@azure/msal-browser 2.20.0 → 2.21.0

package/dist/index.cjs.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.20.0 2021-12-07 */
+/*! @azure/msal-browser v2.21.0 2022-01-04 */
 'use strict';
 'use strict';
 
@@ -105,7 +105,7 @@ function __spread() {
     return ar;
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*! *****************************************************************************
 Copyright (c) Microsoft Corporation.
 
@@ -192,7 +192,7 @@ function __spreadArrays() {
     return r;
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -554,7 +554,7 @@ var CacheOutcome;
     CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
 })(CacheOutcome || (CacheOutcome = {}));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -598,7 +598,7 @@ var AuthError = /** @class */ (function (_super) {
     return AuthError;
 }(Error));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -661,10 +661,19 @@ var DEFAULT_CRYPTO_IMPLEMENTATION = {
                 throw AuthError.createUnexpectedError(notImplErr);
             });
         });
+    },
+    hashString: function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var notImplErr;
+            return __generator(this, function (_a) {
+                notImplErr = "Crypto interface - hashString() has not been implemented";
+                throw AuthError.createUnexpectedError(notImplErr);
+            });
+        });
     }
 };
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1126,7 +1135,7 @@ var ClientAuthError = /** @class */ (function (_super) {
     return ClientAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1251,7 +1260,7 @@ var StringUtils = /** @class */ (function () {
     return StringUtils;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1431,12 +1440,12 @@ var Logger = /** @class */ (function () {
     return Logger;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /* eslint-disable header/header */
 var name$1 = "@azure/msal-common";
-var version$1 = "5.2.0";
+var version$1 = "6.0.0";
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1447,7 +1456,7 @@ var version$1 = "5.2.0";
  *
  * Key:Value Schema:
  *
- * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+ * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
  *
  * Value Schema:
  * {
@@ -1461,6 +1470,7 @@ var version$1 = "5.2.0";
  *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
  *      oboAssertion: access token passed in as part of OBO request
  *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+ *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
  * }
  */
 var CredentialEntity = /** @class */ (function () {
@@ -1488,7 +1498,7 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      */
     CredentialEntity.prototype.generateCredentialKey = function () {
-        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+        return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
     };
     /**
      * returns the type of the cache (in this case credential)
@@ -1532,16 +1542,14 @@ var CredentialEntity = /** @class */ (function () {
      * generates credential key
      * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
      */
-    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+    CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
         var credentialKey = [
             this.generateAccountIdForCacheKey(homeAccountId, environment),
             this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-            this.generateTargetForCacheKey(target)
+            this.generateTargetForCacheKey(target),
+            this.generateClaimsHashForCacheKey(requestedClaimsHash),
+            this.generateSchemeForCacheKey(tokenType)
         ];
-        // PoP Tokens and SSH certs include scheme in cache key
-        if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
-            credentialKey.push(tokenType.toLowerCase());
-        }
         return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
     };
     /**
@@ -1577,10 +1585,26 @@ var CredentialEntity = /** @class */ (function () {
     CredentialEntity.generateTargetForCacheKey = function (scopes) {
         return (scopes || "").toLowerCase();
     };
+    /**
+     * Generate requested claims key component as per schema: <requestedClaims>
+     */
+    CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+        return (requestedClaimsHash || "").toLowerCase();
+    };
+    /**
+     * Generate scheme key componenet as per schema: <scheme>
+     */
+    CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+        /*
+         * PoP Tokens and SSH certs include scheme in cache key
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+    };
     return CredentialEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1825,7 +1849,7 @@ var ClientConfigurationError = /** @class */ (function (_super) {
     return ClientConfigurationError;
 }(ClientAuthError));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2009,7 +2033,7 @@ var ScopeSet = /** @class */ (function () {
     return ScopeSet;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2047,7 +2071,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2061,7 +2085,7 @@ var AuthorityType;
     AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
 })(AuthorityType || (AuthorityType = {}));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2295,7 +2319,7 @@ var AccountEntity = /** @class */ (function () {
     return AccountEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2333,7 +2357,7 @@ var AuthToken = /** @class */ (function () {
     return AuthToken;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2423,7 +2447,8 @@ var CacheManager = /** @class */ (function () {
                             environment: credential.environment,
                             homeAccountId: credential.homeAccountId,
                             realm: credential.realm,
-                            tokenType: credential.tokenType
+                            tokenType: credential.tokenType,
+                            requestedClaimsHash: credential.requestedClaimsHash
                         });
                         currentScopes = ScopeSet.fromString(credential.target);
                         currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2495,7 +2520,7 @@ var CacheManager = /** @class */ (function () {
      * @param target
      */
     CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
+        return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
     };
     /**
      * Support function to help match credentials
@@ -2508,7 +2533,7 @@ var CacheManager = /** @class */ (function () {
      * @param oboAssertion
      * @param tokenType
      */
-    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
+    CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
         var _this = this;
         var allCacheKeys = this.getKeys();
         var matchingCredentials = {
@@ -2555,38 +2580,37 @@ var CacheManager = /** @class */ (function () {
             if (!!target && !_this.matchTarget(entity, target)) {
                 return;
             }
+            // If request OR cached entity has requested Claims Hash, check if they match
+            if (requestedClaimsHash || entity.requestedClaimsHash) {
