@azure/msal-browser 2.20.0 → 2.21.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.20.0 2021-12-07 */
+/*! @azure/msal-browser v2.21.0 2022-01-04 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -556,7 +556,7 @@
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
     })(CacheOutcome || (CacheOutcome = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -600,7 +600,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -663,10 +663,19 @@
                     throw AuthError.createUnexpectedError(notImplErr);
                 });
             });
+        },
+        hashString: function () {
+            return __awaiter(this, void 0, void 0, function () {
+                var notImplErr;
+                return __generator(this, function (_a) {
+                    notImplErr = "Crypto interface - hashString() has not been implemented";
+                    throw AuthError.createUnexpectedError(notImplErr);
+                });
+            });
         }
     };
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1128,7 +1137,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1253,7 +1262,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1433,12 +1442,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "5.2.0";
+    var version$1 = "6.0.0";
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1449,7 +1458,7 @@
      *
      * Key:Value Schema:
      *
-     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
      *
      * Value Schema:
      * {
@@ -1463,6 +1472,7 @@
      *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
      *      oboAssertion: access token passed in as part of OBO request
      *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+     *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
      * }
      */
     var CredentialEntity = /** @class */ (function () {
@@ -1490,7 +1500,7 @@
          * generates credential key
          */
         CredentialEntity.prototype.generateCredentialKey = function () {
-            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
         };
         /**
          * returns the type of the cache (in this case credential)
@@ -1534,16 +1544,14 @@
          * generates credential key
          * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
          */
-        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
             var credentialKey = [
                 this.generateAccountIdForCacheKey(homeAccountId, environment),
                 this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-                this.generateTargetForCacheKey(target)
+                this.generateTargetForCacheKey(target),
+                this.generateClaimsHashForCacheKey(requestedClaimsHash),
+                this.generateSchemeForCacheKey(tokenType)
             ];
-            // PoP Tokens and SSH certs include scheme in cache key
-            if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
-                credentialKey.push(tokenType.toLowerCase());
-            }
             return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
         };
         /**
@@ -1579,10 +1587,26 @@
         CredentialEntity.generateTargetForCacheKey = function (scopes) {
             return (scopes || "").toLowerCase();
         };
+        /**
+         * Generate requested claims key component as per schema: <requestedClaims>
+         */
+        CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+            return (requestedClaimsHash || "").toLowerCase();
+        };
+        /**
+         * Generate scheme key componenet as per schema: <scheme>
+         */
+        CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+            /*
+             * PoP Tokens and SSH certs include scheme in cache key
+             * Cast to lowercase to handle "bearer" from ADFS
+             */
+            return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+        };
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1827,7 +1851,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2011,7 +2035,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2049,7 +2073,7 @@
         };
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2063,7 +2087,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2297,7 +2321,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2335,7 +2359,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2425,7 +2449,8 @@
                                 environment: credential.environment,
                                 homeAccountId: credential.homeAccountId,
                                 realm: credential.realm,
-                                tokenType: credential.tokenType
+                                tokenType: credential.tokenType,
+                                requestedClaimsHash: credential.requestedClaimsHash
                             });
                             currentScopes = ScopeSet.fromString(credential.target);
                             currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2497,7 +2522,7 @@
          * @param target
          */
         CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
+            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
         };
         /**
          * Support function to help match credentials
@@ -2510,7 +2535,7 @@
          * @param oboAssertion
          * @param tokenType
          */
-        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
+        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingCredentials = {
@@ -2557,38 +2582,37 @@
                 if (!!target && !_this.matchTarget(entity, target)) {
                     return;
                 }
+                // If request OR cached entity has requested Claims Hash, check if they match
+                if (requestedClaimsHash || entity.requestedClaimsHash) {
+                    // Don't match if either is undefined or they are different
+                    if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                        return;
+                    }
+                }
                 // Access Token with Auth Scheme specific matching
                 if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                     if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                         return;
                     }
-                    switch (tokenType) {
-                        case exports.AuthenticationScheme.POP:
