@azure/msal-common 6.3.0-beta.0 → 7.0.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v6.3.0-beta.0 2022-04-27 */
+/*! @azure/msal-common v7.0.0 2022-06-13 */
 'use strict';
 'use strict';
 
@@ -462,7 +462,12 @@ var CacheOutcome;
     CacheOutcome["NO_CACHED_ACCESS_TOKEN"] = "2";
     CacheOutcome["CACHED_ACCESS_TOKEN_EXPIRED"] = "3";
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
-})(CacheOutcome || (CacheOutcome = {}));
+})(CacheOutcome || (CacheOutcome = {}));
+var JsonTypes;
+(function (JsonTypes) {
+    JsonTypes["Jwt"] = "JWT";
+    JsonTypes["Jwk"] = "JWK";
+})(JsonTypes || (JsonTypes = {}));
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -767,6 +772,10 @@ var ClientAuthErrorMessage = {
     logoutNotSupported: {
         code: "end_session_endpoint_not_supported",
         desc: "Provided authority does not support logout."
+    },
+    keyIdMissing: {
+        code: "key_id_missing",
+        desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key."
     }
 };
 /**
@@ -1036,6 +1045,12 @@ var ClientAuthError = /** @class */ (function (_super) {
     ClientAuthError.createLogoutNotSupportedError = function () {
         return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
     };
+    /**
+     * Create an error when kid attribute is missing from a PoP token's cache record
+     */
+    ClientAuthError.createKeyIdMissingError = function () {
+        return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
+    };
     return ClientAuthError;
 }(AuthError));
 
@@ -1342,7 +1357,7 @@ var Logger = /** @class */ (function () {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-common";
-var version = "6.3.0-beta.0";
+var version = "7.0.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1385,9 +1400,9 @@ exports.AzureCloudInstance = void 0;
  *      familyId: Family ID identifier, usually only used for refresh tokens
  *      realm: Full tenant or organizational identifier that the account belongs to
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
- *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
  *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
+ *      userAssertionHash: Matches the SHA 256 hash of the obo_assertion for the OBO flow
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -2028,7 +2043,6 @@ exports.AuthorityType = void 0;
  *      clientInfo: Full base64 encoded client info received from ESTS
  *      lastModificationTime: last time this entity was modified in the cache
  *      lastModificationApp:
- *      oboAssertion: access token passed in as part of OBO request
  *      idTokenClaims: Object containing claims parsed from ID token
  *      nativeAccountId: Account identifier on the native device
  * }
@@ -2107,7 +2121,7 @@ var AccountEntity = /** @class */ (function () {
      * @param idToken
      * @param policy
      */
-    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
+    AccountEntity.createAccount = function (clientInfo, homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment, nativeAccountId) {
         var _a, _b, _c, _d, _e, _f;
         var account = new AccountEntity();
         account.authorityType = exports.CacheAccountType.MSSTS_ACCOUNT_TYPE;
@@ -2121,7 +2135,6 @@ var AccountEntity = /** @class */ (function () {
         account.environment = env;
         // non AAD scenarios can have empty realm
         account.realm = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.tid) || Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         if (idToken) {
             account.idTokenClaims = idToken.claims;
             // How do you account for MSA CID here?
