@azure/msal-common 16.14.3 → 16.16.0

package/lib/index.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.14.3 2026-10-21 */
+/*! @azure/msal-common v16.16.0 2026-11-05 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-cgWrVUUm.js');
+var indexNode = require('./index-node-C1QI6fAD.js');
 var indexBrowser = require('./index-browser.cjs');
 
 
@@ -34,6 +34,7 @@ exports.DEFAULT_CRYPTO_IMPLEMENTATION = indexNode.DEFAULT_CRYPTO_IMPLEMENTATION;
 exports.DEFAULT_SYSTEM_OPTIONS = indexNode.DEFAULT_SYSTEM_OPTIONS;
 exports.DEFAULT_TOKEN_BINDING_KEY_MANAGER = indexNode.DEFAULT_TOKEN_BINDING_KEY_MANAGER;
 exports.DefaultStorageClass = indexNode.DefaultStorageClass;
+exports.DpopProofGenerator = indexNode.DpopProofGenerator;
 exports.IntFields = indexNode.IntFields;
 exports.InteractionRequiredAuthError = indexNode.InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorCodes = indexNode.InteractionRequiredAuthErrorCodes;
@@ -87,6 +88,7 @@ exports.getRequestThumbprint = indexNode.getRequestThumbprint;
 exports.getTenantIdFromIdTokenClaims = indexNode.getTenantIdFromIdTokenClaims;
 exports.invoke = indexNode.invoke;
 exports.invokeAsync = indexNode.invokeAsync;
+exports.normalizeDpopResourceRequestContext = indexNode.normalizeDpopResourceRequestContext;
 exports.tenantIdMatchesHomeTenant = indexNode.tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = indexNode.updateAccountTenantProfileData;
 exports.version = indexNode.version;

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
   },
-  "version": "16.14.3",
+  "version": "16.16.0",
   "description": "Microsoft Authentication Library for js",
   "keywords": [
     "implicit",

package/src/cache/CacheManager.ts

@@ -719,6 +719,7 @@ export abstract class CacheManager implements ICacheManager {
             correlationId
         );
 
+        const accessTokenKeysToRemove: string[] = [];
         tokenKeys.accessToken.forEach((key) => {
             if (
                 !this.accessTokenKeyMatchesFilter(key, accessTokenFilter, false)
@@ -744,10 +745,17 @@ export abstract class CacheManager implements ICacheManager {
                     correlationId
                 );
                 if (tokenScopeSet.intersectingScopeSets(currentScopes)) {
-                    this.removeAccessToken(key, correlationId);
+                    accessTokenKeysToRemove.push(key);
                 }
             }
         });
+        for (const key of accessTokenKeysToRemove) {
+            await this.removeAccessTokenAndTokenBindingKey(
+                key,
+                correlationId,
+                credential.keyId
+            );
+        }
         await this.setAccessTokenCredential(
             credential,
             correlationId,
@@ -1100,9 +1108,42 @@ export abstract class CacheManager implements ICacheManager {
      * @param correlationId
      */
     removeAccessToken(key: string, correlationId: string): void {
+        const credential = this.removeAccessTokenCredential(key, correlationId);
+        if (credential) {
+            void this.removeTokenBindingKeyForCredential(
+                credential,
+                correlationId
+            );
+        }
+    }
+
+    /**
+     * Removes an access token and waits for any unreferenced token-binding key
+     * cleanup. Internal callers that require deterministic cleanup should use
+     * this method instead of the synchronous public cache contract.
+     */
+    async removeAccessTokenAndTokenBindingKey(
+        key: string,
+        correlationId: string,
+        preservedKeyId?: string
+    ): Promise<void> {
+        const credential = this.removeAccessTokenCredential(key, correlationId);
+        if (credential) {
+            await this.removeTokenBindingKeyForCredential(
+                credential,
+                correlationId,
+                preservedKeyId
+            );
+        }
+    }
+
+    private removeAccessTokenCredential(
+        key: string,
+        correlationId: string
+    ): AccessTokenEntity | null {
         const credential = this.getAccessTokenCredential(key, correlationId);
         if (!credential) {
-            return;
+            return null;
         }
 
         this.removeItem(key, correlationId);
@@ -1110,7 +1151,14 @@ export abstract class CacheManager implements ICacheManager {
             { accessTokensRemoved: 1 },
             correlationId
         );
+        return credential;
+    }
 