-                            // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                            if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                                // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
-                                _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
-                                return;
-                            }
-                            break;
-                        case exports.AuthenticationScheme.SSH:
-                            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                            if (keyId && !_this.matchKeyId(entity, keyId)) {
-                                return;
-                            }
-                            break;
+                    // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                    if (tokenType === exports.AuthenticationScheme.SSH) {
+                        if (keyId && !_this.matchKeyId(entity, keyId)) {
+                            return;
+                        }
                     }
                 }
+                // At this point, the entity matches the request, update cache key if key schema has changed
+                var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
                 switch (credType) {
                     case CredentialType.ID_TOKEN:
-                        matchingCredentials.idTokens[cacheKey] = entity;
+                        matchingCredentials.idTokens[updatedCacheKey] = entity;
                         break;
                     case CredentialType.ACCESS_TOKEN:
                     case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                        matchingCredentials.accessTokens[cacheKey] = entity;
+                        matchingCredentials.accessTokens[updatedCacheKey] = entity;
                         break;
                     case CredentialType.REFRESH_TOKEN:
-                        matchingCredentials.refreshTokens[cacheKey] = entity;
+                        matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                         break;
                 }
             });
@@ -2787,10 +2811,10 @@
          * @param environment
          * @param authScheme
          */
-        CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
+        CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
             var cachedAccount = this.readAccountFromCache(account);
             var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
+            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
             var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
             var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
             if (cachedAccount && cachedIdToken) {
@@ -2844,9 +2868,14 @@
          * @param scopes
          * @param authScheme
          */
-        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
-            // Distinguish between Bearer and PoP/SSH token cache types
-            var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
+        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+            var scopes = new ScopeSet(request.scopes || []);
+            var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+            /*
+             * Distinguish between Bearer and PoP/SSH token cache types
+             * Cast to lowercase to handle "bearer" from ADFS
+             */
+            var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
             var accessTokenFilter = {
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
@@ -2855,7 +2884,8 @@
                 realm: account.tenantId,
                 target: scopes.printScopesLowerCase(),
                 tokenType: authScheme,
-                keyId: keyId
+                keyId: request.sshKid,
+                requestedClaimsHash: request.requestedClaimsHash
             };
             var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
             var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -3164,10 +3194,14 @@
                 });
             });
         };
+        DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+            var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+            throw AuthError.createUnexpectedError(notImplErr);
+        };
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3249,7 +3283,7 @@
         return __assign({ clientCapabilities: [] }, authOptions);
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3269,7 +3303,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3352,11 +3386,11 @@
                 authority: request.authority,
                 scopes: request.scopes,
                 homeAccountIdentifier: homeAccountIdentifier,
+                claims: request.claims,
                 authenticationScheme: request.authenticationScheme,
                 resourceRequestMethod: request.resourceRequestMethod,
                 resourceRequestUri: request.resourceRequestUri,
                 shrClaims: request.shrClaims,
-                sshJwk: request.sshJwk,
                 sshKid: request.sshKid
             };
             var key = this.generateThrottlingStorageKey(thumbprint);
@@ -3365,7 +3399,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3414,7 +3448,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3425,7 +3459,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3514,7 +3548,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3600,7 +3634,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3940,7 +3974,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4005,7 +4039,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4055,7 +4089,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4101,8 +4135,8 @@
          * @param expiresOn
          * @param extExpiresOn
          */
-        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
-            var _a;
+        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+            var _a, _b;
             var atEntity = new AccessTokenEntity();
             atEntity.homeAccountId = homeAccountId;
             atEntity.credentialType = CredentialType.ACCESS_TOKEN;
@@ -4124,14 +4158,21 @@
             atEntity.target = scopes;
             atEntity.oboAssertion = oboAssertion;
             atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-            // Create Access Token With Auth Scheme instead of regular access token