@@ -2142,14 +2155,13 @@ var AccountEntity = /** @class */ (function () {
      * @param authority
      * @param idToken
      */
-    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, oboAssertion, cloudGraphHostName, msGraphHost, environment) {
+    AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
         var _a, _b, _c, _d;
         var account = new AccountEntity();
         account.authorityType = (authority && authority.authorityType === exports.AuthorityType.Adfs) ? exports.CacheAccountType.ADFS_ACCOUNT_TYPE : exports.CacheAccountType.GENERIC_ACCOUNT_TYPE;
         account.homeAccountId = homeAccountId;
         // non AAD scenarios can have empty realm
         account.realm = Constants.EMPTY_STRING;
-        account.oboAssertion = oboAssertion;
         var env = environment || authority && authority.getPreferredCache();
         if (!env) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -2438,7 +2450,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.userAssertionHash, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2448,10 +2460,10 @@ var CacheManager = /** @class */ (function () {
      * @param clientId
      * @param realm
      * @param target
-     * @param oboAssertion
+     * @param userAssertionHash
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, userAssertionHash, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2470,7 +2482,7 @@ var CacheManager = /** @class */ (function () {
             if (!entity) {
                 return;
             }
-            if (!!oboAssertion && !_this.matchOboAssertion(entity, oboAssertion)) {
+            if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                 return;
             }
             if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
@@ -2801,7 +2813,7 @@ var CacheManager = /** @class */ (function () {
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
             keyId: request.sshKid,
-            requestedClaimsHash: request.requestedClaimsHash
+            requestedClaimsHash: request.requestedClaimsHash,
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2827,7 +2839,7 @@ var CacheManager = /** @class */ (function () {
             environment: account.environment,
             credentialType: exports.CredentialType.REFRESH_TOKEN,
             clientId: clientId,
-            familyId: id
+            familyId: id,
         };
         var credentialCache = this.getCredentialsFilteredBy(refreshTokenFilter);
         var refreshTokens = Object.keys(credentialCache.refreshTokens).map(function (key) { return credentialCache.refreshTokens[key]; });
@@ -2879,8 +2891,8 @@ var CacheManager = /** @class */ (function () {
      * @param value
      * @param oboAssertion
      */
-    CacheManager.prototype.matchOboAssertion = function (entity, oboAssertion) {
-        return !!(entity.oboAssertion && oboAssertion === entity.oboAssertion);
+    CacheManager.prototype.matchUserAssertionHash = function (entity, userAssertionHash) {
+        return !!(entity.userAssertionHash && userAssertionHash === entity.userAssertionHash);
     };
     /**
      * helper to match environment
@@ -3781,14 +3793,18 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param clientAssertion
      */
     RequestParameterBuilder.prototype.addClientAssertion = function (clientAssertion) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        if (!StringUtils.isEmpty(clientAssertion)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION, encodeURIComponent(clientAssertion));
+        }
     };
     /**
      * add clientAssertionType for confidential client flows
      * @param clientAssertionType
      */
     RequestParameterBuilder.prototype.addClientAssertionType = function (clientAssertionType) {
-        this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        if (!StringUtils.isEmpty(clientAssertionType)) {
+            this.parameters.set(AADServerParamKeys.CLIENT_ASSERTION_TYPE, encodeURIComponent(clientAssertionType));
+        }
     };
     /**
      * add OBO assertion for confidential client flows
@@ -3860,14 +3876,14 @@ var RequestParameterBuilder = /** @class */ (function () {
      * @param username
      */
     RequestParameterBuilder.prototype.addUsername = function (username) {
-        this.parameters.set(PasswordGrantConstants.username, username);
+        this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
     };
     /**
      * adds `password` for Password Grant flow
      * @param password
      */
     RequestParameterBuilder.prototype.addPassword = function (password) {
-        this.parameters.set(PasswordGrantConstants.password, password);
+        this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
     };
     /**
      * add pop_jwk to query params
@@ -3954,7 +3970,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId, oboAssertion) {
+    IdTokenEntity.createIdTokenEntity = function (homeAccountId, environment, idToken, clientId, tenantId) {
         var idTokenEntity = new IdTokenEntity();
         idTokenEntity.credentialType = exports.CredentialType.ID_TOKEN;
         idTokenEntity.homeAccountId = homeAccountId;
@@ -3962,7 +3978,6 @@ var IdTokenEntity = /** @class */ (function (_super) {
         idTokenEntity.clientId = clientId;
         idTokenEntity.secret = idToken;
         idTokenEntity.realm = tenantId;
-        idTokenEntity.oboAssertion = oboAssertion;
         return idTokenEntity;
     };
     /**
@@ -4077,7 +4092,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, userAssertionHash, keyId, requestedClaims, requestedClaimsHash) {
         var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
@@ -4098,7 +4113,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.clientId = clientId;
         atEntity.realm = tenantId;
         atEntity.target = scopes;
-        atEntity.oboAssertion = oboAssertion;
+        atEntity.userAssertionHash = userAssertionHash;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