+    private async removeTokenBindingKeyForCredential(
+        credential: AccessTokenEntity,
+        correlationId: string,
+        preservedKeyId?: string
+    ): Promise<void> {
         // Remove Token Binding Key from key store for token-bound access token credentials
         if (
             credential.credentialType.toLowerCase() ===
@@ -1124,19 +1172,26 @@ export abstract class CacheManager implements ICacheManager {
                         credential as AccessTokenEntity;
                     const kid = accessTokenWithAuthSchemeEntity.keyId;
 
-                    if (kid) {
-                        void this.tokenBindingKeyManager
-                            .removeTokenBindingKey(kid, correlationId)
-                            .catch(() => {
-                                this.commonLogger.error(
-                                    "Failed to remove token binding key",
-                                    correlationId
-                                );
-                                this.performanceClient?.incrementFields(
-                                    { removeTokenBindingKeyFailure: 1 },
-                                    correlationId
-                                );
-                            });
+                    if (
+                        kid &&
+                        kid !== preservedKeyId &&
+                        !this.isTokenBindingKeyReferenced(kid, correlationId)
+                    ) {
+                        try {
+                            await this.tokenBindingKeyManager.removeTokenBindingKey(
+                                kid,
+                                correlationId
+                            );
+                        } catch {
+                            this.commonLogger.error(
+                                "Failed to remove token binding key",
+                                correlationId
+                            );
+                            this.performanceClient?.incrementFields(
+                                { removeTokenBindingKeyFailure: 1 },
+                                correlationId
+                            );
+                        }
                     }
                     break;
                 }
@@ -1144,6 +1199,19 @@ export abstract class CacheManager implements ICacheManager {
         }
     }
 
+    private isTokenBindingKeyReferenced(
+        keyId: string,
+        correlationId: string
+    ): boolean {
+        return this.getTokenKeys().accessToken.some((accessTokenKey) => {
+            const accessToken = this.getAccessTokenCredential(
+                accessTokenKey,
+                correlationId
+            );
+            return accessToken?.keyId === keyId;
+        });
+    }
+
     /**
      * Removes all app metadata objects from cache.
      */
@@ -1358,6 +1426,7 @@ export abstract class CacheManager implements ICacheManager {
         const authScheme =
             request.authenticationScheme ||
             Constants.AuthenticationScheme.BEARER;
+        const normalizedAuthScheme = authScheme.toLowerCase();
         /*
          * Distinguish between Bearer and PoP/SSH token cache types
          * Cast to lowercase to handle "bearer" from ADFS
@@ -1388,6 +1457,9 @@ export abstract class CacheManager implements ICacheManager {
             keyId:
                 authScheme === Constants.AuthenticationScheme.SSH
                     ? request.sshKid
+                    : normalizedAuthScheme ===
+                      Constants.AuthenticationScheme.DPOP.toLowerCase()
+                    ? request.popKid || request.dpopJkt
                     : undefined,
             additionalCacheKeyComponents: additionalCacheKeyComponents,
         };

package/src/client/AuthorizationCodeClient.ts

@@ -597,6 +597,10 @@ export class AuthorizationCodeClient {
             );
         }
 