-            if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
+            if (requestedClaims) {
+                atEntity.requestedClaims = requestedClaims;
+                atEntity.requestedClaimsHash = requestedClaimsHash;
+            }
+            /*
+             * Create Access Token With Auth Scheme instead of regular access token
+             * Cast to lower to handle "bearer" from ADFS
+             */
+            if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
                 atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
                 switch (atEntity.tokenType) {
                     case exports.AuthenticationScheme.POP:
                         // Make sure keyId is present and add it to credential
                         var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                        if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                        if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
                             throw ClientAuthError.createTokenClaimsRequiredError();
                         }
                         atEntity.keyId = tokenClaims.cnf.kid;
@@ -4162,7 +4203,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4229,7 +4270,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4293,7 +4334,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4309,7 +4350,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4380,7 +4421,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4581,7 +4622,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4656,7 +4697,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4726,7 +4767,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4762,7 +4803,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4845,7 +4886,7 @@
                             }
                             // Add keyId from request to serverTokenResponse if defined
                             serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, , 5, 8]);
@@ -4893,7 +4934,7 @@
          * @param idTokenObj
          * @param authority
          */
-        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
             var env = authority.getPreferredCache();
             if (StringUtils.isEmpty(env)) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4909,7 +4950,7 @@
             var cachedAccessToken = null;
             if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
                 // If scopes not returned in server response, use request scopes
-                var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+                var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
                 /*
                  * Use timestamp calculated before request
                  * Server may return timestamps as strings, parse to numbers if so.
@@ -4921,7 +4962,7 @@
                 var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
                 var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
                 // non AAD scenarios can have empty realm
-                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
+                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
             }
             // refreshToken
             var cachedRefreshToken = null;
@@ -5027,7 +5068,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5142,11 +5183,11 @@
                                 clientId: this.config.authOptions.clientId,
                                 authority: authority.canonicalAuthority,
                                 scopes: request.scopes,
+                                claims: request.claims,
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
                                 shrClaims: request.shrClaims,
-                                sshJwk: request.sshJwk,
                                 sshKid: request.sshKid
                             };
                             return [4 /*yield*/, this.createTokenRequestBody(request)];
@@ -5435,7 +5476,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5546,11 +5587,11 @@
                                 clientId: this.config.authOptions.clientId,
                                 authority: authority.canonicalAuthority,
                                 scopes: request.scopes,
+                                claims: request.claims,
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
                                 shrClaims: request.shrClaims,
-                                sshJwk: request.sshJwk,
                                 sshKid: request.sshKid
                             };
                             endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
@@ -5646,7 +5687,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5692,7 +5733,7 @@
         SilentFlowClient.prototype.acquireCachedToken = function (request) {
             var _a, _b, _c, _d;
             return __awaiter(this, void 0, void 0, function () {
-                var requestScopes, environment, authScheme, cacheRecord;
+                var environment, cacheRecord;
                 return __generator(this, function (_e) {
                     switch (_e.label) {
                         case 0:
@@ -5706,19 +5747,12 @@
                                 this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                                 throw ClientAuthError.createRefreshRequiredError();
                             }
-                            else if (!StringUtils.isEmptyObj(request.claims)) {
-                                // Must refresh due to request parameters.
-                                this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
-                                throw ClientAuthError.createRefreshRequiredError();
-                            }
                             // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                             if (!request.account) {
                                 throw ClientAuthError.createNoAccountInSilentRequestError();
                             }
-                            requestScopes = new ScopeSet(request.scopes || []);
                             environment = request.authority || this.authority.getPreferredCache();
-                            authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
                             if (!cacheRecord.accessToken) {
                                 // Must refresh due to non-existent access_token.
