@auth0/auth0-spa-js 1.17.1 → 1.18.0

package/README.md

@@ -31,7 +31,7 @@ Auth0 SDK for Single Page Applications using [Authorization Code Grant Flow with
 From the CDN:
 
 ```html
-<script src="https://cdn.auth0.com/js/auth0-spa-js/1.17/auth0-spa-js.production.js"></script>
+<script src="https://cdn.auth0.com/js/auth0-spa-js/1.18/auth0-spa-js.production.js"></script>
 ```
 
 Using [npm](https://npmjs.org):

package/dist/auth0-spa-js.development.js

@@ -310,7 +310,7 @@
     (module.exports = function (key, value) {
       return sharedStore[key] || (sharedStore[key] = value !== undefined ? value : {});
     })('versions', []).push({
-      version: '3.16.1',
+      version: '3.16.3',
       mode: 'global',
       copyright: '© 2021 Denis Pushkarev (zloirock.ru)'
     });
@@ -1060,17 +1060,15 @@
       var iframe = documentCreateElement('iframe');
       var JS = 'java' + SCRIPT + ':';
       var iframeDocument;
-      if (iframe.style) {
-        iframe.style.display = 'none';
-        html.appendChild(iframe);
-        // https://github.com/zloirock/core-js/issues/475
-        iframe.src = String(JS);
-        iframeDocument = iframe.contentWindow.document;
-        iframeDocument.open();
-        iframeDocument.write(scriptTag('document.F=Object'));
-        iframeDocument.close();
-        return iframeDocument.F;
-      }
+      iframe.style.display = 'none';
+      html.appendChild(iframe);
+      // https://github.com/zloirock/core-js/issues/475
+      iframe.src = String(JS);
+      iframeDocument = iframe.contentWindow.document;
+      iframeDocument.open();
+      iframeDocument.write(scriptTag('document.F=Object'));
+      iframeDocument.close();
+      return iframeDocument.F;
     };
 
     // Check for document.domain and active x support
@@ -1083,10 +1081,11 @@
       try {
         activeXDocument = new ActiveXObject('htmlfile');
       } catch (error) { /* ignore */ }
-      NullProtoObject = document.domain && activeXDocument ?
-        NullProtoObjectViaActiveX(activeXDocument) : // old IE
-        NullProtoObjectViaIFrame() ||
-        NullProtoObjectViaActiveX(activeXDocument); // WSH
+      NullProtoObject = typeof document != 'undefined'
+        ? document.domain && activeXDocument
+          ? NullProtoObjectViaActiveX(activeXDocument) // old IE
+          : NullProtoObjectViaIFrame()
+        : NullProtoObjectViaActiveX(activeXDocument); // WSH
       var length = enumBugKeys.length;
       while (length--) delete NullProtoObject[PROTOTYPE$1][enumBugKeys[length]];
       return NullProtoObject();
@@ -3890,7 +3889,7 @@
 
     var Lock = unwrapExports(browserTabsLock);
 
-    var version = '1.17.1';
+    var version = '1.18.0';
 