+                // Don't match if either is undefined or they are different
+                if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                    return;
+                }
+            }
             // Access Token with Auth Scheme specific matching
             if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                 if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                     return;
                 }
-                switch (tokenType) {
-                    case exports.AuthenticationScheme.POP:
-                        // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                        if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                            // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
-                            _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
-                            return;
-                        }
-                        break;
-                    case exports.AuthenticationScheme.SSH:
-                        // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                        if (keyId && !_this.matchKeyId(entity, keyId)) {
-                            return;
-                        }
-                        break;
+                // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                if (tokenType === exports.AuthenticationScheme.SSH) {
+                    if (keyId && !_this.matchKeyId(entity, keyId)) {
+                        return;
+                    }
                 }
             }
+            // At this point, the entity matches the request, update cache key if key schema has changed
+            var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
             switch (credType) {
                 case CredentialType.ID_TOKEN:
-                    matchingCredentials.idTokens[cacheKey] = entity;
+                    matchingCredentials.idTokens[updatedCacheKey] = entity;
                     break;
                 case CredentialType.ACCESS_TOKEN:
                 case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                    matchingCredentials.accessTokens[cacheKey] = entity;
+                    matchingCredentials.accessTokens[updatedCacheKey] = entity;
                     break;
                 case CredentialType.REFRESH_TOKEN:
-                    matchingCredentials.refreshTokens[cacheKey] = entity;
+                    matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                     break;
             }
         });
@@ -2785,10 +2809,10 @@ var CacheManager = /** @class */ (function () {
      * @param environment
      * @param authScheme
      */
-    CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
+    CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
         var cachedAccount = this.readAccountFromCache(account);
         var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
+        var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
         var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
         var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
         if (cachedAccount && cachedIdToken) {
@@ -2842,9 +2866,14 @@ var CacheManager = /** @class */ (function () {
      * @param scopes
      * @param authScheme
      */
-    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
-        // Distinguish between Bearer and PoP/SSH token cache types
-        var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
+    CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+        var scopes = new ScopeSet(request.scopes || []);
+        var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+        /*
+         * Distinguish between Bearer and PoP/SSH token cache types
+         * Cast to lowercase to handle "bearer" from ADFS
+         */
+        var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
         var accessTokenFilter = {
             homeAccountId: account.homeAccountId,
             environment: account.environment,
@@ -2853,7 +2882,8 @@ var CacheManager = /** @class */ (function () {
             realm: account.tenantId,
             target: scopes.printScopesLowerCase(),
             tokenType: authScheme,
-            keyId: keyId
+            keyId: request.sshKid,
+            requestedClaimsHash: request.requestedClaimsHash
         };
         var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
         var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -3162,10 +3192,14 @@ var DefaultStorageClass = /** @class */ (function (_super) {
             });
         });
     };
+    DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+        var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+        throw AuthError.createUnexpectedError(notImplErr);
+    };
     return DefaultStorageClass;
 }(CacheManager));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3247,7 +3281,7 @@ function buildAuthOptions(authOptions) {
     return __assign({ clientCapabilities: [] }, authOptions);
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3267,7 +3301,7 @@ var ServerError = /** @class */ (function (_super) {
     return ServerError;
 }(AuthError));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3350,11 +3384,11 @@ var ThrottlingUtils = /** @class */ (function () {
             authority: request.authority,
             scopes: request.scopes,
             homeAccountIdentifier: homeAccountIdentifier,
+            claims: request.claims,
             authenticationScheme: request.authenticationScheme,
             resourceRequestMethod: request.resourceRequestMethod,
             resourceRequestUri: request.resourceRequestUri,
             shrClaims: request.shrClaims,
-            sshJwk: request.sshJwk,
             sshKid: request.sshKid
         };
         var key = this.generateThrottlingStorageKey(thumbprint);
@@ -3363,7 +3397,7 @@ var ThrottlingUtils = /** @class */ (function () {
     return ThrottlingUtils;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3412,7 +3446,7 @@ var NetworkManager = /** @class */ (function () {
     return NetworkManager;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -3423,7 +3457,7 @@ var CcsCredentialType;
     CcsCredentialType["UPN"] = "UPN";
 })(CcsCredentialType || (CcsCredentialType = {}));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3512,7 +3546,7 @@ var BaseClient = /** @class */ (function () {
     return BaseClient;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3598,7 +3632,7 @@ var RequestValidator = /** @class */ (function () {
     return RequestValidator;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3938,7 +3972,7 @@ var RequestParameterBuilder = /** @class */ (function () {
     return RequestParameterBuilder;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4003,7 +4037,7 @@ var IdTokenEntity = /** @class */ (function (_super) {
     return IdTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4053,7 +4087,7 @@ var TimeUtils = /** @class */ (function () {
     return TimeUtils;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4099,8 +4133,8 @@ var AccessTokenEntity = /** @class */ (function (_super) {
      * @param expiresOn