                                 (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -5769,7 +5803,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5780,7 +5814,7 @@
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5794,7 +5828,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5869,7 +5903,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5879,7 +5913,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5993,7 +6027,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6559,7 +6593,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6620,7 +6654,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6651,7 +6685,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6679,7 +6713,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6696,7 +6730,7 @@
         }
     };
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6755,7 +6789,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.0.0 2022-01-04 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8697,7 +8731,7 @@
          */
         CryptoOps.prototype.getPublicKeyThumbprint = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkBuffer, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
+                var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0: return [4 /*yield*/, this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES)];
@@ -8712,10 +8746,9 @@
                                 n: publicKeyJwk.n
                             };
                             publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
-                            return [4 /*yield*/, this.browserCrypto.sha256Digest(publicJwkString)];
+                            return [4 /*yield*/, this.hashString(publicJwkString)];
                         case 3:
-                            publicJwkBuffer = _a.sent();
-                            publicJwkHash = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
+                            publicJwkHash = _a.sent();
                             return [4 /*yield*/, this.browserCrypto.exportJwk(keyPair.privateKey)];
                         case 4:
                             privateKeyJwk = _a.sent();
@@ -8822,6 +8855,24 @@
                 });
             });
         };
+        /**
+         * Returns the SHA-256 hash of an input string
+         * @param plainText
+         */
+        CryptoOps.prototype.hashString = function (plainText) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var hashBuffer, hashBytes;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.browserCrypto.sha256Digest(plainText)];
+                        case 1:
+                            hashBuffer = _a.sent();
+                            hashBytes = new Uint8Array(hashBuffer);
+                            return [2 /*return*/, this.b64Encode.urlEncodeArr(hashBytes)];
+                    }
+                });
+            });
+        };
         CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
         CryptoOps.EXTRACTABLE = true;
         return CryptoOps;
@@ -9743,6 +9794,7 @@
                 }
             });
             this.clearMsalCookies();
+            this.setInteractionInProgress(false);
         };
         BrowserCacheManager.prototype.cacheCodeRequest = function (authCodeRequest, browserCrypto) {
             this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
@@ -9833,6 +9885,25 @@
             }
             return null;
         };
+        /**
+         * Updates a credential's cache key if the current cache key is outdated
+         */
+        BrowserCacheManager.prototype.updateCredentialCacheKey = function (currentCacheKey, credential) {
+            var updatedCacheKey = credential.generateCredentialKey();
+            if (currentCacheKey !== updatedCacheKey) {
+                var cacheItem = this.getItem(currentCacheKey);
+                if (cacheItem) {
+                    this.removeItem(currentCacheKey);
+                    this.setItem(updatedCacheKey, cacheItem);
+                    this.logger.verbose("Updated an outdated " + credential.credentialType + " cache key");
+                    return updatedCacheKey;
+                }
+                else {
+                    this.logger.error("Attempted to update an outdated " + credential.credentialType + " cache key but no item matching the outdated key was found in storage");
+                }
+            }
+            return currentCacheKey;
+        };
         return BrowserCacheManager;
     }(CacheManager));
     var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
@@ -10333,7 +10404,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.20.0";
+    var version = "2.21.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10550,28 +10621,43 @@
          * @param request
          */
         BaseInteractionClient.prototype.initializeBaseRequest = function (request) {
-            this.logger.verbose("Initializing BaseAuthRequest");
-            var authority = request.authority || this.config.auth.authority;
-            var scopes = __spread(((request && request.scopes) || []));
-            // Set authenticationScheme to BEARER if not explicitly set in the request
-            if (!request.authenticationScheme) {
-                request.authenticationScheme = exports.AuthenticationScheme.BEARER;
-                this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
-            }
-            else {
-                if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
-                    if (!request.sshJwk) {
-                        throw ClientConfigurationError.createMissingSshJwkError();
-                    }
-                    if (!request.sshKid) {
-                        throw ClientConfigurationError.createMissingSshKidError();
+            return __awaiter$1(this, void 0, void 0, function () {
+                var authority, scopes, _a, validatedRequest;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.verbose("Initializing BaseAuthRequest");
+                            authority = request.authority || this.config.auth.authority;
+                            scopes = __spread(((request && request.scopes) || []));
+                            // Set authenticationScheme to BEARER if not explicitly set in the request
+                            if (!request.authenticationScheme) {
+                                request.authenticationScheme = exports.AuthenticationScheme.BEARER;
+                                this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
+                            }
