@azure/msal-browser 2.18.0 → 2.19.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.18.0 2021-10-05 */
+/*! @azure/msal-browser v2.19.0 2021-11-02 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -259,6 +259,8 @@
         HeaderNames["CONTENT_TYPE"] = "Content-Type";
         HeaderNames["RETRY_AFTER"] = "Retry-After";
         HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
+        HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
+        HeaderNames["AuthenticationInfo"] = "Authentication-Info";
     })(HeaderNames || (HeaderNames = {}));
     /**
      * Persistent cache keys MSAL which stay while user is logged in.
@@ -486,8 +488,9 @@
      */
     exports.AuthenticationScheme = void 0;
     (function (AuthenticationScheme) {
-        AuthenticationScheme["POP"] = "pop";
         AuthenticationScheme["BEARER"] = "Bearer";
+        AuthenticationScheme["POP"] = "pop";
+        AuthenticationScheme["SSH"] = "ssh-cert";
     })(exports.AuthenticationScheme || (exports.AuthenticationScheme = {}));
     /**
      * Constants related to throttling
@@ -552,7 +555,7 @@
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
     })(CacheOutcome || (CacheOutcome = {}));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -596,7 +599,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -662,7 +665,7 @@
         }
     };
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -848,6 +851,10 @@
         bindingKeyNotRemovedError: {
             code: "binding_key_not_removed",
             desc: "Could not remove the credential's binding key from storage."
+        },
+        logoutNotSupported: {
+            code: "end_session_endpoint_not_supported",
+            desc: "Provided authority does not support logout."
         }
     };
     /**
@@ -1111,10 +1118,16 @@
         ClientAuthError.createBindingKeyNotRemovedError = function () {
             return new ClientAuthError(ClientAuthErrorMessage.bindingKeyNotRemovedError.code, ClientAuthErrorMessage.bindingKeyNotRemovedError.desc);
         };
+        /**
+         * Thrown when logout is attempted for an authority that doesnt have an end_session_endpoint
+         */
+        ClientAuthError.createLogoutNotSupportedError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
+        };
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1239,7 +1252,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1419,12 +1432,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "5.0.1";
+    var version$1 = "5.1.0";
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1526,8 +1539,8 @@
                 this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
                 this.generateTargetForCacheKey(target)
             ];
-            // PoP Tokens include scheme in cache key
-            if (tokenType === exports.AuthenticationScheme.POP) {
+            // PoP Tokens and SSH certs include scheme in cache key
+            if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
                 credentialKey.push(tokenType.toLowerCase());
             }
             return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
@@ -1568,7 +1581,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1640,15 +1653,31 @@
         },
         invalidCloudDiscoveryMetadata: {
             code: "invalid_cloud_discovery_metadata",
-            desc: "Invalid cloudDiscoveryMetadata provided. Must be a JSON object containing tenant_discovery_endpoint and metadata fields"
+            desc: "Invalid cloudDiscoveryMetadata provided. Must be a stringified JSON object containing tenant_discovery_endpoint and metadata fields"
         },
         invalidAuthorityMetadata: {
             code: "invalid_authority_metadata",
-            desc: "Invalid authorityMetadata provided. Must by a JSON object containing authorization_endpoint, token_endpoint, end_session_endpoint, issuer fields."
+            desc: "Invalid authorityMetadata provided. Must by a stringified JSON object containing authorization_endpoint, token_endpoint, issuer fields."
         },
         untrustedAuthority: {
             code: "untrusted_authority",
             desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
+        },
+        missingSshJwk: {
+            code: "missing_ssh_jwk",
+            desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
+        },
+        missingSshKid: {
+            code: "missing_ssh_kid",
+            desc: "Missing sshKid in SSH certificate request. A string that uniquely identifies the public SSH key is required when using the SSH authentication scheme."
+        },
+        missingNonceAuthenticationHeader: {
+            code: "missing_nonce_authentication_header",
+            desc: "Unable to find an authentication header containing server nonce. Either the Authentication-Info or WWW-Authenticate headers must be present in order to obtain a server nonce."
+        },
+        invalidAuthenticationHeader: {
+            code: "invalid_authentication_header",
+            desc: "Invalid authentication header provided"
         }
     };
     /**
@@ -1770,10 +1799,34 @@
         ClientConfigurationError.createUntrustedAuthorityError = function () {
             return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
         };
+        /*
+         * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
+         */
+        ClientConfigurationError.createMissingSshJwkError = function () {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshJwk.code, ClientConfigurationErrorMessage.missingSshJwk.desc);
+        };
+        /**
+         * Throws an error when the authentication scheme is set to SSH but the SSH public key ID is omitted from the request
+         */
+        ClientConfigurationError.createMissingSshKidError = function () {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.missingSshKid.code, ClientConfigurationErrorMessage.missingSshKid.desc);
+        };
+        /**
+         * Throws error when provided headers don't contain a header that a server nonce can be extracted from
+         */
+        ClientConfigurationError.createMissingNonceAuthenticationHeadersError = function () {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.code, ClientConfigurationErrorMessage.missingNonceAuthenticationHeader.desc);
+        };
+        /**
+         * Throws error when a provided header is invalid in any way
+         */
+        ClientConfigurationError.createInvalidAuthenticationHeaderError = function (invalidHeaderName, details) {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAuthenticationHeader.code, ClientConfigurationErrorMessage.invalidAuthenticationHeader.desc + ". Invalid header: " + invalidHeaderName + ". Details: " + details);
+        };
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1957,7 +2010,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1995,7 +2048,7 @@
         };
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2009,7 +2062,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2243,7 +2296,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2281,7 +2334,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2443,7 +2496,7 @@
          * @param target
          */
         CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType);
+            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
         };
         /**
          * Support function to help match credentials
@@ -2456,7 +2509,7 @@
          * @param oboAssertion
          * @param tokenType
          */
-        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType) {
+        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingCredentials = {
@@ -2503,15 +2556,26 @@
                 if (!!target && !_this.matchTarget(entity, target)) {
                     return;
                 }
+                // Access Token with Auth Scheme specific matching
                 if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                     if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                         return;
                     }
-                    // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                    if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                        // AccessToken_With_AuthScheme that doesn't have pop in the key is outdated
-                        _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
-                        return;
+                    switch (tokenType) {
+                        case exports.AuthenticationScheme.POP:
+                            // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
+                            if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
+                                // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
+                                _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
+                                return;
+                            }
+                            break;