      * @param extExpiresOn
      */
-    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
-        var _a;
+    AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+        var _a, _b;
         var atEntity = new AccessTokenEntity();
         atEntity.homeAccountId = homeAccountId;
         atEntity.credentialType = CredentialType.ACCESS_TOKEN;
@@ -4122,14 +4156,21 @@ var AccessTokenEntity = /** @class */ (function (_super) {
         atEntity.target = scopes;
         atEntity.oboAssertion = oboAssertion;
         atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-        // Create Access Token With Auth Scheme instead of regular access token
-        if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
+        if (requestedClaims) {
+            atEntity.requestedClaims = requestedClaims;
+            atEntity.requestedClaimsHash = requestedClaimsHash;
+        }
+        /*
+         * Create Access Token With Auth Scheme instead of regular access token
+         * Cast to lower to handle "bearer" from ADFS
+         */
+        if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
             atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
             switch (atEntity.tokenType) {
                 case exports.AuthenticationScheme.POP:
                     // Make sure keyId is present and add it to credential
                     var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                    if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                    if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
                         throw ClientAuthError.createTokenClaimsRequiredError();
                     }
                     atEntity.keyId = tokenClaims.cnf.kid;
@@ -4160,7 +4201,7 @@ var AccessTokenEntity = /** @class */ (function (_super) {
     return AccessTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4227,7 +4268,7 @@ var RefreshTokenEntity = /** @class */ (function (_super) {
     return RefreshTokenEntity;
 }(CredentialEntity));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4291,7 +4332,7 @@ var InteractionRequiredAuthError = /** @class */ (function (_super) {
     return InteractionRequiredAuthError;
 }(AuthError));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4307,7 +4348,7 @@ var CacheRecord = /** @class */ (function () {
     return CacheRecord;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4378,7 +4419,7 @@ var ProtocolUtils = /** @class */ (function () {
     return ProtocolUtils;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4579,7 +4620,7 @@ var UrlString = /** @class */ (function () {
     return UrlString;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4654,7 +4695,7 @@ var PopTokenGenerator = /** @class */ (function () {
     return PopTokenGenerator;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4724,7 +4765,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return AppMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4760,7 +4801,7 @@ var AppMetadataEntity = /** @class */ (function () {
     return TokenCacheContext;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4843,7 +4884,7 @@ var ResponseHandler = /** @class */ (function () {
                         }
                         // Add keyId from request to serverTokenResponse if defined
                         serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                        cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, , 5, 8]);
@@ -4891,7 +4932,7 @@ var ResponseHandler = /** @class */ (function () {
      * @param idTokenObj
      * @param authority
      */
-    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+    ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
         var env = authority.getPreferredCache();
         if (StringUtils.isEmpty(env)) {
             throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4907,7 +4948,7 @@ var ResponseHandler = /** @class */ (function () {
         var cachedAccessToken = null;
         if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
             // If scopes not returned in server response, use request scopes
-            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+            var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
             /*
              * Use timestamp calculated before request
              * Server may return timestamps as strings, parse to numbers if so.
@@ -4919,7 +4960,7 @@ var ResponseHandler = /** @class */ (function () {
             var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
             var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
             // non AAD scenarios can have empty realm
-            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
+            cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
         }
         // refreshToken
         var cachedRefreshToken = null;
@@ -5025,7 +5066,7 @@ var ResponseHandler = /** @class */ (function () {
     return ResponseHandler;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5140,11 +5181,11 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         return [4 /*yield*/, this.createTokenRequestBody(request)];
@@ -5433,7 +5474,7 @@ var AuthorizationCodeClient = /** @class */ (function (_super) {
     return AuthorizationCodeClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5544,11 +5585,11 @@ var RefreshTokenClient = /** @class */ (function (_super) {
                             clientId: this.config.authOptions.clientId,
                             authority: authority.canonicalAuthority,
                             scopes: request.scopes,
+                            claims: request.claims,
                             authenticationScheme: request.authenticationScheme,
                             resourceRequestMethod: request.resourceRequestMethod,
                             resourceRequestUri: request.resourceRequestUri,
                             shrClaims: request.shrClaims,
-                            sshJwk: request.sshJwk,
                             sshKid: request.sshKid
                         };
                         endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
@@ -5644,7 +5685,7 @@ var RefreshTokenClient = /** @class */ (function (_super) {
     return RefreshTokenClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5690,7 +5731,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     SilentFlowClient.prototype.acquireCachedToken = function (request) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
-            var requestScopes, environment, authScheme, cacheRecord;
+            var environment, cacheRecord;
             return __generator(this, function (_e) {
                 switch (_e.label) {
                     case 0:
@@ -5704,19 +5745,12 @@ var SilentFlowClient = /** @class */ (function (_super) {
                             this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                             throw ClientAuthError.createRefreshRequiredError();
                         }
-                        else if (!StringUtils.isEmptyObj(request.claims)) {
-                            // Must refresh due to request parameters.