     /**
      * @ignore
@@ -3961,7 +3960,7 @@
     var GenericError = /** @class */ (function (_super) {
         __extends(GenericError, _super);
         function GenericError(error, error_description) {
-            var _this = _super.call(this, error_description) || this;
+            var _this = _super.call(this, error_description) /* istanbul ignore next */ || this;
             _this.error = error;
             _this.error_description = error_description;
             Object.setPrototypeOf(_this, GenericError.prototype);
@@ -3981,7 +3980,7 @@
         __extends(AuthenticationError, _super);
         function AuthenticationError(error, error_description, state, appState) {
             if (appState === void 0) { appState = null; }
-            var _this = _super.call(this, error, error_description) || this;
+            var _this = _super.call(this, error, error_description) /* istanbul ignore next */ || this;
             _this.state = state;
             _this.appState = appState;
             //https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
@@ -3997,7 +3996,7 @@
     var TimeoutError = /** @class */ (function (_super) {
         __extends(TimeoutError, _super);
         function TimeoutError() {
-            var _this = _super.call(this, 'timeout', 'Timeout') || this;
+            var _this = _super.call(this, 'timeout', 'Timeout') /* istanbul ignore next */ || this;
             //https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
             Object.setPrototypeOf(_this, TimeoutError.prototype);
             return _this;
@@ -4010,7 +4009,7 @@
     var PopupTimeoutError = /** @class */ (function (_super) {
         __extends(PopupTimeoutError, _super);
         function PopupTimeoutError(popup) {
-            var _this = _super.call(this) || this;
+            var _this = _super.call(this) /* istanbul ignore next */ || this;
             _this.popup = popup;
             //https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
             Object.setPrototypeOf(_this, PopupTimeoutError.prototype);
@@ -4021,13 +4020,27 @@
     var PopupCancelledError = /** @class */ (function (_super) {
         __extends(PopupCancelledError, _super);
         function PopupCancelledError(popup) {
-            var _this = _super.call(this, 'cancelled', 'Popup closed') || this;
+            var _this = _super.call(this, 'cancelled', 'Popup closed') /* istanbul ignore next */ || this;
             _this.popup = popup;
             //https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
             Object.setPrototypeOf(_this, PopupCancelledError.prototype);
             return _this;
         }
         return PopupCancelledError;
+    }(GenericError));
+    /**
+     * Error thrown when the token exchange results in a `mfa_required` error
+     */
+    var MfaRequiredError = /** @class */ (function (_super) {
+        __extends(MfaRequiredError, _super);
+        function MfaRequiredError(error, error_description, mfa_token) {
+            var _this = _super.call(this, error, error_description) /* istanbul ignore next */ || this;
+            _this.mfa_token = mfa_token;
+            //https://github.com/Microsoft/TypeScript-wiki/blob/master/Breaking-Changes.md#extending-built-ins-like-error-array-and-map-may-no-longer-work
+            Object.setPrototypeOf(_this, MfaRequiredError.prototype);
+            return _this;
+        }
+        return MfaRequiredError;
     }(GenericError));
 
     var parseQueryResult = function (queryString) {
@@ -4298,7 +4311,7 @@
     };
     function getJSON(url, timeout, audience, scope, options, worker, useFormData) {
         return __awaiter(this, void 0, void 0, function () {
-            var fetchError, response, i, e_1, _a, error, error_description, success, ok, errorMessage;
+            var fetchError, response, i, e_1, _a, error, error_description, data, ok, errorMessage;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
@@ -4333,12 +4346,15 @@
                             fetchError.message = fetchError.message || 'Failed to fetch';
                             throw fetchError;
                         }
-                        _a = response.json, error = _a.error, error_description = _a.error_description, success = __rest(_a, ["error", "error_description"]), ok = response.ok;
+                        _a = response.json, error = _a.error, error_description = _a.error_description, data = __rest(_a, ["error", "error_description"]), ok = response.ok;
                         if (!ok) {
                             errorMessage = error_description || "HTTP error. Unable to fetch " + url;
+                            if (error === 'mfa_required') {
+                                throw new MfaRequiredError(error, errorMessage, data.mfa_token);
+                            }
                             throw new GenericError(error || 'request_error', errorMessage);
                         }
-                        return [2 /*return*/, success];
+                        return [2 /*return*/, data];
                 }
             });
         });
@@ -4483,76 +4499,11 @@
         return InMemoryCache;
     }());
 