+                        case exports.AuthenticationScheme.SSH:
+                            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                            if (keyId && !_this.matchKeyId(entity, keyId)) {
+                                return;
+                            }
+                            break;
                     }
                 }
                 switch (credType) {
@@ -2682,6 +2746,7 @@
                         case 0:
                             key = credential.generateCredentialKey();
                             if (!(credential.credentialType.toLowerCase() === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME.toLowerCase())) return [3 /*break*/, 4];
+                            if (!(credential.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 4];
                             accessTokenWithAuthSchemeEntity = credential;
                             kid = accessTokenWithAuthSchemeEntity.keyId;
                             if (!kid) return [3 /*break*/, 4];
@@ -2721,10 +2786,10 @@
          * @param environment
          * @param authScheme
          */
-        CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme) {
+        CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
             var cachedAccount = this.readAccountFromCache(account);
             var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme);
+            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
             var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
             var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
             if (cachedAccount && cachedIdToken) {
@@ -2778,9 +2843,9 @@
          * @param scopes
          * @param authScheme
          */
-        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme) {
-            // Distinguish between Bearer and PoP token cache types
-            var credentialType = (authScheme === exports.AuthenticationScheme.POP) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
+        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
+            // Distinguish between Bearer and PoP/SSH token cache types
+            var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
             var accessTokenFilter = {
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
@@ -2788,7 +2853,8 @@
                 clientId: clientId,
                 realm: account.tenantId,
                 target: scopes.printScopesLowerCase(),
-                tokenType: authScheme
+                tokenType: authScheme,
+                keyId: keyId
             };
             var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
             var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -2941,6 +3007,14 @@
         CacheManager.prototype.matchTokenType = function (entity, tokenType) {
             return !!(entity.tokenType && entity.tokenType === tokenType);
         };
+        /**
+         * Returns true if the credential's keyId matches the one in the request, false otherwise
+         * @param entity
+         * @param tokenType
+         */
+        CacheManager.prototype.matchKeyId = function (entity, keyId) {
+            return !!(entity.keyId && entity.keyId === keyId);
+        };
         /**
          * returns if a given cache entity is of the type appmetadata
          * @param key
@@ -3092,7 +3166,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3174,7 +3248,7 @@
         return __assign({ clientCapabilities: [] }, authOptions);
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3194,7 +3268,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3280,7 +3354,9 @@
                 authenticationScheme: request.authenticationScheme,
                 resourceRequestMethod: request.resourceRequestMethod,
                 resourceRequestUri: request.resourceRequestUri,
-                shrClaims: request.shrClaims
+                shrClaims: request.shrClaims,
+                sshJwk: request.sshJwk,
+                sshKid: request.sshKid
             };
             var key = this.generateThrottlingStorageKey(thumbprint);
             return cacheManager.removeItem(key, CacheSchemaType.THROTTLING);
@@ -3288,7 +3364,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3337,7 +3413,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3348,7 +3424,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3437,7 +3513,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3523,7 +3599,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3827,6 +3903,15 @@
                 this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(cnfString));
             }
         };
+        /**
+         * add SSH JWK and key ID to query params
+         */
+        RequestParameterBuilder.prototype.addSshJwk = function (sshJwkString) {
+            if (!StringUtils.isEmpty(sshJwkString)) {
+                this.parameters.set(AADServerParamKeys.TOKEN_TYPE, exports.AuthenticationScheme.SSH);
+                this.parameters.set(AADServerParamKeys.REQ_CNF, encodeURIComponent(sshJwkString));
+            }
+        };
         /**
          * add server telemetry fields
          * @param serverTelemetryManager
@@ -3854,7 +3939,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3919,7 +4004,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3969,7 +4054,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4015,7 +4100,7 @@
          * @param expiresOn
          * @param extExpiresOn
          */
-        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion) {
+        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
             var _a;
             var atEntity = new AccessTokenEntity();
             atEntity.homeAccountId = homeAccountId;
@@ -4038,15 +4123,21 @@
             atEntity.target = scopes;
             atEntity.oboAssertion = oboAssertion;
             atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-            // Create Access Token With AuthScheme instead of regular access token
-            if (atEntity.tokenType === exports.AuthenticationScheme.POP) {
+            // Create Access Token With Auth Scheme instead of regular access token
+            if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
                 atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
-                // Make sure keyId is present and add it to credential
-                var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                    throw ClientAuthError.createTokenClaimsRequiredError();
+                switch (atEntity.tokenType) {
+                    case exports.AuthenticationScheme.POP:
+                        // Make sure keyId is present and add it to credential
+                        var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
+                        if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                            throw ClientAuthError.createTokenClaimsRequiredError();
+                        }
+                        atEntity.keyId = tokenClaims.cnf.kid;
+                        break;
+                    case exports.AuthenticationScheme.SSH:
+                        atEntity.keyId = keyId;
                 }
-                atEntity.keyId = tokenClaims.cnf.kid;
             }
             return atEntity;
         };
@@ -4070,7 +4161,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4137,7 +4228,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4201,7 +4292,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4217,7 +4308,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4288,7 +4379,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4489,7 +4580,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4548,14 +4639,14 @@
         };
         PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
             return __awaiter(this, void 0, void 0, function () {
-                var resourceRequestMethod, resourceRequestUri, shrClaims, resourceUrlString, resourceUrlComponents;
+                var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims;
+                            resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                             resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                             resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                            return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
+                            return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid)];
                         case 1: return [2 /*return*/, _a.sent()];
                     }
                 });
@@ -4564,7 +4655,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4634,7 +4725,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4670,7 +4761,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4751,6 +4842,8 @@
                             if (!!authCodePayload && !!authCodePayload.state) {
                                 requestStateObj = ProtocolUtils.parseRequestState(this.cryptoObj, authCodePayload.state);
                             }