         if (requestedClaims) {
             atEntity.requestedClaims = requestedClaims;
@@ -4180,14 +4195,14 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
      * @param clientId
      * @param authority
      */
-    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, oboAssertion) {
+    RefreshTokenEntity.createRefreshTokenEntity = function (homeAccountId, environment, refreshToken, clientId, familyId, userAssertionHash) {
         var rtEntity = new RefreshTokenEntity();
         rtEntity.clientId = clientId;
         rtEntity.credentialType = exports.CredentialType.REFRESH_TOKEN;
         rtEntity.environment = environment;
         rtEntity.homeAccountId = homeAccountId;
         rtEntity.secret = refreshToken;
-        rtEntity.oboAssertion = oboAssertion;
+        rtEntity.userAssertionHash = userAssertionHash;
         if (familyId)
             rtEntity.familyId = familyId;
         return rtEntity;
@@ -4570,34 +4585,30 @@ var PopTokenGenerator = /** @class */ (function () {
     }
     /**
      * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+     * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
      * @param request
      * @returns
      */
     PopTokenGenerator.prototype.generateCnf = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var reqCnf;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var reqCnf, reqCnfString, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0: return [4 /*yield*/, this.generateKid(request)];
                     case 1:
-                        reqCnf = _a.sent();
-                        return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                        reqCnf = _b.sent();
+                        reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+                        _a = {
+                            kid: reqCnf.kid,
+                            reqCnfString: reqCnfString
+                        };
+                        return [4 /*yield*/, this.cryptoUtils.hashString(reqCnfString)];
+                    case 2: return [2 /*return*/, (_a.reqCnfHash = _b.sent(),
+                            _a)];
                 }
             });
         });
     };
-    /**
-     * Generates the hash of the req_cnf
-     * @param cnf
-     * @returns
-     */
-    PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
-        return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
-            });
-        });
-    };
     /**
      * Generates key_id for a SHR token request
      * @param request
@@ -4625,16 +4636,10 @@ var PopTokenGenerator = /** @class */ (function () {
      * @param request
      * @returns
      */
-    PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
-        var _a;
+    PopTokenGenerator.prototype.signPopToken = function (accessToken, keyId, request) {
         return __awaiter(this, void 0, void 0, function () {
-            var tokenClaims;
-            return __generator(this, function (_b) {
-                tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
-                if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                    throw ClientAuthError.createTokenClaimsRequiredError();
-                }
-                return [2 /*return*/, this.signPayload(accessToken, tokenClaims.cnf.kid, request)];
+            return __generator(this, function (_a) {
+                return [2 /*return*/, this.signPayload(accessToken, keyId, request)];
             });
         });
     };
@@ -4646,7 +4651,7 @@ var PopTokenGenerator = /** @class */ (function () {
      * @param claims
      * @returns
      */
-    PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
+    PopTokenGenerator.prototype.signPayload = function (payload, keyId, request, claims) {
         return __awaiter(this, void 0, void 0, function () {
             var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
             return __generator(this, function (_a) {
@@ -4655,7 +4660,7 @@ var PopTokenGenerator = /** @class */ (function () {
                         resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                         resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                         resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
+                        return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), keyId, request.correlationId)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });
@@ -4826,7 +4831,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param serverTokenResponse
      * @param authority
      */
-    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, oboAssertion, handlingRefreshTokenResponse) {
+    ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse) {
         return __awaiter(this, void 0, void 0, function () {
             var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
             return __generator(this, function (_a) {
@@ -4848,7 +4853,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4896,7 +4901,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, userAssertionHash, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4905,8 +4910,8 @@ var ResponseHandler = /** @class */ (function () {
         var cachedIdToken;
         var cachedAccount;
         if (!StringUtils.isEmpty(serverTokenResponse.id_token) && !!idTokenObj) {
-            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING, oboAssertion);
-            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, oboAssertion, authCodePayload);
+            cachedIdToken = IdTokenEntity.createIdTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.id_token || Constants.EMPTY_STRING, this.clientId, idTokenObj.claims.tid || Constants.EMPTY_STRING);
+            cachedAccount = this.generateAccountEntity(serverTokenResponse, idTokenObj, authority, authCodePayload);
         }
         // AccessToken
         var cachedAccessToken = null;