-                            this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
-                            throw ClientAuthError.createRefreshRequiredError();
-                        }
                         // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                         if (!request.account) {
                             throw ClientAuthError.createNoAccountInSilentRequestError();
                         }
-                        requestScopes = new ScopeSet(request.scopes || []);
                         environment = request.authority || this.authority.getPreferredCache();
-                        authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                        cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
                         if (!cacheRecord.accessToken) {
                             // Must refresh due to non-existent access_token.
                             (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -5767,7 +5801,7 @@ var SilentFlowClient = /** @class */ (function (_super) {
     return SilentFlowClient;
 }(BaseClient));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5778,7 +5812,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("issuer"));
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5792,7 +5826,7 @@ exports.ProtocolMode = void 0;
     ProtocolMode["OIDC"] = "OIDC";
 })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5867,7 +5901,7 @@ var AuthorityMetadataEntity = /** @class */ (function () {
     return AuthorityMetadataEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5877,7 +5911,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5991,7 +6025,7 @@ var RegionDiscovery = /** @class */ (function () {
     return RegionDiscovery;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6557,7 +6591,7 @@ var Authority = /** @class */ (function () {
     return Authority;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6618,7 +6652,7 @@ var AuthorityFactory = /** @class */ (function () {
     return AuthorityFactory;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6649,7 +6683,7 @@ var ServerTelemetryEntity = /** @class */ (function () {
     return ServerTelemetryEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6677,7 +6711,7 @@ var ThrottlingEntity = /** @class */ (function () {
     return ThrottlingEntity;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6694,7 +6728,7 @@ var StubbedNetworkModule = {
     }
 };
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6753,7 +6787,7 @@ var AuthenticationHeaderParser = /** @class */ (function () {
     return AuthenticationHeaderParser;
 }());
 
-/*! @azure/msal-common v5.2.0 2021-12-07 */
+/*! @azure/msal-common v6.0.0 2022-01-04 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8695,7 +8729,7 @@ var CryptoOps = /** @class */ (function () {
      */
     CryptoOps.prototype.getPublicKeyThumbprint = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkBuffer, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
+            var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0: return [4 /*yield*/, this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES)];
@@ -8710,10 +8744,9 @@ var CryptoOps = /** @class */ (function () {
                             n: publicKeyJwk.n
                         };
                         publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
-                        return [4 /*yield*/, this.browserCrypto.sha256Digest(publicJwkString)];
+                        return [4 /*yield*/, this.hashString(publicJwkString)];
                     case 3:
-                        publicJwkBuffer = _a.sent();
-                        publicJwkHash = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
+                        publicJwkHash = _a.sent();
                         return [4 /*yield*/, this.browserCrypto.exportJwk(keyPair.privateKey)];
                     case 4:
                         privateKeyJwk = _a.sent();
@@ -8820,6 +8853,24 @@ var CryptoOps = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Returns the SHA-256 hash of an input string
+     * @param plainText
+     */
+    CryptoOps.prototype.hashString = function (plainText) {
+        return __awaiter$1(this, void 0, void 0, function () {
+            var hashBuffer, hashBytes;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.browserCrypto.sha256Digest(plainText)];
+                    case 1:
+                        hashBuffer = _a.sent();
+                        hashBytes = new Uint8Array(hashBuffer);
+                        return [2 /*return*/, this.b64Encode.urlEncodeArr(hashBytes)];
+                }
+            });
+        });
+    };
     CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
     CryptoOps.EXTRACTABLE = true;
     return CryptoOps;
@@ -9741,6 +9792,7 @@ var BrowserCacheManager = /** @class */ (function (_super) {
             }
         });
         this.clearMsalCookies();
+        this.setInteractionInProgress(false);
     };
     BrowserCacheManager.prototype.cacheCodeRequest = function (authCodeRequest, browserCrypto) {
         this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
@@ -9831,6 +9883,25 @@ var BrowserCacheManager = /** @class */ (function (_super) {
         }
         return null;
     };
+    /**
+     * Updates a credential's cache key if the current cache key is outdated
+     */
+    BrowserCacheManager.prototype.updateCredentialCacheKey = function (currentCacheKey, credential) {