+        if (request.popupOriginCheckDone) {
+            RequestParameterBuilder.addPopupOriginCheckDone(parameters);
+        }
+
         if (request.extraQueryParameters) {
             RequestParameterBuilder.addExtraParameters(
                 parameters,

package/src/constants/AADServerParamKeys.ts

@@ -70,3 +70,9 @@ export const USERNAME = "username";
 export const USER_ID = "user_id";
 export const FMI_PATH = "fmi_path";
 export const ATTRIBUTE_TOKENS = "attribute_tokens";
+/**
+ * Popup-origin-check-done. Signals to the STS that the client verified the
+ * popup cannot be reached by an untrusted window, so the
+ * Cross-Origin-Opener-Policy response header may be omitted.
+ */
+export const POPUP_ORIGIN_CHECK_DONE = "pocd";

package/src/crypto/DpopProofGenerator.ts

@@ -47,6 +47,20 @@ export type DpopResourceProofParams = {
     nonce?: string;
 };
 
+/**
+ * HTTP resource context used by a DPoP-bound request.
+ * @internal
+ */
+export type DpopResourceRequestContext = {
+    htu: string;
+    htm: string;
+};
+
+/**
+ * Resource request context and access token used to generate a DPoP proof.
+ * Exported for use by MSAL Browser and unsupported for direct consumers.
+ * @internal
+ */
 export type GenerateDpopResourceProofParams = {
     htu?: string;
     htm?: string;
@@ -128,13 +142,26 @@ function validateDpopNonce(
     }
 }
 
+/**
+ * Validates and normalizes the HTTP resource context for a DPoP-bound request.
+ * @internal
+ */
+export function normalizeDpopResourceRequestContext(
+    context: DpopResourceRequestContext,
+    correlationId: string = ""
+): DpopResourceRequestContext {
+    return {
+        htm: normalizeHtm(context.htm, correlationId),
+        htu: normalizeHtu(context.htu, correlationId),
+    };
+}
+
 /**
  * Builds RFC 9449 DPoP proof JWT payloads for token-endpoint and
  * resource-endpoint proof bindings.
  *
- * Not exported from any public package entry point.
- * This helper is internal-only until DPoP is wired into acquisition flows
- * in a subsequent work item.
+ * Exported from package entry points for use by MSAL Browser.
+ * This helper remains an unsupported internal API for direct consumers.
  *
  * DPoP proofs do not contain SHR fields (at, ts, m, u, p, q).
  * @internal
@@ -213,10 +240,14 @@ export class DpopProofGenerator {
         correlationId: string = ""
     ): DpopProofClaims {
         validateDpopNonce(params.nonce, correlationId);
+        const resourceContext = normalizeDpopResourceRequestContext(
+            params,
+            correlationId
+        );
         const claims: DpopProofClaims = {
             jti: this.cryptoUtils.createNewGuid(),
-            htm: normalizeHtm(params.htm, correlationId),
-            htu: normalizeHtu(params.htu, correlationId),
+            htm: resourceContext.htm,
+            htu: resourceContext.htu,
             ath: params.ath,
             iat: TimeUtils.nowSeconds(),
         };

package/src/crypto/ITokenBindingKeyManager.ts

@@ -39,6 +39,17 @@ export interface ITokenBindingKeyManager {
      * @param correlationId - Request correlation identifier.
      */
     removeTokenBindingKey(kid: string, correlationId: string): Promise<void>;
+    /**
+     * Returns whether a token-binding key is available to the current context.
+     */
+    hasTokenBindingKey?(kid: string, correlationId: string): Promise<boolean>;
+    /**
+     * Returns whether a token-binding key is available in persistent storage.
+     */
+    isTokenBindingKeyPersisted?(
+        kid: string,
+        correlationId: string
+    ): Promise<boolean>;
     /**
      * Gets a token-binding public key as a JWK by identifier.
      * @param kid - Token-binding key identifier.