@@ -4924,12 +4929,12 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, userAssertionHash, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.refresh_token)) {
-            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, oboAssertion);
+            cachedRefreshToken = RefreshTokenEntity.createRefreshTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.refresh_token || Constants.EMPTY_STRING, this.clientId, serverTokenResponse.foci, userAssertionHash);
         }
         // appMetadata
         var cachedAppMetadata = null;
@@ -4944,22 +4949,22 @@ var ResponseHandler = /** @class */ (function () {
      * @param idToken
      * @param authority
      */
-    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateAccountEntity = function (serverTokenResponse, idToken, authority, authCodePayload) {
         var authorityType = authority.authorityType;
         var cloudGraphHostName = authCodePayload ? authCodePayload.cloud_graph_host_name : Constants.EMPTY_STRING;
         var msGraphhost = authCodePayload ? authCodePayload.msgraph_host : Constants.EMPTY_STRING;
         // ADFS does not require client_info in the response
         if (authorityType === exports.AuthorityType.Adfs) {
             this.logger.verbose("Authority type is ADFS, creating ADFS account");
-            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            return AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
         }
         // This fallback applies to B2C as well as they fall under an AAD account type.
         if (StringUtils.isEmpty(serverTokenResponse.client_info) && authority.protocolMode === "AAD") {
             throw ClientAuthError.createClientInfoEmptyError();
         }
         return serverTokenResponse.client_info ?
-            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost) :
-            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, oboAssertion, cloudGraphHostName, msGraphhost);
+            AccountEntity.createAccount(serverTokenResponse.client_info, this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost) :
+            AccountEntity.createGenericAccount(this.homeAccountIdentifier, idToken, authority, cloudGraphHostName, msGraphhost);
     };
     /**
      * Creates an @AuthenticationResult from @CacheRecord , @IdToken , and a boolean that states whether or not the result is from cache.
@@ -4974,9 +4979,9 @@ var ResponseHandler = /** @class */ (function () {
     ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function () {
-            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
-            return __generator(this, function (_d) {
-                switch (_d.label) {
+            var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         accessToken = Constants.EMPTY_STRING;
                         responseScopes = [];
@@ -4985,18 +4990,22 @@ var ResponseHandler = /** @class */ (function () {
                         if (!cacheRecord.accessToken) return [3 /*break*/, 4];
                         if (!(cacheRecord.accessToken.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(cryptoObj);
-                        return [4 /*yield*/, popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request)];
+                        _d = cacheRecord.accessToken, secret = _d.secret, keyId = _d.keyId;
+                        if (!keyId) {
+                            throw ClientAuthError.createKeyIdMissingError();
+                        }
+                        return [4 /*yield*/, popTokenGenerator.signPopToken(secret, keyId, request)];
                     case 1:
-                        accessToken = _d.sent();
+                        accessToken = _e.sent();
                         return [3 /*break*/, 3];
                     case 2:
                         accessToken = cacheRecord.accessToken.secret;
-                        _d.label = 3;
+                        _e.label = 3;
                     case 3:
                         responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
                         expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
                         extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
-                        _d.label = 4;
+                        _e.label = 4;
                     case 4:
                         if (cacheRecord.appMetadata) {
                             familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
@@ -5196,7 +5205,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
+            var parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, correlationId, ccsCred, clientInfo, clientInfo;
             var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
@@ -5244,8 +5253,9 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _b.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _b.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5316,7 +5326,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
      */
     AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+            var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5408,20 +5418,17 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                         if (request.extraQueryParameters) {
                             parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
                         }
-                        if (!request.nativeBroker) return [3 /*break*/, 3];
+                        if (!request.nativeBroker) return [3 /*break*/, 2];
                         // signal ests that this is a WAM call
                         parameterBuilder.addNativeBroker();
-                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                        if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnf = _a.sent();
-                        return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
-                    case 2:
-                        cnfHash = _a.sent();
-                        parameterBuilder.addPopToken(cnfHash);