-    var CacheKeyManifest = /** @class */ (function () {
-        function CacheKeyManifest(cache, clientId) {
-            this.cache = cache;
-            this.clientId = clientId;
-            this.manifestKey = this.createManifestKeyFrom(clientId);
-        }
-        CacheKeyManifest.prototype.add = function (key) {
-            var _a;
-            return __awaiter(this, void 0, void 0, function () {
-                var keys, _b;
-                return __generator(this, function (_c) {
-                    switch (_c.label) {
-                        case 0:
-                            _b = Set.bind;
-                            return [4 /*yield*/, this.cache.get(this.manifestKey)];
-                        case 1:
-                            keys = new (_b.apply(Set, [void 0, ((_a = (_c.sent())) === null || _a === void 0 ? void 0 : _a.keys) || []]))();
-                            keys.add(key);
-                            return [4 /*yield*/, this.cache.set(this.manifestKey, {
-                                    keys: __spreadArray([], __read(keys))
-                                })];
-                        case 2:
-                            _c.sent();
-                            return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        CacheKeyManifest.prototype.remove = function (key) {
-            return __awaiter(this, void 0, void 0, function () {
-                var entry, keys;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.cache.get(this.manifestKey)];
-                        case 1:
-                            entry = _a.sent();
-                            if (!entry) return [3 /*break*/, 5];
-                            keys = new Set(entry.keys);
-                            keys.delete(key);
-                            if (!(keys.size > 0)) return [3 /*break*/, 3];
-                            return [4 /*yield*/, this.cache.set(this.manifestKey, { keys: __spreadArray([], __read(keys)) })];
-                        case 2: return [2 /*return*/, _a.sent()];
-                        case 3: return [4 /*yield*/, this.cache.remove(this.manifestKey)];
-                        case 4: return [2 /*return*/, _a.sent()];
-                        case 5: return [2 /*return*/];
-                    }
-                });
-            });
-        };
-        CacheKeyManifest.prototype.get = function () {
-            return this.cache.get(this.manifestKey);
-        };
-        CacheKeyManifest.prototype.clear = function () {
-            return this.cache.remove(this.manifestKey);
-        };
-        CacheKeyManifest.prototype.createManifestKeyFrom = function (clientId) {
-            return CACHE_KEY_PREFIX + "::" + clientId;
-        };
-        return CacheKeyManifest;
-    }());
-
     var DEFAULT_EXPIRY_ADJUSTMENT_SECONDS = 0;
     var CacheManager = /** @class */ (function () {
-        function CacheManager(cache, clientId) {
+        function CacheManager(cache, keyManifest) {
             this.cache = cache;
-            // If the cache implementation doesn't provide an `allKeys` method,
-            // use a built-in key manifest.
-            if (!cache.allKeys) {
-                this.keyManifest = new CacheKeyManifest(this.cache, clientId);
-            }
+            this.keyManifest = keyManifest;
         }
         CacheManager.prototype.get = function (cacheKey, expiryAdjustmentSeconds) {
             var _a;
@@ -4626,7 +4577,7 @@
                 });
             });
         };
-        CacheManager.prototype.clear = function () {
+        CacheManager.prototype.clear = function (clientId) {
             var _a;
             return __awaiter(this, void 0, void 0, function () {
                 var keys;
@@ -4639,18 +4590,25 @@
                             /* istanbul ignore next */
                             if (!keys)
                                 return [2 /*return*/];
-                            keys.forEach(function (key) { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0: return [4 /*yield*/, this.cache.remove(key)];
-                                        case 1:
-                                            _a.sent();
-                                            return [2 /*return*/];
-                                    }
-                                });
-                            }); });
-                            return [4 /*yield*/, ((_a = this.keyManifest) === null || _a === void 0 ? void 0 : _a.clear())];
+                            return [4 /*yield*/, keys
+                                    .filter(function (key) { return (clientId ? key.includes(clientId) : true); })
+                                    .reduce(function (memo, key) { return __awaiter(_this, void 0, void 0, function () {
+                                    return __generator(this, function (_a) {
+                                        switch (_a.label) {
+                                            case 0: return [4 /*yield*/, memo];
+                                            case 1:
+                                                _a.sent();
+                                                return [4 /*yield*/, this.cache.remove(key)];
+                                            case 2:
+                                                _a.sent();
+                                                return [2 /*return*/];
+                                        }
+                                    });
+                                }); }, Promise.resolve())];
                         case 2:
+                            _b.sent();
+                            return [4 /*yield*/, ((_a = this.keyManifest) === null || _a === void 0 ? void 0 : _a.clear())];
+                        case 3:
                             _b.sent();
                             return [2 /*return*/];
                     }
@@ -4660,13 +4618,15 @@
         /**
          * Note: only call this if you're sure one of our internal (synchronous) caches are being used.
          */
-        CacheManager.prototype.clearSync = function () {
+        CacheManager.prototype.clearSync = function (clientId) {
             var _this = this;
             var keys = this.cache.allKeys();
             /* istanbul ignore next */
             if (!keys)
                 return;
-            keys.forEach(function (key) {
+            keys
+                .filter(function (key) { return (clientId ? key.includes(clientId) : true); })
+                .forEach(function (key) {
                 _this.cache.remove(key);
             });
         };
@@ -4727,15 +4687,17 @@
         return CacheManager;
     }());
 