package/src/exports-browser-only.ts

@@ -23,3 +23,8 @@ export { PerformanceClient } from "./telemetry/performance/PerformanceClient.js"
 export { StubPerformanceClient } from "./telemetry/performance/StubPerformanceClient.js";
 
 export { PopTokenGenerator } from "./crypto/PopTokenGenerator.js";
+export {
+    DpopProofGenerator,
+    normalizeDpopResourceRequestContext,
+} from "./crypto/DpopProofGenerator.js";
+export type { DpopResourceRequestContext } from "./crypto/DpopProofGenerator.js";

package/src/network/NetworkResponse.ts

@@ -4,6 +4,9 @@
  */
 
 export type NetworkResponse<T> = {
+    /**
+     * Header names are case-insensitive. Built-in clients return lowercase keys.
+     */
     headers: Record<string, string>;
     body: T;
     status: number;

package/src/network/ResponseHeaders.ts

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+// Track only our normalized copies, never caller-owned mutable inputs.
+const normalizedHeaderRecords = new WeakSet<Record<string, string>>();
+
+/**
+ * Creates a lowercase-keyed snapshot without changing header values or the input.
+ * Reuses snapshots produced by this function to avoid repeated normalization.
+ * @internal
+ */
+export function normalizeResponseHeaders(
+    headers: Record<string, string>
+): Record<string, string> {
+    if (normalizedHeaderRecords.has(headers)) {
+        return headers;
+    }
+
+    const normalized = Object.fromEntries<string>(
+        Object.entries(headers).map(([name, value]): [string, string] => [
+            name.toLowerCase(),
+            value,
+        ])
+    );
+    normalizedHeaderRecords.add(normalized);
+    return normalized;
+}
+
+/**
+ * Reads a response header case-insensitively.
+ * Normalized snapshots are never scanned, even when a header is missing.
+ * @internal
+ */
+export function getResponseHeader(
+    headers: Record<string, string>,
+    name: string
+): string | undefined {
+    const key = name.toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(headers, key)) {
+        return headers[key];
+    }
+    if (normalizedHeaderRecords.has(headers)) {
+        return undefined;
+    }
+
+    const headerName = Object.keys(headers).find(
+        (header) => header.toLowerCase() === key
+    );
+    return headerName === undefined ? undefined : headers[headerName];
+}

package/src/network/ThrottlingUtils.ts

@@ -14,6 +14,7 @@ import {
 } from "./RequestThumbprint.js";
 import { ThrottlingEntity } from "../cache/entities/ThrottlingEntity.js";
 import { BaseAuthRequest } from "../request/BaseAuthRequest.js";
+import { getResponseHeader } from "./ResponseHeaders.js";
 
 /** @internal */
 export class ThrottlingUtils {
@@ -56,7 +57,7 @@ export class ThrottlingUtils {
      * Performs necessary throttling checks after a network request.
      * @param cacheManager
      * @param thumbprint
-     * @param response
+     * @param response - Token response with case-insensitive header names.
      */
     static postProcess(
         cacheManager: CacheManager,
@@ -64,15 +65,14 @@ export class ThrottlingUtils {
         response: NetworkResponse<ServerAuthorizationTokenResponse>,
         correlationId: string
     ): void {
+        const retryAfter = getRetryAfterHeader(response);
         if (
             ThrottlingUtils.checkResponseStatus(response) ||
-            ThrottlingUtils.checkResponseForRetryAfter(response)
+            retryAfter !== undefined
         ) {
             const thumbprintValue: ThrottlingEntity = {
                 throttleTime: ThrottlingUtils.calculateThrottleTime(
-                    parseInt(
-                        response.headers[Constants.HeaderNames.RETRY_AFTER]
-                    )
+                    parseInt(retryAfter || "")
                 ),
                 error: response.body.error,
                 errorCodes: response.body.error_codes,
@@ -102,20 +102,12 @@ export class ThrottlingUtils {
 
     /**
      * Checks a NetworkResponse object's RetryAfter header
-     * @param response
+     * @param response - Token response with case-insensitive header names.
      */
     static checkResponseForRetryAfter(
         response: NetworkResponse<ServerAuthorizationTokenResponse>
     ): boolean {
-        if (response.headers) {
-            return (
-                response.headers.hasOwnProperty(
-                    Constants.HeaderNames.RETRY_AFTER
-                ) &&
-                (response.status < 200 || response.status >= 300)
-            );
-        }
-        return false;
+        return getRetryAfterHeader(response) !== undefined;
     }
 