-                        _a.label = 3;
-                    case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
+                        reqCnfData = _a.sent();
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                        _a.label = 2;
+                    case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                 }
             });
         });
@@ -5818,7 +5825,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
      */
     RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+            var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -5848,8 +5855,9 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                         popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                         return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                     case 1:
-                        cnfString = _a.sent();
-                        parameterBuilder.addPopToken(cnfString);
+                        reqCnfData = _a.sent();
+                        // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                        parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                         return [3 /*break*/, 3];
                     case 2:
                         if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -6038,8 +6046,9 @@ var ClientCredentialClient = /** @class */ (function (_super) {
         if (this.config.clientCredentials.clientSecret) {
             parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
         }
-        if (this.config.clientCredentials.clientAssertion) {
-            var clientAssertion = this.config.clientCredentials.clientAssertion;
+        // Use clientAssertion from request, fallback to client assertion in base configuration
+        var clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+        if (clientAssertion) {
             parameterBuilder.addClientAssertion(clientAssertion.assertion);
             parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
         }
@@ -6069,44 +6078,64 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
      */
     OnBehalfOfClient.prototype.acquireToken = function (request) {
         return __awaiter(this, void 0, void 0, function () {
-            var cachedAuthenticationResult;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
                     case 0:
                         this.scopeSet = new ScopeSet(request.scopes || []);
-                        if (!request.skipCache) return [3 /*break*/, 2];
-                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 1: return [2 /*return*/, _a.sent()];
-                    case 2: return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a = this;
+                        return [4 /*yield*/, this.cryptoUtils.hashString(request.oboAssertion)];
+                    case 1:
+                        // generate the user_assertion_hash for OBOAssertion
+                        _a.userAssertionHash = _b.sent();
+                        if (!request.skipCache) return [3 /*break*/, 3];
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 2: return [2 /*return*/, _b.sent()];
                     case 3:
-                        cachedAuthenticationResult = _a.sent();
-                        if (!cachedAuthenticationResult) return [3 /*break*/, 4];
-                        return [2 /*return*/, cachedAuthenticationResult];
-                    case 4: return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
-                    case 5: return [2 /*return*/, _a.sent()];
+                        _b.trys.push([3, 5, , 7]);
+                        return [4 /*yield*/, this.getCachedAuthenticationResult(request)];
+                    case 4: return [2 /*return*/, _b.sent()];
+                    case 5:
+                        _b.sent();
+                        return [4 /*yield*/, this.executeTokenRequest(request, this.authority, this.userAssertionHash)];
+                    case 6: 
+                    // Any failure falls back to interactive request, once we implement distributed cache, we plan to handle `createRefreshRequiredError` to refresh using the RT
+                    return [2 /*return*/, _b.sent()];
+                    case 7: return [2 /*return*/];
                 }
             });
         });
     };
     /**
      * look up cache for tokens
+     * Find idtoken in the cache
+     * Find accessToken based on user assertion and account info in the cache
+     * Please note we are not yet supported OBO tokens refreshed with long lived RT. User will have to send a new assertion if the current access token expires
+     * This is to prevent security issues when the assertion changes over time, however, longlived RT helps retaining the session
      * @param request
      */
     OnBehalfOfClient.prototype.getCachedAuthenticationResult = function (request) {
-        var _a;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function () {
             var cachedAccessToken, cachedIdToken, idTokenObject, cachedAccount, localAccountId, accountInfo;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0:
-                        cachedAccessToken = this.readAccessTokenFromCache();
-                        if (!cachedAccessToken ||
-                            TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
-                            // Update the server telemetry outcome
-                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(!cachedAccessToken ? CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED : CacheOutcome.NO_CACHED_ACCESS_TOKEN);
-                            return [2 /*return*/, null];
+                        cachedAccessToken = this.readAccessTokenFromCacheForOBO(this.config.authOptions.clientId, request);
+                        if (!cachedAccessToken) {
+                            // Must refresh due to non-existent access_token.