+                            else {
+                                if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                    if (!request.sshJwk) {
+                                        throw ClientConfigurationError.createMissingSshJwkError();
+                                    }
+                                    if (!request.sshKid) {
+                                        throw ClientConfigurationError.createMissingSshKidError();
+                                    }
+                                }
+                                this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
+                            }
+                            if (!(request.claims && !StringUtils.isEmpty(request.claims))) return [3 /*break*/, 2];
+                            _a = request;
+                            return [4 /*yield*/, this.browserCrypto.hashString(request.claims)];
+                        case 1:
+                            _a.requestedClaimsHash = _b.sent();
+                            _b.label = 2;
+                        case 2:
+                            validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
+                                scopes: scopes });
+                            return [2 /*return*/, validatedRequest];
                     }
-                }
-                this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
-            }
-            var validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
-                scopes: scopes });
-            return validatedRequest;
+                });
+            });
         };
         /**
          *
@@ -10801,14 +10887,22 @@
          * @param interactionType
          */
         StandardInteractionClient.prototype.preflightInteractiveRequest = function (request, interactionType) {
-            this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
-            // block the reload if it occurred inside a hidden iframe
-            BrowserUtils.blockReloadInHiddenIframes();
-            // Check if interaction is in progress. Throw error if true.
-            if (this.browserStorage.isInteractionInProgress(false)) {
-                throw BrowserAuthError.createInteractionInProgressError();
-            }
-            return this.initializeAuthorizationRequest(request, interactionType);
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
+                            // block the reload if it occurred inside a hidden iframe
+                            BrowserUtils.blockReloadInHiddenIframes();
+                            // Check if interaction is in progress. Throw error if true.
+                            if (this.browserStorage.isInteractionInProgress(false)) {
+                                throw BrowserAuthError.createInteractionInProgressError();
+                            }
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(request, interactionType)];
+                        case 1: return [2 /*return*/, _a.sent()];
+                    }
+                });
+            });
         };
         /**
          * Helper to initialize required request parameters for interactive APIs and ssoSilent()
@@ -10816,28 +10910,39 @@
          * @param interactionType
          */
         StandardInteractionClient.prototype.initializeAuthorizationRequest = function (request, interactionType) {
-            this.logger.verbose("initializeAuthorizationRequest called");
-            var redirectUri = this.getRedirectUri(request.redirectUri);
-            var browserState = {
-                interactionType: interactionType
-            };
-            var state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
-            var validatedRequest = __assign$1(__assign$1({}, this.initializeBaseRequest(request)), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT });
-            var account = request.account || this.browserStorage.getActiveAccount();
-            if (account) {
-                this.logger.verbose("Setting validated request account");
-                this.logger.verbosePii("Setting validated request account: " + account);
-                validatedRequest.account = account;
-            }
-            // Check for ADAL/MSAL v1 SSO
-            if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
-                var legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-                if (legacyLoginHint) {
-                    validatedRequest.loginHint = legacyLoginHint;
-                }
-            }
-            this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
-            return validatedRequest;
+            return __awaiter$1(this, void 0, void 0, function () {
+                var redirectUri, browserState, state, validatedRequest, _a, account, legacyLoginHint;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.verbose("initializeAuthorizationRequest called");
+                            redirectUri = this.getRedirectUri(request.redirectUri);
+                            browserState = {
+                                interactionType: interactionType
+                            };
+                            state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
+                            _a = [{}];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1:
+                            validatedRequest = __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT }]);
+                            account = request.account || this.browserStorage.getActiveAccount();
+                            if (account) {
+                                this.logger.verbose("Setting validated request account");
+                                this.logger.verbosePii("Setting validated request account: " + account);
+                                validatedRequest.account = account;
+                            }
+                            // Check for ADAL/MSAL v1 SSO
+                            if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
+                                legacyLoginHint = this.browserStorage.getLegacyLoginHint();
+                                if (legacyLoginHint) {
+                                    validatedRequest.loginHint = legacyLoginHint;
+                                }
+                            }
+                            this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
+                            return [2 /*return*/, validatedRequest];
+                    }
+                });
+            });
         };