+                            // Add keyId from request to serverTokenResponse if defined
+                            serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
                             cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
                             _a.label = 1;
                         case 1:
@@ -4827,7 +4920,7 @@
                 var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
                 var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
                 // non AAD scenarios can have empty realm
-                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion);
+                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
             }
             // refreshToken
             var cachedRefreshToken = null;
@@ -4932,7 +5025,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5047,7 +5140,9 @@
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
-                                shrClaims: request.shrClaims
+                                shrClaims: request.shrClaims,
+                                sshJwk: request.sshJwk,
+                                sshKid: request.sshKid
                             };
                             return [4 /*yield*/, this.createTokenRequestBody(request)];
                         case 1:
@@ -5128,8 +5223,18 @@
                         case 1:
                             cnfString = _a.sent();
                             parameterBuilder.addPopToken(cnfString);
-                            _a.label = 2;
+                            return [3 /*break*/, 3];
                         case 2:
+                            if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                if (request.sshJwk) {
+                                    parameterBuilder.addSshJwk(request.sshJwk);
+                                }
+                                else {
+                                    throw ClientConfigurationError.createMissingSshJwkError();
+                                }
+                            }
+                            _a.label = 3;
+                        case 3:
                             correlationId = request.correlationId || this.config.cryptoInterface.createNewGuid();
                             parameterBuilder.addCorrelationId(correlationId);
                             if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
@@ -5305,7 +5410,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5419,7 +5524,9 @@
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
-                                shrClaims: request.shrClaims
+                                shrClaims: request.shrClaims,
+                                sshJwk: request.sshJwk,
+                                sshKid: request.sshKid
                             };
                             endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
                             return [2 /*return*/, this.executePostToTokenEndpoint(endpoint, requestBody, headers, thumbprint)];
@@ -5444,9 +5551,9 @@
          */
         RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, _a, _b, clientInfo;
-                return __generator(this, function (_c) {
-                    switch (_c.label) {
+                var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
                         case 0:
                             parameterBuilder = new RequestParameterBuilder();
                             parameterBuilder.addClientId(this.config.authOptions.clientId);
@@ -5471,12 +5578,22 @@
                             }
                             if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
-                            _b = (_a = parameterBuilder).addPopToken;
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            _b.apply(_a, [_c.sent()]);
-                            _c.label = 2;
+                            cnfString = _a.sent();
+                            parameterBuilder.addPopToken(cnfString);
+                            return [3 /*break*/, 3];
                         case 2:
+                            if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                if (request.sshJwk) {
+                                    parameterBuilder.addSshJwk(request.sshJwk);
+                                }
+                                else {
+                                    throw ClientConfigurationError.createMissingSshJwkError();
+                                }
+                            }
+                            _a.label = 3;
+                        case 3:
                             if (!StringUtils.isEmptyObj(request.claims) || this.config.authOptions.clientCapabilities && this.config.authOptions.clientCapabilities.length > 0) {
                                 parameterBuilder.addClaims(request.claims, this.config.authOptions.clientCapabilities);
                             }
@@ -5504,7 +5621,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5558,6 +5675,17 @@
                             if (!request) {
                                 throw ClientConfigurationError.createEmptyTokenRequestError();
                             }
+                            if (request.forceRefresh) {
+                                // Must refresh due to present force_refresh flag.
+                                (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
+                                this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
+                                throw ClientAuthError.createRefreshRequiredError();
+                            }
+                            else if (!StringUtils.isEmptyObj(request.claims)) {
+                                // Must refresh due to request parameters.
+                                this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
+                                throw ClientAuthError.createRefreshRequiredError();
+                            }
                             // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                             if (!request.account) {
                                 throw ClientAuthError.createNoAccountInSilentRequestError();
@@ -5565,30 +5693,24 @@
                             requestScopes = new ScopeSet(request.scopes || []);
                             environment = request.authority || this.authority.getPreferredCache();
                             authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme);
-                            if (request.forceRefresh) {
-                                // Must refresh due to present force_refresh flag.
-                                (_a = this.serverTelemetryManager) === null || _a === void 0 ? void 0 : _a.setCacheOutcome(CacheOutcome.FORCE_REFRESH);
-                                throw ClientAuthError.createRefreshRequiredError();
-                            }
-                            else if (!cacheRecord.accessToken) {
+                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                            if (!cacheRecord.accessToken) {
                                 // Must refresh due to non-existent access_token.
                                 (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
+                                this.logger.info("SilentFlowClient:acquireCachedToken - No access token found in cache for the given properties.");
                                 throw ClientAuthError.createRefreshRequiredError();
                             }
                             else if (TimeUtils.wasClockTurnedBack(cacheRecord.accessToken.cachedAt) ||
                                 TimeUtils.isTokenExpired(cacheRecord.accessToken.expiresOn, this.config.systemOptions.tokenRenewalOffsetSeconds)) {
                                 // Must refresh due to expired access_token.
                                 (_c = this.serverTelemetryManager) === null || _c === void 0 ? void 0 : _c.setCacheOutcome(CacheOutcome.CACHED_ACCESS_TOKEN_EXPIRED);
+                                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token is expired or will expire within " + this.config.systemOptions.tokenRenewalOffsetSeconds + " seconds.");
                                 throw ClientAuthError.createRefreshRequiredError();
                             }
                             else if (cacheRecord.accessToken.refreshOn && TimeUtils.isTokenExpired(cacheRecord.accessToken.refreshOn, 0)) {
                                 // Must refresh due to the refresh_in value.
                                 (_d = this.serverTelemetryManager) === null || _d === void 0 ? void 0 : _d.setCacheOutcome(CacheOutcome.REFRESH_CACHED_ACCESS_TOKEN);
-                                throw ClientAuthError.createRefreshRequiredError();
-                            }
-                            else if (!StringUtils.isEmptyObj(request.claims)) {
-                                // Must refresh due to request parameters.