+        var updatedCacheKey = credential.generateCredentialKey();
+        if (currentCacheKey !== updatedCacheKey) {
+            var cacheItem = this.getItem(currentCacheKey);
+            if (cacheItem) {
+                this.removeItem(currentCacheKey);
+                this.setItem(updatedCacheKey, cacheItem);
+                this.logger.verbose("Updated an outdated " + credential.credentialType + " cache key");
+                return updatedCacheKey;
+            }
+            else {
+                this.logger.error("Attempted to update an outdated " + credential.credentialType + " cache key but no item matching the outdated key was found in storage");
+            }
+        }
+        return currentCacheKey;
+    };
     return BrowserCacheManager;
 }(CacheManager));
 var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
@@ -10331,7 +10402,7 @@ function buildConfiguration(_a, isBrowserEnvironment) {
 
 /* eslint-disable header/header */
 var name = "@azure/msal-browser";
-var version = "2.20.0";
+var version = "2.21.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10548,28 +10619,43 @@ var BaseInteractionClient = /** @class */ (function () {
      * @param request
      */
     BaseInteractionClient.prototype.initializeBaseRequest = function (request) {
-        this.logger.verbose("Initializing BaseAuthRequest");
-        var authority = request.authority || this.config.auth.authority;
-        var scopes = __spread(((request && request.scopes) || []));
-        // Set authenticationScheme to BEARER if not explicitly set in the request
-        if (!request.authenticationScheme) {
-            request.authenticationScheme = exports.AuthenticationScheme.BEARER;
-            this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
-        }
-        else {
-            if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
-                if (!request.sshJwk) {
-                    throw ClientConfigurationError.createMissingSshJwkError();
-                }
-                if (!request.sshKid) {
-                    throw ClientConfigurationError.createMissingSshKidError();
+        return __awaiter$1(this, void 0, void 0, function () {
+            var authority, scopes, _a, validatedRequest;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.verbose("Initializing BaseAuthRequest");
+                        authority = request.authority || this.config.auth.authority;
+                        scopes = __spread(((request && request.scopes) || []));
+                        // Set authenticationScheme to BEARER if not explicitly set in the request
+                        if (!request.authenticationScheme) {
+                            request.authenticationScheme = exports.AuthenticationScheme.BEARER;
+                            this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
+                        }
+                        else {
+                            if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                if (!request.sshJwk) {
+                                    throw ClientConfigurationError.createMissingSshJwkError();
+                                }
+                                if (!request.sshKid) {
+                                    throw ClientConfigurationError.createMissingSshKidError();
+                                }
+                            }
+                            this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
+                        }
+                        if (!(request.claims && !StringUtils.isEmpty(request.claims))) return [3 /*break*/, 2];
+                        _a = request;
+                        return [4 /*yield*/, this.browserCrypto.hashString(request.claims)];
+                    case 1:
+                        _a.requestedClaimsHash = _b.sent();
+                        _b.label = 2;
+                    case 2:
+                        validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
+                            scopes: scopes });
+                        return [2 /*return*/, validatedRequest];
                 }
-            }
-            this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
-        }
-        var validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
-            scopes: scopes });
-        return validatedRequest;
+            });
+        });
     };
     /**
      *
@@ -10799,14 +10885,22 @@ var StandardInteractionClient = /** @class */ (function (_super) {
      * @param interactionType
      */
     StandardInteractionClient.prototype.preflightInteractiveRequest = function (request, interactionType) {
-        this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
-        // block the reload if it occurred inside a hidden iframe
-        BrowserUtils.blockReloadInHiddenIframes();
-        // Check if interaction is in progress. Throw error if true.
-        if (this.browserStorage.isInteractionInProgress(false)) {
-            throw BrowserAuthError.createInteractionInProgressError();
-        }
-        return this.initializeAuthorizationRequest(request, interactionType);
+        return __awaiter$1(this, void 0, void 0, function () {
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
+                        // block the reload if it occurred inside a hidden iframe
+                        BrowserUtils.blockReloadInHiddenIframes();
+                        // Check if interaction is in progress. Throw error if true.
