ServerError.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { AuthError } from './AuthError.mjs';
 

package/dist-browser/index-browser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist-browser/index.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import * as AADServerParamKeys from './constants/AADServerParamKeys.mjs';
 export { AADServerParamKeys };

package/dist-browser/log-strings-mapping.json

@@ -1,7 +1,7 @@
 {
-  "timestamp": "2026-08-28T21:31:23.790Z",
-  "packageVersion": "16.14.0",
-  "totalStrings": 100,
+  "timestamp": "2026-09-15T19:43:08.448Z",
+  "packageVersion": "16.14.1",
+  "totalStrings": 101,
   "mappings": {
     "1lrjz7": {
       "message": "Failed to validate URL: '${e}'",
@@ -315,6 +315,10 @@
       "message": "Persistence enabled, calling beforeCacheAccess",
       "level": "verbose"
     },
+    "0thba9": {
+      "message": "Authorization code response contains an ID Token nonce, but no expected nonce was supplied. Rejecting the response.",
+      "level": "warning"
+    },
     "0g61x3": {
       "message": "executeTokenRequest:validateTokenResponse - AAD is currently available but is unable to refresh the access token.\\n${serverError}",
       "level": "warning"

package/dist-browser/logger/Logger.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/network/INetworkModule.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { methodNotImplemented } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/network/RequestThumbprint.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { serializeAttributeTokens } from '../cache/utils/CacheHelpers.mjs';
 

package/dist-browser/network/ThrottlingUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { THROTTLING_PREFIX, HeaderNames, DEFAULT_THROTTLE_TIME_SECONDS, DEFAULT_MAX_THROTTLE_TIME_SECONDS } from '../utils/Constants.mjs';
 import { ServerError } from '../error/ServerError.mjs';

package/dist-browser/packageMetadata.mjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.14.0";
+const version = "16.14.1";
 
 export { name, version };
 //# sourceMappingURL=packageMetadata.mjs.map

package/dist-browser/protocol/Authorize.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { addClientId, addScopes, addResource, addRedirectUri, addCorrelationId, addResponseMode, addClientInfo, addCliData, addPrompt, addDomainHint, addSid, addLoginHint, addCcsOid, addCcsUpn, addNonce, addState, addBrokerParameters, addClaims, addInstanceAware } from '../request/RequestParameterBuilder.mjs';
 import { INSTANCE_AWARE, CLIENT_ID } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/protocol/Token.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { CcsCredentialType } from '../account/CcsCredential.mjs';
 import { buildClientInfoFromHomeAccountId } from '../account/ClientInfo.mjs';

package/dist-browser/request/AuthenticationHeaderParser.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { HeaderNames } from '../utils/Constants.mjs';

package/dist-browser/request/BaseAuthRequest.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { misplacedResourceParam, resourceParameterRequired } from '../error/ClientAuthErrorCodes.mjs';

package/dist-browser/request/RequestParameterBuilder.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { OIDC_DEFAULT_SCOPES, HeaderNames, CLIENT_INFO, PasswordGrantConstants, AuthenticationScheme, ResponseMode, X_MS_LIB_CAPABILITY_VALUE, ClaimsRequestKeys } from '../utils/Constants.mjs';
 import { X_APP_NAME, X_APP_VER, ATTRIBUTE_TOKENS, CODE, BROKER_CLIENT_ID, BROKER_REDIRECT_URI, CLAIMS, CLI_DATA, CLIENT_ASSERTION, CLIENT_ASSERTION_TYPE, CLIENT_ID, CLIENT_SECRET, CODE_CHALLENGE, CODE_CHALLENGE_METHOD, CODE_VERIFIER, CLIENT_REQUEST_ID, DEVICE_CODE, DOMAIN_HINT, EAR_JWK, EAR_JWE_CRYPTO, GRANT_TYPE, ID_TOKEN_HINT, INSTANCE_AWARE, X_CLIENT_SKU, X_CLIENT_VER, X_CLIENT_OS, X_CLIENT_CPU, LOGIN_HINT, LOGOUT_HINT, NATIVE_BROKER, NONCE, OBO_ASSERTION, TOKEN_TYPE, REQ_CNF, POST_LOGOUT_URI, PROMPT, REDIRECT_URI, REFRESH_TOKEN, REQUESTED_TOKEN_USE, RESOURCE, RESPONSE_MODE, RESPONSE_TYPE, SCOPE, X_CLIENT_CURR_TELEM, X_CLIENT_LAST_TELEM, SID, STATE, X_MS_LIB_CAPABILITY } from '../constants/AADServerParamKeys.mjs';

package/dist-browser/request/ScopeSet.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';
 import { StringUtils } from '../utils/StringUtils.mjs';

package/dist-browser/response/ResponseHandler.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.0 2026-08-28 */
+/*! @azure/msal-common v16.14.1 2026-09-15 */
 'use strict';
 import { updateAccountTenantProfileData, buildTenantProfile } from '../account/AccountInfo.mjs';
 import { extractTokenClaims, isKmsi } from '../account/AuthToken.mjs';
@@ -89,11 +89,26 @@ class ResponseHandler {
         let idTokenClaims;
         if (serverTokenResponse.id_token) {
             idTokenClaims = extractTokenClaims(serverTokenResponse.id_token || "", this.cryptoObj.base64Decode, request.correlationId);
-            // token nonce check (TODO: Add a warning if no nonce is given?)
-            if (authCodePayload && authCodePayload.nonce) {
-                if (idTokenClaims.nonce !== authCodePayload.nonce) {
-                    throw createClientAuthError(nonceMismatch, request.correlationId);
-                }
+        }
+        /*
+         * Callers opt in to strict nonce-presence validation by including
+         * the nonce property, even when its value is undefined.
+         */
+        if (authCodePayload &&
+            Object.prototype.hasOwnProperty.call(authCodePayload, "nonce")) {
+            const expectedNonce = authCodePayload.nonce;
+            const tokenNonce = idTokenClaims?.nonce;
+            // Warn when the ID Token nonce cannot be bound to the request.
+            if (tokenNonce !== undefined && expectedNonce === undefined) {
+                this.logger.warning("0thba9", request.correlationId);
+                throw createClientAuthError(nonceMismatch, request.correlationId);
+            }
+            // If the request supplies a nonce, the ID Token value must be a matching string.
+            if (expectedNonce !== undefined &&
+                (typeof expectedNonce !== "string" ||
+                    typeof tokenNonce !== "string" ||
+                    expectedNonce !== tokenNonce)) {
+                throw createClientAuthError(nonceMismatch, request.correlationId);
             }
         }
         // generate homeAccountId