-    var TRANSACTION_STORAGE_KEY = 'a0.spajs.txs';
+    var TRANSACTION_STORAGE_KEY_PREFIX = 'a0.spajs.txs';
     var TransactionManager = /** @class */ (function () {
-        function TransactionManager(storage) {
+        function TransactionManager(storage, clientId) {
             this.storage = storage;
-            this.transaction = this.storage.get(TRANSACTION_STORAGE_KEY);
+            this.clientId = clientId;
+            this.storageKey = TRANSACTION_STORAGE_KEY_PREFIX + "." + clientId;
+            this.transaction = this.storage.get(this.storageKey);
         }
         TransactionManager.prototype.create = function (transaction) {
             this.transaction = transaction;
-            this.storage.save(TRANSACTION_STORAGE_KEY, transaction, {
+            this.storage.save(this.storageKey, transaction, {
                 daysUntilExpire: 1
             });
         };
@@ -4744,7 +4706,7 @@
         };
         TransactionManager.prototype.remove = function () {
             delete this.transaction;
-            this.storage.remove(TRANSACTION_STORAGE_KEY);
+            this.storage.remove(this.storageKey);
         };
         return TransactionManager;
     }());
@@ -4999,7 +4961,9 @@
                     sameSite: 'none'
                 };
             }
-            cookieAttributes.expires = options.daysUntilExpire;
+            if (options === null || options === void 0 ? void 0 : options.daysUntilExpire) {
+                cookieAttributes.expires = options.daysUntilExpire;
+            }
             esCookie_5(key, JSON.stringify(value), cookieAttributes);
         },
         remove: function (key) {
@@ -5027,7 +4991,9 @@
             if ('https:' === window.location.protocol) {
                 cookieAttributes = { secure: true };
             }
-            cookieAttributes.expires = options.daysUntilExpire;
+            if (options === null || options === void 0 ? void 0 : options.daysUntilExpire) {
+                cookieAttributes.expires = options.daysUntilExpire;
+            }
             esCookie_5("" + LEGACY_PREFIX + key, JSON.stringify(value), cookieAttributes);
             CookieStorage.save(key, value, options);
         },
@@ -5041,6 +5007,7 @@
      */
     var SessionStorage = {
         get: function (key) {
+            /* istanbul ignore next */
             if (typeof sessionStorage === 'undefined') {
                 return;
             }
@@ -5131,6 +5098,67 @@
         });
     };
 