+                            (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                            this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
+                            throw ClientAuthError.createRefreshRequiredError();
+                        }
+                        else if (TimeUtils.isTokenExpired(cachedAccessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
+                            // Access token expired, will need to renewed
+                            (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                            this.logger.info("OnbehalfofFlow:getCachedAuthenticationResult - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
+                            throw ClientAuthError.createRefreshRequiredError();
                         }
-                        cachedIdToken = this.readIdTokenFromCache(request);
+                        cachedIdToken = this.readIdTokenFromCacheForOBO(request, cachedAccessToken.homeAccountId);
                         cachedAccount = null;
                         if (cachedIdToken) {
                             idTokenObject = new AuthToken(cachedIdToken.secret, this.config.cryptoInterface);
@@ -6118,7 +6147,11 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 username: Constants.EMPTY_STRING,
                                 localAccountId: localAccountId || Constants.EMPTY_STRING
                             };
-                            cachedAccount = this.readAccountFromCache(accountInfo);
+                            cachedAccount = this.cacheManager.readAccountFromCache(accountInfo);
+                        }
+                        // increment telemetry cache hit counter
+                        if (this.config.serverTelemetryManager) {
+                            this.config.serverTelemetryManager.incrementCacheHits();
                         }
                         return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, {
                                 account: cachedAccount,
@@ -6127,45 +6160,23 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                                 refreshToken: null,
                                 appMetadata: null
                             }, true, request, idTokenObject)];
-                    case 1: return [2 /*return*/, _b.sent()];
+                    case 1: return [2 /*return*/, _c.sent()];
                 }
             });
         });
     };
     /**
-     * read access token from cache TODO: CacheManager API should be used here
+     * read idtoken from cache, this is a specific implementation for OBO as the requirements differ from a generic lookup in the cacheManager
+     * Certain use cases of OBO flow do not expect an idToken in the cache/or from the service
      * @param request
      */
-    OnBehalfOfClient.prototype.readAccessTokenFromCache = function () {
-        var accessTokenFilter = {
-            environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
-            credentialType: exports.CredentialType.ACCESS_TOKEN,
-            clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            target: this.scopeSet.printScopesLowerCase(),
-        };
-        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
-        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
-        var numAccessTokens = accessTokens.length;
-        if (numAccessTokens < 1) {
-            return null;
-        }
-        else if (numAccessTokens > 1) {
-            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
-        }
-        return accessTokens[0];
-    };
-    /**
-     * read idtoken from cache TODO: CacheManager API should be used here instead
-     * @param request
-     */
-    OnBehalfOfClient.prototype.readIdTokenFromCache = function (request) {
+    OnBehalfOfClient.prototype.readIdTokenFromCacheForOBO = function (request, atHomeAccountId) {
         var idTokenFilter = {
+            homeAccountId: atHomeAccountId,
             environment: this.authority.canonicalAuthorityUrlComponents.HostNameAndPort,
             credentialType: exports.CredentialType.ID_TOKEN,
             clientId: this.config.authOptions.clientId,
-            realm: this.authority.tenant,
-            oboAssertion: request.oboAssertion
+            realm: this.authority.tenant
         };
         var credentialCache = this.cacheManager.getCredentialsFilteredBy(idTokenFilter);
         var idTokens = Object.keys(credentialCache.idTokens).map(function (key) { return credentialCache.idTokens[key]; });
@@ -6176,18 +6187,44 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
         return idTokens[0];
     };
     /**
-     * read account from cache, TODO: CacheManager API should be used here instead
-     * @param account
+     * Fetches the cached access token based on incoming assertion
+     * @param clientId
+     * @param request
+     * @param userAssertionHash
      */
-    OnBehalfOfClient.prototype.readAccountFromCache = function (account) {
-        return this.cacheManager.readAccountFromCache(account);
+    OnBehalfOfClient.prototype.readAccessTokenFromCacheForOBO = function (clientId, request) {
