@azure/msal-common 16.14.3 → 16.15.0

package/lib/{index-node-cgWrVUUm.js → index-node-DD4RzKVr.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.14.3 2026-10-21 */
+/*! @azure/msal-common v16.15.0 2026-10-27 */
 'use strict';
 'use strict';
 
@@ -2895,7 +2895,8 @@ function stripLeadingHashOrQuery(responseString) {
     return responseString;
 }
 /**
- * Returns URL hash as server auth code response object.
+ * Returns flat fragment or query parameters as an authorization response.
+ * Application routes and unrecognized responses return null.
  */
 function getDeserializedResponse(responseString) {
     // Check if given hash is empty
@@ -2905,7 +2906,15 @@ function getDeserializedResponse(responseString) {
     try {
         // Strip the # or ? symbol if present
         const normalizedResponse = stripLeadingHashOrQuery(responseString);
-        // If # symbol was not present, above will return empty string, so give original hash value
+        /*
+         * Require a flat parameter name, not an application route.
+         * Reject routes like #/dashboard?tab=orders&code=... and
+         * #/dashboard/orders&state=..., where ?, /, or # appears before
+         * the first = or &. These characters are allowed in parameter values.
+         */
+        if (!/^[^=&?#/]+(?:=|&|$)/.test(normalizedResponse)) {
+            return null;
+        }
         const deserializedHash = Object.fromEntries(new URLSearchParams(normalizedResponse));
         // Check for known response properties
         if (deserializedHash.code ||
@@ -3074,7 +3083,13 @@ const USER_FEDERATED_IDENTITY_CREDENTIAL = "user_federated_identity_credential";
 const USERNAME = "username";
 const USER_ID = "user_id";
 const FMI_PATH = "fmi_path";
-const ATTRIBUTE_TOKENS = "attribute_tokens";
+const ATTRIBUTE_TOKENS = "attribute_tokens";
+/**
+ * Popup-origin-check-done. Signals to the STS that the client verified the
+ * popup cannot be reached by an untrusted window, so the
+ * Cross-Origin-Opener-Policy response header may be omitted.
+ */
+const POPUP_ORIGIN_CHECK_DONE = "pocd";
 
 var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -3115,6 +3130,7 @@ var AADServerParamKeys = /*#__PURE__*/Object.freeze({
     NONCE: NONCE,
     OBO_ASSERTION: OBO_ASSERTION,
     ON_BEHALF_OF: ON_BEHALF_OF,
+    POPUP_ORIGIN_CHECK_DONE: POPUP_ORIGIN_CHECK_DONE,
     POST_LOGOUT_URI: POST_LOGOUT_URI,
     PROMPT: PROMPT,
     REDIRECT_URI: REDIRECT_URI,
@@ -4004,6 +4020,20 @@ function addInstanceAware(parameters) {
         parameters.set(INSTANCE_AWARE, "true");
     }
 }
+/**
+ * Adds `pocd=1`, telling the STS that the client verified the popup driving
+ * this request cannot be reached by an untrusted window, so the
+ * Cross-Origin-Opener-Policy response header may be omitted.
+ *
+ * Only ever added when the check passed — a negative result is signalled by
+ * omitting the parameter, which keeps the STS default (apply COOP) and stays
+ * compatible with library versions that never send it.
+ */
+function addPopupOriginCheckDone(parameters) {
+    if (!parameters.has(POPUP_ORIGIN_CHECK_DONE)) {
+        parameters.set(POPUP_ORIGIN_CHECK_DONE, "1");
+    }
+}
 /**
  * Add extraParameters
  * @param extraParams - String dictionary containing extra parameters to be added.
@@ -4256,6 +4286,7 @@ var RequestParameterBuilder = /*#__PURE__*/Object.freeze({
     addOboAssertion: addOboAssertion,
     addPassword: addPassword,
     addPopToken: addPopToken,
+    addPopupOriginCheckDone: addPopupOriginCheckDone,
     addPostLogoutRedirectUri: addPostLogoutRedirectUri,
     addPrompt: addPrompt,
     addRedirectUri: addRedirectUri,
@@ -4632,7 +4663,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.14.3";
+const version = "16.15.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7171,6 +7202,45 @@ function getRequestThumbprint(clientId, request, homeAccountId) {
     };
 }
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// Track only our normalized copies, never caller-owned mutable inputs.
+const normalizedHeaderRecords = new WeakSet();
+/**
+ * Creates a lowercase-keyed snapshot without changing header values or the input.
+ * Reuses snapshots produced by this function to avoid repeated normalization.
+ * @internal
+ */
+function normalizeResponseHeaders(headers) {
+    if (normalizedHeaderRecords.has(headers)) {
+        return headers;
+    }
+    const normalized = Object.fromEntries(Object.entries(headers).map(([name, value]) => [
+        name.toLowerCase(),
+        value,
+    ]));
+    normalizedHeaderRecords.add(normalized);
+    return normalized;
+}
+/**
+ * Reads a response header case-insensitively.
+ * Normalized snapshots are never scanned, even when a header is missing.
+ * @internal
+ */
+function getResponseHeader(headers, name) {
+    const key = name.toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(headers, key)) {
+        return headers[key];
+    }
+    if (normalizedHeaderRecords.has(headers)) {
+        return undefined;
+    }
+    const headerName = Object.keys(headers).find((header) => header.toLowerCase() === key);
+    return headerName === undefined ? undefined : headers[headerName];
+}
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7204,13 +7274,14 @@ class ThrottlingUtils {
      * Performs necessary throttling checks after a network request.
      * @param cacheManager
      * @param thumbprint
-     * @param response
+     * @param response - Token response with case-insensitive header names.
      */
     static postProcess(cacheManager, thumbprint, response, correlationId) {
+        const retryAfter = getRetryAfterHeader(response);
         if (ThrottlingUtils.checkResponseStatus(response) ||
-            ThrottlingUtils.checkResponseForRetryAfter(response)) {
+            retryAfter !== undefined) {
             const thumbprintValue = {
-                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(response.headers[HeaderNames.RETRY_AFTER])),
+                throttleTime: ThrottlingUtils.calculateThrottleTime(parseInt(retryAfter || "")),
                 error: response.body.error,
                 errorCodes: response.body.error_codes,
                 errorMessage: response.body.error_description,
@@ -7229,14 +7300,10 @@ class ThrottlingUtils {
     }
     /**
      * Checks a NetworkResponse object's RetryAfter header
-     * @param response
+     * @param response - Token response with case-insensitive header names.
      */
     static checkResponseForRetryAfter(response) {
-        if (response.headers) {
-            return (response.headers.hasOwnProperty(HeaderNames.RETRY_AFTER) &&
-                (response.status < 200 || response.status >= 300));
-        }
-        return false;
+        return getRetryAfterHeader(response) !== undefined;
     }
     /**
      * Calculates the Unix-time value for a throttle to expire given throttleTime in seconds.
@@ -7253,6 +7320,13 @@ class ThrottlingUtils {
         const key = this.generateThrottlingStorageKey(thumbprint);
         cacheManager.removeItem(key, request.correlationId);
     }
+}
+/** Reads Retry-After only for non-success responses. */
+function getRetryAfterHeader(response) {
+    if ((response.status < 200 || response.status >= 300) && response.headers) {
+        return getResponseHeader(response.headers, HeaderNames.RETRY_AFTER);
+    }
+    return undefined;
 }
 