         return StandardInteractionClient;
     }(BaseInteractionClient));
@@ -11227,26 +11332,36 @@
          * @param request
          */
         PopupClient.prototype.acquireToken = function (request) {
-            try {
-                var validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Popup);
-                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
-                var popupWindowAttributes = request.popupWindowAttributes || {};
-                // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
-                if (this.config.system.asyncPopups) {
-                    this.logger.verbose("asyncPopups set to true, acquiring token");
-                    // Passes on popup position and dimensions if in request
-                    return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes);
-                }
-                else {
-                    // asyncPopups flag is set to false. Opens popup before acquiring token.
-                    this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                    var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                    return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup);
-                }
-            }
-            catch (e) {
-                return Promise.reject(e);
-            }
+            return __awaiter$1(this, void 0, void 0, function () {
+                var validRequest, popupName, popupWindowAttributes, popup, e_1;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            _a.trys.push([0, 2, , 3]);
+                            return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Popup)];
+                        case 1:
+                            validRequest = _a.sent();
+                            popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
+                            popupWindowAttributes = request.popupWindowAttributes || {};
+                            // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
+                            if (this.config.system.asyncPopups) {
+                                this.logger.verbose("asyncPopups set to true, acquiring token");
+                                // Passes on popup position and dimensions if in request
+                                return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes)];
+                            }
+                            else {
+                                // asyncPopups flag is set to false. Opens popup before acquiring token.
+                                this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
+                                popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                                return [2 /*return*/, this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup)];
+                            }
+                        case 2:
+                            e_1 = _a.sent();
+                            return [2 /*return*/, Promise.reject(e_1)];
+                        case 3: return [2 /*return*/];
+                    }
+                });
+            });
         };
         /**
          * Clears local cache for the current user then opens a popup window prompting the user to sign-out of the server
@@ -11289,7 +11404,7 @@
          */
         PopupClient.prototype.acquireTokenPopupAsync = function (validRequest, popupName, popupWindowAttributes, popup) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+                var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_2;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -11327,17 +11442,17 @@
                             result = _a.sent();
                             return [2 /*return*/, result];
                         case 7:
-                            e_1 = _a.sent();
+                            e_2 = _a.sent();
                             if (popup) {
                                 // Close the synchronous popup if an error is thrown before the window unload event is registered
                                 popup.close();
                             }
-                            if (e_1 instanceof AuthError) {
-                                e_1.setCorrelationId(this.correlationId);
+                            if (e_2 instanceof AuthError) {
+                                e_2.setCorrelationId(this.correlationId);
                             }
-                            serverTelemetryManager.cacheFailedRequest(e_1);
+                            serverTelemetryManager.cacheFailedRequest(e_2);
                             this.browserStorage.cleanRequestByState(validRequest.state);
-                            throw e_1;
+                            throw e_2;
                         case 8: return [2 /*return*/];
                     }
                 });
@@ -11354,7 +11469,7 @@
          */
         PopupClient.prototype.logoutPopupAsync = function (validRequest, popupName, popupWindowAttributes, requestAuthority, popup, mainWindowRedirectUri) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_2, navigationOptions, absoluteUrl, e_3;
+                var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_3, navigationOptions, absoluteUrl, e_4;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -11390,8 +11505,8 @@
                             this.logger.verbose("Popup successfully redirected to postLogoutRedirectUri");
                             return [3 /*break*/, 7];
                         case 6:
-                            e_2 = _a.sent();
-                            this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_2);
+                            e_3 = _a.sent();
+                            this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_3);
                             return [3 /*break*/, 7];
                         case 7:
                             popupUtils.cleanPopup(popupWindow);
@@ -11411,19 +11526,19 @@
                             }
                             return [3 /*break*/, 9];
                         case 8:
-                            e_3 = _a.sent();
+                            e_4 = _a.sent();
                             if (popup) {
                                 // Close the synchronous popup if an error is thrown before the window unload event is registered
                                 popup.close();
                             }
-                            if (e_3 instanceof AuthError) {
-                                e_3.setCorrelationId(this.correlationId);