+                                this.logger.info("SilentFlowClient:acquireCachedToken - Cached access token's refreshOn property has been exceeded'.");
                                 throw ClientAuthError.createRefreshRequiredError();
                             }
                             if (this.config.serverTelemetryManager) {
@@ -5622,7 +5744,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5630,11 +5752,10 @@
     function isOpenIdConfigResponse(response) {
         return (response.hasOwnProperty("authorization_endpoint") &&
             response.hasOwnProperty("token_endpoint") &&
-            response.hasOwnProperty("end_session_endpoint") &&
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5648,7 +5769,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5715,7 +5836,6 @@
                 entity.hasOwnProperty("canonical_authority") &&
                 entity.hasOwnProperty("authorization_endpoint") &&
                 entity.hasOwnProperty("token_endpoint") &&
-                entity.hasOwnProperty("end_session_endpoint") &&
                 entity.hasOwnProperty("issuer") &&
                 entity.hasOwnProperty("aliasesFromNetwork") &&
                 entity.hasOwnProperty("endpointsFromNetwork") &&
@@ -5724,7 +5844,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5734,7 +5854,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5848,7 +5968,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6002,6 +6122,10 @@
              */
             get: function () {
                 if (this.discoveryComplete()) {
+                    // ROPC policies may not have end_session_endpoint set
+                    if (!this.metadata.end_session_endpoint) {
+                        throw ClientAuthError.createLogoutNotSupportedError();
+                    }
                     var endpoint = this.replacePath(this.metadata.end_session_endpoint);
                     return this.replaceTenant(endpoint);
                 }
@@ -6402,13 +6526,15 @@
             metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
             // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
             metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
-            metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+            if (metadata.end_session_endpoint) {
+                metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
+            }
             return metadata;
         };
         return Authority;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6469,7 +6595,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6500,7 +6626,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6528,7 +6654,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6545,7 +6671,66 @@
         }
     };
 
-    /*! @azure/msal-common v5.0.1 2021-10-05 */
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * This is a helper class that parses supported HTTP response authentication headers to extract and return
+     * header challenge values that can be used outside the basic authorization flows.
+     */
+    var AuthenticationHeaderParser = /** @class */ (function () {
+        function AuthenticationHeaderParser(headers) {
+            this.headers = headers;
+        }
+        /**
+         * This method parses the SHR nonce value out of either the Authentication-Info or WWW-Authenticate authentication headers.
+         * @returns
+         */
+        AuthenticationHeaderParser.prototype.getShrNonce = function () {
+            // Attempt to parse nonce from Authentiacation-Info
+            var authenticationInfo = this.headers[HeaderNames.AuthenticationInfo];
+            if (authenticationInfo) {
+                var authenticationInfoChallenges = this.parseChallenges(authenticationInfo);
+                if (authenticationInfoChallenges.nextnonce) {
+                    return authenticationInfoChallenges.nextnonce;
+                }
+                throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.AuthenticationInfo, "nextnonce challenge is missing.");
+            }
+            // Attempt to parse nonce from WWW-Authenticate
+            var wwwAuthenticate = this.headers[HeaderNames.WWWAuthenticate];
+            if (wwwAuthenticate) {
+                var wwwAuthenticateChallenges = this.parseChallenges(wwwAuthenticate);
+                if (wwwAuthenticateChallenges.nonce) {
+                    return wwwAuthenticateChallenges.nonce;
+                }
+                throw ClientConfigurationError.createInvalidAuthenticationHeaderError(HeaderNames.WWWAuthenticate, "nonce challenge is missing.");
+            }
+            // If neither header is present, throw missing headers error
+            throw ClientConfigurationError.createMissingNonceAuthenticationHeadersError();
+        };
+        /**
+         * Parses an HTTP header's challenge set into a key/value map.
+         * @param header
+         * @returns
+         */
+        AuthenticationHeaderParser.prototype.parseChallenges = function (header) {
+            var schemeSeparator = header.indexOf(" ");
+            var challenges = header.substr(schemeSeparator + 1).split(",");
+            var challengeMap = {};
+            challenges.forEach(function (challenge) {
+                var _a = challenge.split("="), key = _a[0], value = _a[1];
+                // Remove escaped quotation marks (', ") from challenge string to keep only the challenge value
+                challengeMap[key] = unescape(value.replace(/['"]+/g, ""));
+            });
+            return challengeMap;
+        };
+        return AuthenticationHeaderParser;
+    }());
+
+    /*! @azure/msal-common v5.1.0 2021-11-02 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6858,7 +7043,11 @@
     (function (WrapperSKU) {
         WrapperSKU["React"] = "@azure/msal-react";
         WrapperSKU["Angular"] = "@azure/msal-angular";
-    })(exports.WrapperSKU || (exports.WrapperSKU = {}));
+    })(exports.WrapperSKU || (exports.WrapperSKU = {}));
+    // DatabaseStorage Constants
+    var DB_NAME = "msal.db";
+    var DB_VERSION = 1;
+    var DB_TABLE_NAME = DB_NAME + ".keys";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7334,7 +7523,7 @@
         },
         noTokenRequestCacheError: {
             code: "no_token_request_cache_error",
-            desc: "No token request in found in cache."
+            desc: "No token request found in cache."
         },
         unableToParseTokenRequestCacheError: {
             code: "unable_to_parse_token_request_cache_error",
@@ -7383,6 +7572,10 @@
         signingKeyNotFoundInStorage: {
             code: "crypto_key_not_found",
             desc: "Cryptographic Key or Keypair not found in browser storage."
+        },
+        databaseUnavailable: {
+            code: "database_unavailable",
+            desc: "IndexedDB, which is required for persistent cryptographic key storage, is unavailable. This may be caused by browser privacy features which block persistent storage in third-party contexts."