     /**
@@ -150,3 +142,16 @@ export class ThrottlingUtils {
         cacheManager.removeItem(key, request.correlationId);
     }
 }
+
+/** Reads Retry-After only for non-success responses. */
+function getRetryAfterHeader(
+    response: NetworkResponse<ServerAuthorizationTokenResponse>
+): string | undefined {
+    if ((response.status < 200 || response.status >= 300) && response.headers) {
+        return getResponseHeader(
+            response.headers,
+            Constants.HeaderNames.RETRY_AFTER
+        );
+    }
+    return undefined;
+}

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-common";
-export const version = "16.14.3";
+export const version = "16.16.0";

package/src/protocol/Authorize.ts

@@ -267,6 +267,10 @@ export function getStandardAuthorizeRequestParameters(
         RequestParameterBuilder.addInstanceAware(parameters);
     }
 
+    if (request.popupOriginCheckDone) {
+        RequestParameterBuilder.addPopupOriginCheckDone(parameters);
+    }
+
     return parameters;
 }
 

package/src/protocol/Token.ts

@@ -23,6 +23,10 @@ import {
     NetworkRequestOptions,
 } from "../network/INetworkModule.js";
 import { NetworkResponse } from "../network/NetworkResponse.js";
+import {
+    getResponseHeader,
+    normalizeResponseHeaders,
+} from "../network/ResponseHeaders.js";
 import { ThrottlingUtils } from "../network/ThrottlingUtils.js";
 import { NetworkError } from "../error/NetworkError.js";
 import { AuthError } from "../error/AuthError.js";
@@ -223,7 +227,10 @@ export async function sendPostRequest<
             performanceClient,
             correlationId
         )(tokenEndpoint, { ...options, correlationId, performanceClient });
-        const responseHeaders = response.headers || {};
+        const responseHeaders = normalizeResponseHeaders(
+            response.headers || {}
+        );
+        response = { ...response, headers: responseHeaders };
         performanceClient?.addFields(
             {
                 refreshTokenSize: response.body.refresh_token?.length || 0,
@@ -235,7 +242,9 @@ export async function sendPostRequest<
         );
     } catch (e) {
         if (e instanceof NetworkError) {
-            const responseHeaders = e.responseHeaders;
+            const responseHeaders = e.responseHeaders
+                ? normalizeResponseHeaders(e.responseHeaders)
+                : undefined;
             if (responseHeaders) {
                 performanceClient?.addFields(
                     {
@@ -245,11 +254,15 @@ export async function sendPostRequest<
                         requestId:
                             responseHeaders[HeaderNames.X_MS_REQUEST_ID] || "",
                         contentTypeHeader:
-                            responseHeaders[HeaderNames.CONTENT_TYPE] ||
-                            undefined,
+                            getResponseHeader(
+                                responseHeaders,
+                                HeaderNames.CONTENT_TYPE
+                            ) || undefined,
                         contentLengthHeader:
-                            responseHeaders[HeaderNames.CONTENT_LENGTH] ||
-                            undefined,
+                            getResponseHeader(
+                                responseHeaders,
+                                HeaderNames.CONTENT_LENGTH
+                            ) || undefined,
                         httpStatus: e.httpStatus,
                     },
                     correlationId

package/src/request/AuthenticationHeaderParser.ts

@@ -8,6 +8,10 @@ import {
     ClientConfigurationErrorCodes,
 } from "../error/ClientConfigurationError.js";
 import { HeaderNames } from "../utils/Constants.js";
+import {
+    getResponseHeader,
+    normalizeResponseHeaders,
+} from "../network/ResponseHeaders.js";
 
 type WWWAuthenticateChallenges = {
     nonce?: string;
@@ -24,8 +28,9 @@ type AuthenticationInfoChallenges = {
 export class AuthenticationHeaderParser {
     private headers: Record<string, string>;
 