+                        if (this.browserStorage.isInteractionInProgress(false)) {
+                            throw BrowserAuthError.createInteractionInProgressError();
+                        }
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(request, interactionType)];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
     };
     /**
      * Helper to initialize required request parameters for interactive APIs and ssoSilent()
@@ -10814,28 +10908,39 @@ var StandardInteractionClient = /** @class */ (function (_super) {
      * @param interactionType
      */
     StandardInteractionClient.prototype.initializeAuthorizationRequest = function (request, interactionType) {
-        this.logger.verbose("initializeAuthorizationRequest called");
-        var redirectUri = this.getRedirectUri(request.redirectUri);
-        var browserState = {
-            interactionType: interactionType
-        };
-        var state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
-        var validatedRequest = __assign$1(__assign$1({}, this.initializeBaseRequest(request)), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT });
-        var account = request.account || this.browserStorage.getActiveAccount();
-        if (account) {
-            this.logger.verbose("Setting validated request account");
-            this.logger.verbosePii("Setting validated request account: " + account);
-            validatedRequest.account = account;
-        }
-        // Check for ADAL/MSAL v1 SSO
-        if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
-            var legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-            if (legacyLoginHint) {
-                validatedRequest.loginHint = legacyLoginHint;
-            }
-        }
-        this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
-        return validatedRequest;
+        return __awaiter$1(this, void 0, void 0, function () {
+            var redirectUri, browserState, state, validatedRequest, _a, account, legacyLoginHint;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        this.logger.verbose("initializeAuthorizationRequest called");
+                        redirectUri = this.getRedirectUri(request.redirectUri);
+                        browserState = {
+                            interactionType: interactionType
+                        };
+                        state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
+                        _a = [{}];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1:
+                        validatedRequest = __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT }]);
+                        account = request.account || this.browserStorage.getActiveAccount();
+                        if (account) {
+                            this.logger.verbose("Setting validated request account");
+                            this.logger.verbosePii("Setting validated request account: " + account);
+                            validatedRequest.account = account;
+                        }
+                        // Check for ADAL/MSAL v1 SSO
+                        if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
+                            legacyLoginHint = this.browserStorage.getLegacyLoginHint();
+                            if (legacyLoginHint) {
+                                validatedRequest.loginHint = legacyLoginHint;
+                            }
+                        }
+                        this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
+                        return [2 /*return*/, validatedRequest];
+                }
+            });
+        });
     };
     return StandardInteractionClient;
 }(BaseInteractionClient));
@@ -11225,26 +11330,36 @@ var PopupClient = /** @class */ (function (_super) {
      * @param request
      */
     PopupClient.prototype.acquireToken = function (request) {
-        try {
-            var validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Popup);
-            var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
-            var popupWindowAttributes = request.popupWindowAttributes || {};
-            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-            if (this.config.system.asyncPopups) {
-                this.logger.verbose("asyncPopups set to true, acquiring token");
-                // Passes on popup position and dimensions if in request
-                return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes);
-            }
-            else {
-                // asyncPopups flag is set to false. Opens popup before acquiring token.
-                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup);
-            }
-        }
-        catch (e) {
-            return Promise.reject(e);
-        }
+        return __awaiter$1(this, void 0, void 0, function () {
+            var validRequest, popupName, popupWindowAttributes, popup, e_1;
+            return __generator$1(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        _a.trys.push([0, 2, , 3]);
+                        return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Popup)];
+                    case 1:
+                        validRequest = _a.sent();
+                        popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
+                        popupWindowAttributes = request.popupWindowAttributes || {};
+                        // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+                        if (this.config.system.asyncPopups) {
+                            this.logger.verbose("asyncPopups set to true, acquiring token");
+                            // Passes on popup position and dimensions if in request
+                            return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes)];
+                        }
+                        else {
+                            // asyncPopups flag is set to false. Opens popup before acquiring token.
+                            this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                            popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                            return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup)];
+                        }
+                    case 2:
+                        e_1 = _a.sent();
+                        return [2 /*return*/, Promise.reject(e_1)];
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
     };
     /**
      * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
@@ -11287,7 +11402,7 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.acquireTokenPopupAsync = function (validRequest, popupName, popupWindowAttributes, popup) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+            var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_2;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -11325,17 +11440,17 @@ var PopupClient = /** @class */ (function (_super) {
                         result = _a.sent();
                         return [2 /*return*/, result];
                     case 7:
-                        e_1 = _a.sent();
+                        e_2 = _a.sent();
                         if (popup) {
                             // Close the synchronous popup if an error is thrown before the window unload event is registered
                             popup.close();
                         }
-                        if (e_1 instanceof AuthError) {
-                            e_1.setCorrelationId(this.correlationId);
+                        if (e_2 instanceof AuthError) {
+                            e_2.setCorrelationId(this.correlationId);
                         }
-                        serverTelemetryManager.cacheFailedRequest(e_1);
+                        serverTelemetryManager.cacheFailedRequest(e_2);
                         this.browserStorage.cleanRequestByState(validRequest.state);
-                        throw e_1;
+                        throw e_2;
                     case 8: return [2 /*return*/];
                 }
             });
@@ -11352,7 +11467,7 @@ var PopupClient = /** @class */ (function (_super) {
      */
     PopupClient.prototype.logoutPopupAsync = function (validRequest, popupName, popupWindowAttributes, requestAuthority, popup, mainWindowRedirectUri) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_2, navigationOptions, absoluteUrl, e_3;