         }
     };
     /**
@@ -7616,6 +7809,12 @@
         BrowserAuthError.createSigningKeyNotFoundInStorageError = function (keyId) {
             return new BrowserAuthError(BrowserAuthErrorMessage.signingKeyNotFoundInStorage.code, BrowserAuthErrorMessage.signingKeyNotFoundInStorage.desc + " | No match found for KeyId: " + keyId);
         };
+        /**
+         * Create an error when IndexedDB is unavailable
+         */
+        BrowserAuthError.createDatabaseUnavailableError = function () {
+            return new BrowserAuthError(BrowserAuthErrorMessage.databaseUnavailable.code, BrowserAuthErrorMessage.databaseUnavailable.desc);
+        };
         return BrowserAuthError;
     }(AuthError));
 
@@ -7718,7 +7917,8 @@
      * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
      */
     var BrowserCrypto = /** @class */ (function () {
-        function BrowserCrypto() {
+        function BrowserCrypto(logger) {
+            this.logger = logger;
             if (!(this.hasCryptoAPI())) {
                 throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto or msCrypto object not available.");
             }
@@ -7977,10 +8177,10 @@
      * Storage wrapper for IndexedDB storage in browsers: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API
      */
     var DatabaseStorage = /** @class */ (function () {
-        function DatabaseStorage(dbName, tableName, version) {
-            this.dbName = dbName;
-            this.tableName = tableName;
-            this.version = version;
+        function DatabaseStorage() {
+            this.dbName = DB_NAME;
+            this.version = DB_VERSION;
+            this.tableName = DB_TABLE_NAME;
             this.dbOpen = false;
         }
         /**
@@ -7991,7 +8191,6 @@
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            // TODO: Add timeouts?
                             var openDB = window.indexedDB.open(_this.dbName, _this.version);
                             openDB.addEventListener("upgradeneeded", function (e) {
                                 var event = e;
@@ -8003,40 +8202,53 @@
                                 _this.dbOpen = true;
                                 resolve();
                             });
-                            openDB.addEventListener("error", function (error) { return reject(error); });
+                            openDB.addEventListener("error", function () { return reject(BrowserAuthError.createDatabaseUnavailableError()); });
                         })];
                 });
             });
         };
         /**
-         * Retrieves item from IndexedDB instance.
-         * @param key
+         * Opens database if it's not already open
          */
-        DatabaseStorage.prototype.get = function (key) {
+        DatabaseStorage.prototype.validateDbIsOpen = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             if (!!this.dbOpen) return [3 /*break*/, 2];
                             return [4 /*yield*/, this.open()];
+                        case 1: return [2 /*return*/, _a.sent()];
+                        case 2: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Retrieves item from IndexedDB instance.
+         * @param key
+         */
+        DatabaseStorage.prototype.getItem = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _this = this;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                         case 1:
                             _a.sent();
-                            _a.label = 2;
-                        case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                                // TODO: Add timeouts?
-                                if (!_this.db) {
-                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
-                                }
-                                var transaction = _this.db.transaction([_this.tableName], "readonly");
-                                var objectStore = transaction.objectStore(_this.tableName);
-                                var dbGet = objectStore.get(key);
-                                dbGet.addEventListener("success", function (e) {
-                                    var event = e;
-                                    resolve(event.target.result);
-                                });
-                                dbGet.addEventListener("error", function (e) { return reject(e); });
-                            })];
+                            return [2 /*return*/, new Promise(function (resolve, reject) {
+                                    // TODO: Add timeouts?
+                                    if (!_this.db) {
+                                        return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                    }
+                                    var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                    var objectStore = transaction.objectStore(_this.tableName);
+                                    var dbGet = objectStore.get(key);
+                                    dbGet.addEventListener("success", function (e) {
+                                        var event = e;
+                                        resolve(event.target.result);
+                                    });
+                                    dbGet.addEventListener("error", function (e) { return reject(e); });
+                                })];
                     }
                 });
             });
@@ -8046,31 +8258,25 @@
          * @param key
          * @param payload
          */
-        DatabaseStorage.prototype.put = function (key, payload) {
+        DatabaseStorage.prototype.setItem = function (key, payload) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            if (!!this.dbOpen) return [3 /*break*/, 2];
-                            return [4 /*yield*/, this.open()];
+                        case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                         case 1:
                             _a.sent();
-                            _a.label = 2;
-                        case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                                // TODO: Add timeouts?
-                                if (!_this.db) {
-                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
-                                }
-                                var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                                var objectStore = transaction.objectStore(_this.tableName);
-                                var dbPut = objectStore.put(payload, key);
-                                dbPut.addEventListener("success", function (e) {
-                                    var event = e;
-                                    resolve(event.target.result);
-                                });
-                                dbPut.addEventListener("error", function (e) { return reject(e); });
-                            })];
+                            return [2 /*return*/, new Promise(function (resolve, reject) {
+                                    // TODO: Add timeouts?
+                                    if (!_this.db) {
+                                        return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                    }
+                                    var transaction = _this.db.transaction([_this.tableName], "readwrite");
+                                    var objectStore = transaction.objectStore(_this.tableName);
+                                    var dbPut = objectStore.put(payload, key);
+                                    dbPut.addEventListener("success", function () { return resolve(); });
+                                    dbPut.addEventListener("error", function (e) { return reject(e); });
+                                })];
                     }
                 });
             });
@@ -8079,65 +8285,323 @@
          * Removes item from IndexedDB under given key
          * @param key
          */
-        DatabaseStorage.prototype.delete = function (key) {
+        DatabaseStorage.prototype.removeItem = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            if (!!this.dbOpen) return [3 /*break*/, 2];
-                            return [4 /*yield*/, this.open()];
+                        case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                         case 1:
                             _a.sent();
-                            _a.label = 2;
-                        case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                                if (!_this.db) {
-                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
-                                }
-                                var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                                var objectStore = transaction.objectStore(_this.tableName);
-                                var dbDelete = objectStore.delete(key);
-                                dbDelete.addEventListener("success", function (e) {
-                                    var event = e;
-                                    resolve(event.target.result === undefined);
-                                });
-                                dbDelete.addEventListener("error", function (e) { return reject(e); });
-                            })];
+                            return [2 /*return*/, new Promise(function (resolve, reject) {
+                                    if (!_this.db) {
+                                        return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                    }
+                                    var transaction = _this.db.transaction([_this.tableName], "readwrite");
+                                    var objectStore = transaction.objectStore(_this.tableName);
+                                    var dbDelete = objectStore.delete(key);
+                                    dbDelete.addEventListener("success", function () { return resolve(); });
+                                    dbDelete.addEventListener("error", function (e) { return reject(e); });
+                                })];
                     }
                 });
             });
         };
-        DatabaseStorage.prototype.clear = function () {
+        /**
+         * Get all the keys from the storage object as an iterable array of strings.