+                            if (e_4 instanceof AuthError) {
+                                e_4.setCorrelationId(this.correlationId);
                             }
                             this.browserStorage.setInteractionInProgress(false);
-                            this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_3);
+                            this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_4);
                             this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
-                            serverTelemetryManager.cacheFailedRequest(e_3);
-                            throw e_3;
+                            serverTelemetryManager.cacheFailedRequest(e_4);
+                            throw e_4;
                         case 9:
                             this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
                             return [2 /*return*/];
@@ -11581,22 +11696,23 @@
                 var validRequest, serverTelemetryManager, authCodeRequest, authClient, interactionHandler, navigateUrl, redirectStartPage, e_1;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Redirect);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
-                            _a.label = 1;
+                        case 0: return [4 /*yield*/, this.preflightInteractiveRequest(request, exports.InteractionType.Redirect)];
                         case 1:
-                            _a.trys.push([1, 6, , 7]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                            validRequest = _a.sent();
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
+                            _a.label = 2;
                         case 2:
+                            _a.trys.push([2, 7, , 8]);
+                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                        case 3:
                             authCodeRequest = _a.sent();
                             return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority)];
-                        case 3:
+                        case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
                             return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
-                        case 4:
+                        case 5:
                             navigateUrl = _a.sent();
                             redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                             this.logger.verbosePii("Redirect start page: " + redirectStartPage);
@@ -11606,10 +11722,10 @@
                                     redirectStartPage: redirectStartPage,
                                     onRedirectNavigate: request.onRedirectNavigate
                                 })];
-                        case 5: 
+                        case 6: 
                         // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
                         return [2 /*return*/, _a.sent()];
-                        case 6:
+                        case 7:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -11617,7 +11733,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(validRequest.state);
                             throw e_1;
-                        case 7: return [2 /*return*/];
+                        case 8: return [2 /*return*/];
                     }
                 });
             });
@@ -12033,24 +12149,26 @@
                             if (request.prompt && request.prompt !== PromptValue.NONE) {
                                 throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                             }
-                            silentRequest = this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                            _a.label = 1;
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
                         case 1:
-                            _a.trys.push([1, 6, , 7]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                            silentRequest = _a.sent();
+                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                            _a.label = 2;
                         case 2:
+                            _a.trys.push([2, 7, , 8]);
+                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                        case 3:
                             authCodeRequest = _a.sent();
                             return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority)];
-                        case 3:
+                        case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                        case 4:
+                        case 5:
                             navigateUrl = _a.sent();
                             return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)];
-                        case 5: return [2 /*return*/, _a.sent()];
-                        case 6:
+                        case 6: return [2 /*return*/, _a.sent()];
+                        case 7:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -12058,7 +12176,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(silentRequest.state);
                             throw e_1;
-                        case 7: return [2 /*return*/];
+                        case 8: return [2 /*return*/];
                     }
                 });
             });
@@ -12114,16 +12232,19 @@
          */
         SilentRefreshClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var silentRequest, serverTelemetryManager, refreshTokenClient;
+                var silentRequest, _a, serverTelemetryManager, refreshTokenClient;
                 var _this = this;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
-                            silentRequest = __assign$1(__assign$1({}, request), this.initializeBaseRequest(request));
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1:
+                            silentRequest = __assign$1.apply(void 0, _a.concat([_b.sent()]));
                             serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
                             return [4 /*yield*/, this.createRefreshTokenClient(serverTelemetryManager, silentRequest.authority)];
-                        case 1:
-                            refreshTokenClient = _a.sent();
+                        case 2:
+                            refreshTokenClient = _b.sent();
                             this.logger.verbose("Refresh token client created");
                             // Send request to renew token. Auth module will throw errors if token cannot be renewed.