+            var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_3, navigationOptions, absoluteUrl, e_4;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -11388,8 +11503,8 @@ var PopupClient = /** @class */ (function (_super) {
                         this.logger.verbose("Popup successfully redirected to postLogoutRedirectUri");
                         return [3 /*break*/, 7];
                     case 6:
-                        e_2 = _a.sent();
-                        this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_2);
+                        e_3 = _a.sent();
+                        this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_3);
                         return [3 /*break*/, 7];
                     case 7:
                         popupUtils.cleanPopup(popupWindow);
@@ -11409,19 +11524,19 @@ var PopupClient = /** @class */ (function (_super) {
                         }
                         return [3 /*break*/, 9];
                     case 8:
-                        e_3 = _a.sent();
+                        e_4 = _a.sent();
                         if (popup) {
                             // Close the synchronous popup if an error is thrown before the window unload event is registered
                             popup.close();
                         }
-                        if (e_3 instanceof AuthError) {
-                            e_3.setCorrelationId(this.correlationId);
+                        if (e_4 instanceof AuthError) {
+                            e_4.setCorrelationId(this.correlationId);
                         }
                         this.browserStorage.setInteractionInProgress(false);
-                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_3);
+                        this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_4);
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
-                        serverTelemetryManager.cacheFailedRequest(e_3);
-                        throw e_3;
+                        serverTelemetryManager.cacheFailedRequest(e_4);
+                        throw e_4;
                     case 9:
                         this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
                         return [2 /*return*/];
@@ -11579,22 +11694,23 @@ var RedirectClient = /** @class */ (function (_super) {
             var validRequest, serverTelemetryManager, authCodeRequest, authClient, interactionHandler, navigateUrl, redirectStartPage, e_1;
             return __generator$1(this, function (_a) {
                 switch (_a.label) {
-                    case 0:
-                        validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Redirect);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
-                        _a.label = 1;
+                    case 0: return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Redirect)];
                     case 1:
-                        _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                        validRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
+                        _a.label = 2;
                     case 2:
+                        _a.trys.push([2, 7, , 8]);
+                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                    case 3:
                         authCodeRequest = _a.sent();
                         return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority)];
-                    case 3:
+                    case 4:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
                         return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
-                    case 4:
+                    case 5:
                         navigateUrl = _a.sent();
                         redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                         this.logger.verbosePii("Redirect start page: " + redirectStartPage);
@@ -11604,10 +11720,10 @@ var RedirectClient = /** @class */ (function (_super) {
                                 redirectStartPage: redirectStartPage,
                                 onRedirectNavigate: request.onRedirectNavigate
                             })];
-                    case 5: 
+                    case 6: 
                     // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
                     return [2 /*return*/, _a.sent()];
-                    case 6:
+                    case 7:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -11615,7 +11731,7 @@ var RedirectClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(validRequest.state);
                         throw e_1;
-                    case 7: return [2 /*return*/];
+                    case 8: return [2 /*return*/];
                 }
             });
         });
@@ -12031,24 +12147,26 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         if (request.prompt && request.prompt !== PromptValue.NONE) {
                             throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                         }
-                        silentRequest = this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                        _a.label = 1;
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
                     case 1:
-                        _a.trys.push([1, 6, , 7]);
-                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                        silentRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                        _a.label = 2;
                     case 2:
+                        _a.trys.push([2, 7, , 8]);
+                        return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                    case 3:
                         authCodeRequest = _a.sent();
                         return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority)];
-                    case 3:
+                    case 4:
                         authClient = _a.sent();
                         this.logger.verbose("Auth code client created");
                         return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                    case 4:
+                    case 5:
                         navigateUrl = _a.sent();
                         return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)];
-                    case 5: return [2 /*return*/, _a.sent()];
-                    case 6:
+                    case 6: return [2 /*return*/, _a.sent()];
+                    case 7:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -12056,7 +12174,7 @@ var SilentIframeClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(silentRequest.state);
                         throw e_1;
-                    case 7: return [2 /*return*/];
+                    case 8: return [2 /*return*/];
                 }
             });
         });
@@ -12112,16 +12230,19 @@ var SilentRefreshClient = /** @class */ (function (_super) {
      */
     SilentRefreshClient.prototype.acquireToken = function (request) {
         return __awaiter$1(this, void 0, void 0, function () {
-            var silentRequest, serverTelemetryManager, refreshTokenClient;
+            var silentRequest, _a, serverTelemetryManager, refreshTokenClient;
             var _this = this;
-            return __generator$1(this, function (_a) {
-                switch (_a.label) {
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
                     case 0:
-                        silentRequest = __assign$1(__assign$1({}, request), this.initializeBaseRequest(request));
+                        _a = [__assign$1({}, request)];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1:
+                        silentRequest = __assign$1.apply(void 0, _a.concat([_b.sent()]));
                         serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
                         return [4 /*yield*/, this.createRefreshTokenClient(serverTelemetryManager, silentRequest.authority)];
-                    case 1:
-                        refreshTokenClient = _a.sent();
+                    case 2:
+                        refreshTokenClient = _b.sent();
                         this.logger.verbose("Refresh token client created");
                         // Send request to renew token. Auth module will throw errors if token cannot be renewed.