+         */
+        DatabaseStorage.prototype.getKeys = function () {
             return __awaiter$1(this, void 0, void 0, function () {
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            if (!!this.dbOpen) return [3 /*break*/, 2];
-                            return [4 /*yield*/, this.open()];
+                        case 0: return [4 /*yield*/, this.validateDbIsOpen()];
                         case 1:
                             _a.sent();
-                            _a.label = 2;
-                        case 2: return [2 /*return*/, new Promise(function (resolve, reject) {
-                                if (!_this.db) {
-                                    return reject(BrowserAuthError.createDatabaseNotOpenError());
-                                }
-                                var transaction = _this.db.transaction([_this.tableName], "readwrite");
-                                var objectStore = transaction.objectStore(_this.tableName);
-                                var dbDelete = objectStore.clear();
-                                dbDelete.addEventListener("success", function (e) {
-                                    var event = e;
-                                    resolve(event.target.result === undefined);
-                                });
-                                dbDelete.addEventListener("error", function (e) { return reject(e); });
-                            })];
+                            return [2 /*return*/, new Promise(function (resolve, reject) {
+                                    if (!_this.db) {
+                                        return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                    }
+                                    var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                    var objectStore = transaction.objectStore(_this.tableName);
+                                    var dbGetKeys = objectStore.getAllKeys();
+                                    dbGetKeys.addEventListener("success", function (e) {
+                                        var event = e;
+                                        resolve(event.target.result);
+                                    });
+                                    dbGetKeys.addEventListener("error", function (e) { return reject(e); });
+                                })];
                     }
                 });
             });
         };
+        /**
+         *
+         * Checks whether there is an object under the search key in the object store
+         */
+        DatabaseStorage.prototype.containsKey = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _this = this;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.validateDbIsOpen()];
+                        case 1:
+                            _a.sent();
+                            return [2 /*return*/, new Promise(function (resolve, reject) {
+                                    if (!_this.db) {
+                                        return reject(BrowserAuthError.createDatabaseNotOpenError());
+                                    }
+                                    var transaction = _this.db.transaction([_this.tableName], "readonly");
+                                    var objectStore = transaction.objectStore(_this.tableName);
+                                    var dbContainsKey = objectStore.count(key);
+                                    dbContainsKey.addEventListener("success", function (e) {
+                                        var event = e;
+                                        resolve(event.target.result === 1);
+                                    });
+                                    dbContainsKey.addEventListener("error", function (e) { return reject(e); });
+                                })];
+                    }
+                });
+            });
+        };
+        /**
+         * Deletes the MSAL database. The database is deleted rather than cleared to make it possible
+         * for client applications to downgrade to a previous MSAL version without worrying about forward compatibility issues
+         * with IndexedDB database versions.
+         */
+        DatabaseStorage.prototype.deleteDatabase = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            var deleteDbRequest = window.indexedDB.deleteDatabase(DB_NAME);
+                            deleteDbRequest.addEventListener("success", function () { return resolve(true); });
+                            deleteDbRequest.addEventListener("error", function () { return reject(false); });
+                        })];
+                });
+            });
+        };
         return DatabaseStorage;
     }());
 
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var MemoryStorage = /** @class */ (function () {
+        function MemoryStorage() {
+            this.cache = new Map();
+        }
+        MemoryStorage.prototype.getItem = function (key) {
+            return this.cache.get(key) || null;
+        };
+        MemoryStorage.prototype.setItem = function (key, value) {
+            this.cache.set(key, value);
+        };
+        MemoryStorage.prototype.removeItem = function (key) {
+            this.cache.delete(key);
+        };
+        MemoryStorage.prototype.getKeys = function () {
+            var cacheKeys = [];
+            this.cache.forEach(function (value, key) {
+                cacheKeys.push(key);
+            });
+            return cacheKeys;
+        };
+        MemoryStorage.prototype.containsKey = function (key) {
+            return this.cache.has(key);
+        };
+        MemoryStorage.prototype.clear = function () {
+            this.cache.clear();
+        };
+        return MemoryStorage;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * This class allows MSAL to store artifacts asynchronously using the DatabaseStorage IndexedDB wrapper,
+     * backed up with the more volatile MemoryStorage object for cases in which IndexedDB may be unavailable.
+     */
+    var AsyncMemoryStorage = /** @class */ (function () {
+        function AsyncMemoryStorage(logger) {
+            this.inMemoryCache = new MemoryStorage();
+            this.indexedDBCache = new DatabaseStorage();
+            this.logger = logger;
+        }
+        AsyncMemoryStorage.prototype.handleDatabaseAccessError = function (error) {
+            if (error instanceof BrowserAuthError && error.errorCode === BrowserAuthErrorMessage.databaseUnavailable.code) {
+                this.logger.error("Could not access persistent storage. This may be caused by browser privacy features which block persistent storage in third-party contexts.");
+            }
+        };
+        /**
+         * Get the item matching the given key. Tries in-memory cache first, then in the asynchronous
+         * storage object if item isn't found in-memory.
+         * @param key
+         */
+        AsyncMemoryStorage.prototype.getItem = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var item, e_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            item = this.inMemoryCache.getItem(key);
+                            if (!!item) return [3 /*break*/, 4];
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            this.logger.verbose("Queried item not found in in-memory cache, now querying persistent storage.");
+                            return [4 /*yield*/, this.indexedDBCache.getItem(key)];
+                        case 2: return [2 /*return*/, _a.sent()];
+                        case 3:
+                            e_1 = _a.sent();
+                            this.handleDatabaseAccessError(e_1);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/, item];
+                    }
+                });
+            });
+        };
+        /**
+         * Sets the item in the in-memory cache and then tries to set it in the asynchronous
+         * storage object with the given key.