+    /** Captures a case-insensitive snapshot of the response headers. */
     constructor(headers: Record<string, string>) {
-        this.headers = headers;
+        this.headers = normalizeResponseHeaders(headers);
     }
 
     /**
@@ -34,7 +39,10 @@ export class AuthenticationHeaderParser {
      */
     getShrNonce(): string {
         // Attempt to parse nonce from Authentiacation-Info
-        const authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+        const authenticationInfo = getResponseHeader(
+            this.headers,
+            HeaderNames.AuthenticationInfo
+        );
         if (authenticationInfo) {
             const authenticationInfoChallenges =
                 this.parseChallenges<AuthenticationInfoChallenges>(
@@ -50,7 +58,10 @@ export class AuthenticationHeaderParser {
         }
 
         // Attempt to parse nonce from WWW-Authenticate
-        const wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+        const wwwAuthenticate = getResponseHeader(
+            this.headers,
+            HeaderNames.WWWAuthenticate
+        );
         if (wwwAuthenticate) {
             const wwwAuthenticateChallenges =
                 this.parseChallenges<WWWAuthenticateChallenges>(

package/src/request/CommonAuthorizationUrlRequest.ts

@@ -78,4 +78,12 @@ export type CommonAuthorizationUrlRequest = BaseAuthRequest & {
      * @internal
      */
     reqCnf?: string;
+    /**
+     * Adds `pocd=1`, signalling that no untrusted window can reach the window
+     * driving this request. msal-browser computes this for every authorize
+     * request; a flow sets it explicitly only to assert a value the current
+     * window cannot be measured for, such as the popup-relay topology.
+     * @internal
+     */
+    popupOriginCheckDone?: boolean;
 };

package/src/request/CommonEndSessionRequest.ts

@@ -38,4 +38,12 @@ export type CommonEndSessionRequest = {
      * String to string map of custom query parameters added to the /authorize call
      */
     extraQueryParameters?: StringDict;
+    /**
+     * Adds `pocd=1`, signalling that no untrusted window can reach the window
+     * driving this request. msal-browser computes this for every end-session
+     * request; a flow sets it explicitly only to assert a value the current
+     * window cannot be measured for, such as the popup-relay topology.
+     * @internal
+     */
+    popupOriginCheckDone?: boolean;
 };

package/src/request/RequestParameterBuilder.ts

@@ -474,6 +474,21 @@ export function addInstanceAware(parameters: Map<string, string>): void {
     }
 }
 
+/**
+ * Adds `pocd=1`, telling the STS that the client verified the popup driving
+ * this request cannot be reached by an untrusted window, so the
+ * Cross-Origin-Opener-Policy response header may be omitted.
+ *
+ * Only ever added when the check passed — a negative result is signalled by
+ * omitting the parameter, which keeps the STS default (apply COOP) and stays
+ * compatible with library versions that never send it.
+ */
+export function addPopupOriginCheckDone(parameters: Map<string, string>): void {
+    if (!parameters.has(AADServerParamKeys.POPUP_ORIGIN_CHECK_DONE)) {
+        parameters.set(AADServerParamKeys.POPUP_ORIGIN_CHECK_DONE, "1");
+    }
+}
+
 /**
  * Add extraParameters
  * @param extraParams - String dictionary containing extra parameters to be added.

package/src/telemetry/performance/PerformanceEvent.ts

@@ -372,6 +372,18 @@ export type PerformanceEvent = {
 
     isAsyncPopup?: boolean;
 
+    /**
+     * Whether the auth response was collected via the legacy (non-COOP)
+     * location-polling flow rather than the BroadcastChannel redirect bridge.
+     */
+    usesLegacyPolling?: boolean;
+
+    /**
+     * Timeout, in milliseconds, applied while polling a silent iframe for the
+     * auth response under the legacy polling flow.
+     */
+    iframePollTimeout?: number;
+
     cacheRtExpiresOnSeconds?: number;
     ntwkRtExpiresOnSeconds?: number;
     extRtExpiresOnSeconds?: number;