                         return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(silentRequest).catch(function (e) {
@@ -12320,14 +12441,16 @@ var SilentAuthCodeClient = /** @class */ (function (_super) {
                         if (!request.code) {
                             throw BrowserAuthError.createAuthCodeRequiredError();
                         }
-                        silentRequest = this.initializeAuthorizationRequest(request, exports.InteractionType.Silent);
-                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                        _a.label = 1;
+                        return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Silent)];
                     case 1:
-                        _a.trys.push([1, 3, , 4]);
+                        silentRequest = _a.sent();
+                        serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                        _a.label = 2;
+                    case 2:
+                        _a.trys.push([2, 4, , 5]);
                         authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
                         return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
-                    case 2:
+                    case 3:
                         clientConfig = _a.sent();
                         authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
                         this.logger.verbose("Auth code client created");
@@ -12339,7 +12462,7 @@ var SilentAuthCodeClient = /** @class */ (function (_super) {
                                 cloud_graph_host_name: request.cloudGraphHostName,
                                 cloud_instance_host_name: request.cloudInstanceHostName
                             }, silentRequest.state, authClient.authority, this.networkClient, false)];
-                    case 3:
+                    case 4:
                         e_1 = _a.sent();
                         if (e_1 instanceof AuthError) {
                             e_1.setCorrelationId(this.correlationId);
@@ -12347,7 +12470,7 @@ var SilentAuthCodeClient = /** @class */ (function (_super) {
                         serverTelemetryManager.cacheFailedRequest(e_1);
                         this.browserStorage.cleanRequestByState(silentRequest.state);
                         throw e_1;
-                    case 4: return [2 /*return*/];
+                    case 5: return [2 /*return*/];
                 }
             });
         });
@@ -13006,7 +13129,17 @@ var SilentCacheClient = /** @class */ (function (_super) {
         });
     };
     SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-        return __assign$1(__assign$1(__assign$1({}, request), this.initializeBaseRequest(request)), { account: account, forceRefresh: request.forceRefresh || false });
+        return __awaiter$1(this, void 0, void 0, function () {
+            var _a;
+            return __generator$1(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _a = [__assign$1({}, request)];
+                        return [4 /*yield*/, this.initializeBaseRequest(request)];
+                    case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                }
+            });
+        });
     };
     return SilentCacheClient;
 }(StandardInteractionClient));
@@ -13097,11 +13230,11 @@ var PublicClientApplication = /** @class */ (function (_super) {
                     authority: request.authority || "",
                     scopes: request.scopes,
                     homeAccountIdentifier: account.homeAccountId,
+                    claims: request.claims,
                     authenticationScheme: request.authenticationScheme,
                     resourceRequestMethod: request.resourceRequestMethod,
                     resourceRequestUri: request.resourceRequestUri,
                     shrClaims: request.shrClaims,
-                    sshJwk: request.sshJwk,
                     sshKid: request.sshKid
                 };
                 silentRequestKey = JSON.stringify(thumbprint);
@@ -13138,28 +13271,33 @@ var PublicClientApplication = /** @class */ (function (_super) {
             var silentCacheClient, silentRequest;
             var _this = this;
             return __generator$1(this, function (_a) {
-                silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
-                silentRequest = silentCacheClient.initializeSilentRequest(request, account);
-                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                        var tokenRenewalResult, tokenRenewalError_1;
-                        return __generator$1(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    _a.trys.push([0, 2, , 3]);
-                                    return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                case 1:
-                                    tokenRenewalResult = _a.sent();
-                                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                    return [2 /*return*/, tokenRenewalResult];
-                                case 2:
-                                    tokenRenewalError_1 = _a.sent();
-                                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                    throw tokenRenewalError_1;
-                                case 3: return [2 /*return*/];
-                            }
-                        });
-                    }); })];
+                switch (_a.label) {
+                    case 0:
+                        silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
+                        return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                    case 1:
+                        silentRequest = _a.sent();
+                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
+                        return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                                var tokenRenewalResult, tokenRenewalError_1;
+                                return __generator$1(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            _a.trys.push([0, 2, , 3]);
+                                            return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
+                                        case 1:
+                                            tokenRenewalResult = _a.sent();
+                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
+                                            return [2 /*return*/, tokenRenewalResult];
+                                        case 2:
+                                            tokenRenewalError_1 = _a.sent();
+                                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
+                                            throw tokenRenewalError_1;
+                                        case 3: return [2 /*return*/];
+                                    }
+                                });
+                            }); })];
+                }
             });
         });
     };