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? exports.CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : exports.CredentialType.ACCESS_TOKEN;
+        var accessTokenFilter = {
+            credentialType: credentialType,
+            clientId: clientId,
+            target: this.scopeSet.printScopesLowerCase(),
+            tokenType: authScheme,
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash,
+            userAssertionHash: this.userAssertionHash
+        };
+        var credentialCache = this.cacheManager.getCredentialsFilteredBy(accessTokenFilter);
+        var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
+        var numAccessTokens = accessTokens.length;
+        if (numAccessTokens < 1) {
+            return null;
+        }
+        else if (numAccessTokens > 1) {
+            throw ClientAuthError.createMultipleMatchingTokensInCacheError();
+        }
+        return accessTokens[0];
     };
     /**
      * Make a network call to the server requesting credentials
      * @param request
      * @param authority
      */
-    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority) {
+    OnBehalfOfClient.prototype.executeTokenRequest = function (request, authority, userAssertionHash) {
         return __awaiter(this, void 0, void 0, function () {
             var requestBody, headers, thumbprint, reqTimestamp, response, responseHandler, tokenResponse;
             return __generator(this, function (_a) {
@@ -6212,7 +6249,7 @@ var OnBehalfOfClient = /** @class */ (function (_super) {
                         response = _a.sent();
                         responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                         responseHandler.validateTokenResponse(response.body);
-                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request)];
+                        return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, userAssertionHash)];
                     case 2:
                         tokenResponse = _a.sent();
                         return [2 /*return*/, tokenResponse];
@@ -7416,6 +7453,87 @@ var StubbedNetworkModule = {
     }
 };
 
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+ */
+var JoseHeaderErrorMessage = {
+    missingKidError: {
+        code: "missing_kid_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided."
+    },
+    missingAlgError: {
+        code: "missing_alg_error",
+        desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."
+    },
+};
+/**
+ * Error thrown when there is an error in the client code running on the browser.
+ */
+var JoseHeaderError = /** @class */ (function (_super) {
+    __extends(JoseHeaderError, _super);
+    function JoseHeaderError(errorCode, errorMessage) {
+        var _this = _super.call(this, errorCode, errorMessage) || this;
+        _this.name = "JoseHeaderError";
+        Object.setPrototypeOf(_this, JoseHeaderError.prototype);
+        return _this;
+    }
+    /**
+     * Creates an error thrown when keyId isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingKidError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingKidError.code, JoseHeaderErrorMessage.missingKidError.desc);
+    };
+    /**
+     * Creates an error thrown when algorithm isn't set on JOSE header.
+     */
+    JoseHeaderError.createMissingAlgError = function () {
+        return new JoseHeaderError(JoseHeaderErrorMessage.missingAlgError.code, JoseHeaderErrorMessage.missingAlgError.desc);
+    };
+    return JoseHeaderError;
+}(AuthError));
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+var JoseHeader = /** @class */ (function () {
+    function JoseHeader(options) {
+        this.typ = options.typ;
+        this.alg = options.alg;
+        this.kid = options.kid;
+    }
+    /**
+     * Builds SignedHttpRequest formatted JOSE Header from the
+     * JOSE Header options provided or previously set on the object and returns
+     * the stringified header object.
+     * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+     * @param shrHeaderOptions
+     * @returns
+     */
+    JoseHeader.getShrHeaderString = function (shrHeaderOptions) {
+        // KeyID is required on the SHR header
+        if (!shrHeaderOptions.kid) {
+            throw JoseHeaderError.createMissingKidError();
+        }
+        // Alg is required on the SHR header
+        if (!shrHeaderOptions.alg) {
+            throw JoseHeaderError.createMissingAlgError();
+        }
+        var shrHeader = new JoseHeader({
+            // Access Token PoP headers must have type JWT, but the type header can be overriden for special cases
+            typ: shrHeaderOptions.typ || JsonTypes.Jwt,
+            kid: shrHeaderOptions.kid,
+            alg: shrHeaderOptions.alg
+        });
+        return JSON.stringify(shrHeader);
+    };
+    return JoseHeader;
+}());
+
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -8054,6 +8172,7 @@ exports.IdToken = AuthToken;
 exports.IdTokenEntity = IdTokenEntity;
 exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
 exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
+exports.JoseHeader = JoseHeader;
 exports.Logger = Logger;
 exports.NetworkManager = NetworkManager;
 exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;