 /*
@@ -7380,7 +7454,8 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     let response;
     try {
         response = await invokeAsync((networkClient.sendPostRequestAsync.bind(networkClient)), NetworkClientSendPostRequestAsync, logger, performanceClient, correlationId)(tokenEndpoint, { ...options, correlationId, performanceClient });
-        const responseHeaders = response.headers || {};
+        const responseHeaders = normalizeResponseHeaders(response.headers || {});
+        response = { ...response, headers: responseHeaders };
         performanceClient?.addFields({
             refreshTokenSize: response.body.refresh_token?.length || 0,
             httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] || "",
@@ -7389,16 +7464,16 @@ async function sendPostRequest(thumbprint, tokenEndpoint, options, correlationId
     }
     catch (e) {
         if (e instanceof NetworkError) {
-            const responseHeaders = e.responseHeaders;
+            const responseHeaders = e.responseHeaders
+                ? normalizeResponseHeaders(e.responseHeaders)
+                : undefined;
             if (responseHeaders) {
                 performanceClient?.addFields({
                     httpVerToken: responseHeaders[HeaderNames.X_MS_HTTP_VERSION] ||
                         "",
                     requestId: responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
-                    contentTypeHeader: responseHeaders[HeaderNames.CONTENT_TYPE] ||
-                        undefined,
-                    contentLengthHeader: responseHeaders[HeaderNames.CONTENT_LENGTH] ||
-                        undefined,
+                    contentTypeHeader: getResponseHeader(responseHeaders, HeaderNames.CONTENT_TYPE) || undefined,
+                    contentLengthHeader: getResponseHeader(responseHeaders, HeaderNames.CONTENT_LENGTH) || undefined,
                     httpStatus: e.httpStatus,
                 }, correlationId);
             }
@@ -7666,6 +7741,9 @@ class AuthorizationCodeClient {
         if (request.logoutHint) {
             addLogoutHint(parameters, request.logoutHint);
         }
+        if (request.popupOriginCheckDone) {
+            addPopupOriginCheckDone(parameters);
+        }
         if (request.extraQueryParameters) {
             addExtraParameters(parameters, request.extraQueryParameters);
         }
@@ -8191,6 +8269,9 @@ function getStandardAuthorizeRequestParameters(authOptions, request, logger, per
             !Object.keys(request.extraQueryParameters).includes(INSTANCE_AWARE))) {
         addInstanceAware(parameters);
     }
+    if (request.popupOriginCheckDone) {
+        addPopupOriginCheckDone(parameters);
+    }
     return parameters;
 }
 /**
@@ -8331,8 +8412,9 @@ function containsResourceParam(params) {
  * header challenge values that can be used outside the basic authorization flows.
  */
 class AuthenticationHeaderParser {
+    /** Captures a case-insensitive snapshot of the response headers. */
     constructor(headers) {
-        this.headers = headers;
+        this.headers = normalizeResponseHeaders(headers);
     }
     /**
      * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
@@ -8340,7 +8422,7 @@ class AuthenticationHeaderParser {
      */
     getShrNonce() {
         // Attempt to parse nonce from Authentiacation-Info
-        const authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        const authenticationInfo = getResponseHeader(this.headers, HeaderNames.AuthenticationInfo);
         if (authenticationInfo) {
             const authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
             if (authenticationInfoChallenges.nextnonce) {
@@ -8349,7 +8431,7 @@ class AuthenticationHeaderParser {
             throw createClientConfigurationError(invalidAuthenticationHeader, "");
         }
         // Attempt to parse nonce from WWW-Authenticate
-        const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        const wwwAuthenticate = getResponseHeader(this.headers, HeaderNames.WWWAuthenticate);
         if (wwwAuthenticate) {
             const wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
             if (wwwAuthenticateChallenges.nonce) {
@@ -8793,4 +8875,4 @@ exports.invokeAsync = invokeAsync;
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-cgWrVUUm.js.map
+//# sourceMappingURL=index-node-DD4RzKVr.js.map