+    var CacheKeyManifest = /** @class */ (function () {
+        function CacheKeyManifest(cache, clientId) {
+            this.cache = cache;
+            this.clientId = clientId;
+            this.manifestKey = this.createManifestKeyFrom(this.clientId);
+        }
+        CacheKeyManifest.prototype.add = function (key) {
+            var _a;
+            return __awaiter(this, void 0, void 0, function () {
+                var keys, _b;
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
+                        case 0:
+                            _b = Set.bind;
+                            return [4 /*yield*/, this.cache.get(this.manifestKey)];
+                        case 1:
+                            keys = new (_b.apply(Set, [void 0, ((_a = (_c.sent())) === null || _a === void 0 ? void 0 : _a.keys) || []]))();
+                            keys.add(key);
+                            return [4 /*yield*/, this.cache.set(this.manifestKey, {
+                                    keys: __spreadArray([], __read(keys))
+                                })];
+                        case 2:
+                            _c.sent();
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        CacheKeyManifest.prototype.remove = function (key) {
+            return __awaiter(this, void 0, void 0, function () {
+                var entry, keys;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.cache.get(this.manifestKey)];
+                        case 1:
+                            entry = _a.sent();
+                            if (!entry) return [3 /*break*/, 5];
+                            keys = new Set(entry.keys);
+                            keys.delete(key);
+                            if (!(keys.size > 0)) return [3 /*break*/, 3];
+                            return [4 /*yield*/, this.cache.set(this.manifestKey, { keys: __spreadArray([], __read(keys)) })];
+                        case 2: return [2 /*return*/, _a.sent()];
+                        case 3: return [4 /*yield*/, this.cache.remove(this.manifestKey)];
+                        case 4: return [2 /*return*/, _a.sent()];
+                        case 5: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        CacheKeyManifest.prototype.get = function () {
+            return this.cache.get(this.manifestKey);
+        };
+        CacheKeyManifest.prototype.clear = function () {
+            return this.cache.remove(this.manifestKey);
+        };
+        CacheKeyManifest.prototype.createManifestKeyFrom = function (clientId) {
+            return CACHE_KEY_PREFIX + "::" + clientId;
+        };
+        return CacheKeyManifest;
+    }());
+
     /**
      * @ignore
      */
@@ -5139,6 +5167,22 @@
      * @ignore
      */
     var GET_TOKEN_SILENTLY_LOCK_KEY = 'auth0.lock.getTokenSilently';
+    /**
+     * @ignore
+     */
+    var buildOrganizationHintCookieName = function (clientId) {
+        return "auth0." + clientId + ".organization_hint";
+    };
+    /**
+     * @ignore
+     */
+    var OLD_IS_AUTHENTICATED_COOKIE_NAME = 'auth0.is.authenticated';
+    /**
+     * @ignore
+     */
+    var buildIsAuthenticatedCookieName = function (clientId) {
+        return "auth0." + clientId + ".is.authenticated";
+    };
     /**
      * @ignore
      */
@@ -5207,14 +5251,18 @@
                 options.legacySameSiteCookie === false
                     ? CookieStorage
                     : CookieStorageWithLegacySameSite;
+            this.orgHintCookieName = buildOrganizationHintCookieName(this.options.client_id);
+            this.isAuthenticatedCookieName = buildIsAuthenticatedCookieName(this.options.client_id);
             this.sessionCheckExpiryDays =
                 options.sessionCheckExpiryDays || DEFAULT_SESSION_CHECK_EXPIRY_DAYS;
             var transactionStorage = options.useCookiesForTransactions
                 ? this.cookieStorage
                 : SessionStorage;
             this.scope = this.options.scope;
-            this.transactionManager = new TransactionManager(transactionStorage);
-            this.cacheManager = new CacheManager(cache, this.options.client_id);
+            this.transactionManager = new TransactionManager(transactionStorage, this.options.client_id);
+            this.cacheManager = new CacheManager(cache, !cache.allKeys
+                ? new CacheKeyManifest(cache, this.options.client_id)
+                : null);
             this.domainUrl = getDomain(this.options.domain);
             this.tokenIssuer = getTokenIssuer(this.options.issuer, this.domainUrl);
             this.defaultScope = getUniqueScopes('openid', ((_b = (_a = this.options) === null || _a === void 0 ? void 0 : _a.advancedOptions) === null || _b === void 0 ? void 0 : _b.defaultScope) !== undefined
@@ -5264,6 +5312,14 @@
             }
             return parseInt(value, 10) || undefined;
         };
+        Auth0Client.prototype._processOrgIdHint = function (organizationId) {
+            if (organizationId) {
+                this.cookieStorage.save(this.orgHintCookieName, organizationId);
+            }
+            else {
+                this.cookieStorage.remove(this.orgHintCookieName);
+            }
+        };
         /**
          * ```js
          * await auth0.buildAuthorizeUrl(options);
@@ -5373,9 +5429,10 @@
                             return [4 /*yield*/, this.cacheManager.set(cacheEntry)];
                         case 4:
                             _a.sent();
-                            this.cookieStorage.save('auth0.is.authenticated', true, {
+                            this.cookieStorage.save(this.isAuthenticatedCookieName, true, {
                                 daysUntilExpire: this.sessionCheckExpiryDays
                             });
+                            this._processOrgIdHint(decodedToken.claims.org_id);
                             return [2 /*return*/];
                     }
                 });
@@ -5530,9 +5587,10 @@
                             return [4 /*yield*/, this.cacheManager.set(cacheEntry)];
                         case 2:
                             _b.sent();
-                            this.cookieStorage.save('auth0.is.authenticated', true, {
+                            this.cookieStorage.save(this.isAuthenticatedCookieName, true, {