+         * @param key
+         * @param value
+         */
+        AsyncMemoryStorage.prototype.setItem = function (key, value) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var e_2;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.inMemoryCache.setItem(key, value);
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            return [4 /*yield*/, this.indexedDBCache.setItem(key, value)];
+                        case 2:
+                            _a.sent();
+                            return [3 /*break*/, 4];
+                        case 3:
+                            e_2 = _a.sent();
+                            this.handleDatabaseAccessError(e_2);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Removes the item matching the key from the in-memory cache, then tries to remove it from the asynchronous storage object.
+         * @param key
+         */
+        AsyncMemoryStorage.prototype.removeItem = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var e_3;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.inMemoryCache.removeItem(key);
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            return [4 /*yield*/, this.indexedDBCache.removeItem(key)];
+                        case 2:
+                            _a.sent();
+                            return [3 /*break*/, 4];
+                        case 3:
+                            e_3 = _a.sent();
+                            this.handleDatabaseAccessError(e_3);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        /**
+         * Get all the keys from the in-memory cache as an iterable array of strings. If no keys are found, query the keys in the
+         * asynchronous storage object.
+         */
+        AsyncMemoryStorage.prototype.getKeys = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var cacheKeys, e_4;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            cacheKeys = this.inMemoryCache.getKeys();
+                            if (!(cacheKeys.length === 0)) return [3 /*break*/, 4];
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            this.logger.verbose("In-memory cache is empty, now querying persistent storage.");
+                            return [4 /*yield*/, this.indexedDBCache.getKeys()];
+                        case 2: return [2 /*return*/, _a.sent()];
+                        case 3:
+                            e_4 = _a.sent();
+                            this.handleDatabaseAccessError(e_4);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/, cacheKeys];
+                    }
+                });
+            });
+        };
+        /**
+         * Returns true or false if the given key is present in the cache.
+         * @param key
+         */
+        AsyncMemoryStorage.prototype.containsKey = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var containsKey, e_5;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            containsKey = this.inMemoryCache.containsKey(key);
+                            if (!!containsKey) return [3 /*break*/, 4];
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            this.logger.verbose("Key not found in in-memory cache, now querying persistent storage.");
+                            return [4 /*yield*/, this.indexedDBCache.containsKey(key)];
+                        case 2: return [2 /*return*/, _a.sent()];
+                        case 3:
+                            e_5 = _a.sent();
+                            this.handleDatabaseAccessError(e_5);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/, containsKey];
+                    }
+                });
+            });
+        };
+        /**
+         * Clears in-memory Map and tries to delete the IndexedDB database.
+         */
+        AsyncMemoryStorage.prototype.clear = function () {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var e_6;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.inMemoryCache.clear();
+                            _a.label = 1;
+                        case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            return [4 /*yield*/, this.indexedDBCache.deleteDatabase()];
+                        case 2:
+                            _a.sent();
+                            return [3 /*break*/, 4];
+                        case 3:
+                            e_6 = _a.sent();
+                            this.handleDatabaseAccessError(e_6);
+                            return [3 /*break*/, 4];
+                        case 4: return [2 /*return*/];
+                    }
+                });
+            });
+        };
+        return AsyncMemoryStorage;
+    }());
+
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -8147,14 +8611,18 @@
      * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
      */
     var CryptoOps = /** @class */ (function () {
-        function CryptoOps() {
+        function CryptoOps(logger) {
+            this.logger = logger;
             // Browser crypto needs to be validated first before any other classes can be set.
-            this.browserCrypto = new BrowserCrypto();
+            this.browserCrypto = new BrowserCrypto(this.logger);
             this.b64Encode = new Base64Encode();
             this.b64Decode = new Base64Decode();
             this.guidGenerator = new GuidGenerator(this.browserCrypto);
             this.pkceGenerator = new PkceGenerator(this.browserCrypto);
-            this.cache = new DatabaseStorage(CryptoOps.DB_NAME, CryptoOps.TABLE_NAME, CryptoOps.DB_VERSION);
+            this.cache = {
+                asymmetricKeys: new AsyncMemoryStorage(this.logger),
+                symmetricKeys: new AsyncMemoryStorage(this.logger)
+            };
         }
         /**
          * Creates a new random GUID - used to populate state and nonce.
@@ -8219,7 +8687,7 @@
                         case 5:
                             unextractablePrivateKey = _a.sent();
                             // Store Keypair data in keystore
-                            return [4 /*yield*/, this.cache.put(publicJwkHash, {
+                            return [4 /*yield*/, this.cache.asymmetricKeys.setItem(publicJwkHash, {
                                     privateKey: unextractablePrivateKey,
                                     publicKey: keyPair.publicKey,
                                     requestMethod: request.resourceRequestMethod,
@@ -8239,8 +8707,17 @@
          */
         CryptoOps.prototype.removeTokenBindingKey = function (kid) {
             return __awaiter$1(this, void 0, void 0, function () {
+                var keyFound;
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.cache.delete(kid)];
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.cache.asymmetricKeys.removeItem(kid)];
+                        case 1:
+                            _a.sent();
+                            return [4 /*yield*/, this.cache.asymmetricKeys.containsKey(kid)];
+                        case 2:
+                            keyFound = _a.sent();
+                            return [2 /*return*/, !keyFound];
+                    }
                 });
             });
         };
@@ -8249,8 +8726,22 @@
          */
         CryptoOps.prototype.clearKeystore = function () {
             return __awaiter$1(this, void 0, void 0, function () {
-                return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.cache.clear()];
+                var dataStoreNames, databaseStorage, _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            dataStoreNames = Object.keys(this.cache);
+                            databaseStorage = this.cache[dataStoreNames[0]];
+                            if (!databaseStorage) return [3 /*break*/, 2];
+                            return [4 /*yield*/, databaseStorage.deleteDatabase()];
+                        case 1:
+                            _a = _b.sent();
+                            return [3 /*break*/, 3];
+                        case 2:
+                            _a = false;
+                            _b.label = 3;
+                        case 3: return [2 /*return*/, _a];
+                    }
                 });
             });
         };