                                 daysUntilExpire: this.sessionCheckExpiryDays
                             });
+                            this._processOrgIdHint(decodedToken.claims.org_id);
                             return [2 /*return*/, {
                                     appState: transaction.appState
                                 }];
@@ -5549,7 +5607,7 @@
          * with `getTokenSilently` is that this doesn't return a token, but it will
          * pre-fill the token cache.
          *
-         * This method also heeds the `auth0.is.authenticated` cookie, as an optimization
+         * This method also heeds the `auth0.{clientId}.is.authenticated` cookie, as an optimization
          *  to prevent calling Auth0 unnecessarily. If the cookie is not present because
          * there was no previous login (or it has expired) then tokens will not be refreshed.
          *
@@ -5565,8 +5623,17 @@
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            if (!this.cookieStorage.get('auth0.is.authenticated')) {
-                                return [2 /*return*/];
+                            if (!this.cookieStorage.get(this.isAuthenticatedCookieName)) {
+                                if (!this.cookieStorage.get(OLD_IS_AUTHENTICATED_COOKIE_NAME)) {
+                                    return [2 /*return*/];
+                                }
+                                else {
+                                    // Migrate the existing cookie to the new name scoped by client ID
+                                    this.cookieStorage.save(this.isAuthenticatedCookieName, true, {
+                                        daysUntilExpire: this.sessionCheckExpiryDays
+                                    });
+                                    this.cookieStorage.remove(OLD_IS_AUTHENTICATED_COOKIE_NAME);
+                                }
                             }
                             _a.label = 1;
                         case 1:
@@ -5687,7 +5754,7 @@
                             return [4 /*yield*/, this.cacheManager.set(__assign({ client_id: this.options.client_id }, authResult))];
                         case 11:
                             _b.sent();
-                            this.cookieStorage.save('auth0.is.authenticated', true, {
+                            this.cookieStorage.save(this.isAuthenticatedCookieName, true, {
                                 daysUntilExpire: this.sessionCheckExpiryDays
                             });
                             return [2 /*return*/, authResult.access_token];
@@ -5809,7 +5876,8 @@
                 throw new Error('It is invalid to set both the `federated` and `localOnly` options to `true`');
             }
             var postCacheClear = function () {
-                _this.cookieStorage.remove('auth0.is.authenticated');
+                _this.cookieStorage.remove(_this.orgHintCookieName);
+                _this.cookieStorage.remove(_this.isAuthenticatedCookieName);
                 if (localOnly) {
                     return;
                 }
@@ -5826,7 +5894,7 @@
         };
         Auth0Client.prototype._getTokenFromIFrame = function (options) {
             return __awaiter(this, void 0, void 0, function () {
-                var stateIn, nonceIn, code_verifier, code_challengeBuffer, code_challenge, params, url, timeout, codeResult, scope, audience, customOptions, tokenResult, decodedToken, e_1;
+                var stateIn, nonceIn, code_verifier, code_challengeBuffer, code_challenge, params, orgIdHint, url, timeout, codeResult, scope, audience, customOptions, tokenResult, decodedToken, e_1;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5840,11 +5908,21 @@
                             params = this._getParams(options, stateIn, nonceIn, code_challenge, options.redirect_uri ||
                                 this.options.redirect_uri ||
                                 window.location.origin);
+                            orgIdHint = this.cookieStorage.get(this.orgHintCookieName);
+                            if (orgIdHint && !params.organization) {
+                                params.organization = orgIdHint;
+                            }
                             url = this._authorizeUrl(__assign(__assign({}, params), { prompt: 'none', response_mode: 'web_message' }));
                             timeout = options.timeoutInSeconds || this.options.authorizeTimeoutInSeconds;
                             _a.label = 2;
                         case 2:
                             _a.trys.push([2, 5, , 6]);
+                            // When a browser is running in a Cross-Origin Isolated context, using iframes is not possible.
+                            // It doesn't throw an error but times out instead, so we should exit early and inform the user about the reason.
+                            // https://developer.mozilla.org/en-US/docs/Web/API/crossOriginIsolated
+                            if (window.crossOriginIsolated) {
+                                throw new GenericError('login_required', 'The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.');
+                            }
                             return [4 /*yield*/, runIframe(url, this.domainUrl, timeout)];
                         case 3:
                             codeResult = _a.sent();
@@ -5856,6 +5934,7 @@
                         case 4:
                             tokenResult = _a.sent();
                             decodedToken = this._verifyIdToken(tokenResult.id_token, nonceIn);
+                            this._processOrgIdHint(decodedToken.claims.org_id);
                             return [2 /*return*/, __assign(__assign({}, tokenResult), { decodedToken: decodedToken, scope: params.scope, audience: params.audience || 'default' })];
                         case 5:
                             e_1 = _a.sent();
@@ -5953,7 +6032,8 @@
     wrapper.GenericError = GenericError;
     wrapper.AuthenticationError = AuthenticationError;
     wrapper.TimeoutError = TimeoutError;
-    wrapper.PopupTimeoutError = PopupTimeoutError;
+    wrapper.PopupTimeoutError = PopupTimeoutError;
+    wrapper.MfaRequiredError = MfaRequiredError;
 
     return wrapper;