@@ -8264,7 +8755,7 @@
                 var cachedKeyPair, publicKeyJwk, publicKeyJwkString, header, encodedHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.cache.get(kid)];
+                        case 0: return [4 /*yield*/, this.cache.asymmetricKeys.getItem(kid)];
                         case 1:
                             cachedKeyPair = _a.sent();
                             if (!cachedKeyPair) {
@@ -8297,9 +8788,6 @@
         };
         CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
         CryptoOps.EXTRACTABLE = true;
-        CryptoOps.DB_VERSION = 1;
-        CryptoOps.DB_NAME = "msal.db";
-        CryptoOps.TABLE_NAME = CryptoOps.DB_NAME + ".keys";
         return CryptoOps;
     }());
 
@@ -8429,39 +8917,6 @@
         return BrowserStorage;
     }());
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var MemoryStorage = /** @class */ (function () {
-        function MemoryStorage() {
-            this.cache = new Map();
-        }
-        MemoryStorage.prototype.getItem = function (key) {
-            return this.cache.get(key) || null;
-        };
-        MemoryStorage.prototype.setItem = function (key, value) {
-            this.cache.set(key, value);
-        };
-        MemoryStorage.prototype.removeItem = function (key) {
-            this.cache.delete(key);
-        };
-        MemoryStorage.prototype.getKeys = function () {
-            var cacheKeys = [];
-            this.cache.forEach(function (value, key) {
-                cacheKeys.push(key);
-            });
-            return cacheKeys;
-        };
-        MemoryStorage.prototype.containsKey = function (key) {
-            return this.cache.has(key);
-        };
-        MemoryStorage.prototype.clear = function () {
-            this.cache.clear();
-        };
-        return MemoryStorage;
-    }());
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -9842,7 +10297,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.18.0";
+    var version = "2.19.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10065,6 +10520,14 @@
                 this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
             }
             else {
+                if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                    if (!request.sshJwk) {
+                        throw ClientConfigurationError.createMissingSshJwkError();
+                    }
+                    if (!request.sshKid) {
+                        throw ClientConfigurationError.createMissingSshKidError();
+                    }
+                }
                 this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
             }
             var validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
@@ -11151,7 +11614,7 @@
                             this.logger.verbose("NavigateToLoginRequestUrl set to false, handling hash");
                             return [2 /*return*/, this.handleHash(responseHash, state, serverTelemetryManager)];
                         case 4:
-                            if (!!BrowserUtils.isInIframe()) return [3 /*break*/, 9];
+                            if (!(!BrowserUtils.isInIframe() || this.config.system.allowRedirectInIframe)) return [3 /*break*/, 9];
                             /*
                              * Returned from authority using redirect - need to perform navigation before processing response
                              * Cache the hash to be retrieved after the next redirect
@@ -11798,7 +12261,7 @@
             // Initialize redirectResponse Map
             this.redirectResponse = new Map();
             // Initialize the crypto class.
-            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps() : DEFAULT_CRYPTO_IMPLEMENTATION;
+            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger) : DEFAULT_CRYPTO_IMPLEMENTATION;
             this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
             // Initialize the browser storage class.
             this.browserStorage = this.isBrowserEnvironment ?
@@ -12027,7 +12490,7 @@
                             var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
                             if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
                                 _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                                var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode);
+                                var silentIframeClient = new SilentIframeClient(_this.config, _this.browserStorage, _this.browserCrypto, _this.logger, _this.eventHandler, _this.navigationClient, exports.ApiId.acquireTokenSilent_authCode, request.correlationId);
                                 return silentIframeClient.acquireToken(request);
                             }
                             throw e;
@@ -12247,6 +12710,12 @@
         ClientApplication.prototype.setNavigationClient = function (navigationClient) {
             this.navigationClient = navigationClient;
         };
+        /**
+         * Returns the configuration object
+         */
+        ClientApplication.prototype.getConfiguration = function () {
+            return this.config;
+        };
         return ClientApplication;
     }());
 
@@ -12413,7 +12882,9 @@
                         authenticationScheme: request.authenticationScheme,
                         resourceRequestMethod: request.resourceRequestMethod,
                         resourceRequestUri: request.resourceRequestUri,
-                        shrClaims: request.shrClaims
+                        shrClaims: request.shrClaims,
+                        sshJwk: request.sshJwk,
+                        sshKid: request.sshKid
                     };
                     silentRequestKey = JSON.stringify(thumbprint);
                     cachedResponse = this.activeSilentTokenRequests.get(silentRequestKey);
@@ -12449,7 +12920,7 @@
                 var silentCacheClient, silentRequest;
                 var _this = this;
                 return __generator$1(this, function (_a) {
-                    silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient);
+                    silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
                     silentRequest = silentCacheClient.initializeSilentRequest(request, account);
                     this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
                     return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
@@ -12556,6 +13027,9 @@
         },
         setNavigationClient: function () {
             return;
+        },
+        getConfiguration: function () {
+            throw BrowserConfigurationAuthError.createStubPcaInstanceCalledError();
         }
     };
 
@@ -12628,8 +13102,10 @@
      * Licensed under the MIT License.
      */
     var SignedHttpRequest = /** @class */ (function () {
-        function SignedHttpRequest(shrParameters) {
-            this.cryptoOps = new CryptoOps();
+        function SignedHttpRequest(shrParameters, shrOptions) {
+            var loggerOptions = (shrOptions && shrOptions.loggerOptions) || {};
+            this.logger = new Logger(loggerOptions, name, version);
+            this.cryptoOps = new CryptoOps(this.logger);
             this.popTokenGenerator = new PopTokenGenerator(this.cryptoOps);
             this.shrParameters = shrParameters;
         }
@@ -12672,7 +13148,10 @@
         SignedHttpRequest.prototype.removeKeys = function (publicKeyThumbprint) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint)];
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.cryptoOps.removeTokenBindingKey(publicKeyThumbprint)];
+                        case 1: return [2 /*return*/, _a.sent()];
+                    }
                 });
             });
         };
@@ -12682,6 +13161,7 @@
     exports.AccountEntity = AccountEntity;
     exports.AuthError = AuthError;
     exports.AuthErrorMessage = AuthErrorMessage;
+    exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
     exports.BrowserAuthError = BrowserAuthError;
     exports.BrowserAuthErrorMessage = BrowserAuthErrorMessage;
     exports.BrowserConfigurationAuthError = BrowserConfigurationAuthError;