                             return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(silentRequest).catch(function (e) {
@@ -12322,14 +12443,16 @@
                             if (!request.code) {
                                 throw BrowserAuthError.createAuthCodeRequiredError();
                             }
-                            silentRequest = this.initializeAuthorizationRequest(request, exports.InteractionType.Silent);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                            _a.label = 1;
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Silent)];
                         case 1:
-                            _a.trys.push([1, 3, , 4]);
+                            silentRequest = _a.sent();
+                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
                             authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
                             return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
-                        case 2:
+                        case 3:
                             clientConfig = _a.sent();
                             authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
                             this.logger.verbose("Auth code client created");
@@ -12341,7 +12464,7 @@
                                     cloud_graph_host_name: request.cloudGraphHostName,
                                     cloud_instance_host_name: request.cloudInstanceHostName
                                 }, silentRequest.state, authClient.authority, this.networkClient, false)];
-                        case 3:
+                        case 4:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -12349,7 +12472,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(silentRequest.state);
                             throw e_1;
-                        case 4: return [2 /*return*/];
+                        case 5: return [2 /*return*/];
                     }
                 });
             });
@@ -13008,7 +13131,17 @@
             });
         };
         SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-            return __assign$1(__assign$1(__assign$1({}, request), this.initializeBaseRequest(request)), { account: account, forceRefresh: request.forceRefresh || false });
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                    }
+                });
+            });
         };
         return SilentCacheClient;
     }(StandardInteractionClient));
@@ -13099,11 +13232,11 @@
                         authority: request.authority || "",
                         scopes: request.scopes,
                         homeAccountIdentifier: account.homeAccountId,
+                        claims: request.claims,
                         authenticationScheme: request.authenticationScheme,
                         resourceRequestMethod: request.resourceRequestMethod,
                         resourceRequestUri: request.resourceRequestUri,
                         shrClaims: request.shrClaims,
-                        sshJwk: request.sshJwk,
                         sshKid: request.sshKid
                     };
                     silentRequestKey = JSON.stringify(thumbprint);
@@ -13140,28 +13273,33 @@
                 var silentCacheClient, silentRequest;
                 var _this = this;
                 return __generator$1(this, function (_a) {
-                    silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
-                    silentRequest = silentCacheClient.initializeSilentRequest(request, account);
-                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                    return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                            var tokenRenewalResult, tokenRenewalError_1;
-                            return __generator$1(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        _a.trys.push([0, 2, , 3]);
-                                        return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                    case 1:
-                                        tokenRenewalResult = _a.sent();
-                                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                        return [2 /*return*/, tokenRenewalResult];
-                                    case 2:
-                                        tokenRenewalError_1 = _a.sent();
-                                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                        throw tokenRenewalError_1;
-                                    case 3: return [2 /*return*/];
-                                }
-                            });
-                        }); })];
+                    switch (_a.label) {
+                        case 0:
+                            silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
+                            return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                        case 1:
+                            silentRequest = _a.sent();
+                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
+                            return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                                    var tokenRenewalResult, tokenRenewalError_1;
+                                    return __generator$1(this, function (_a) {
+                                        switch (_a.label) {
+                                            case 0:
+                                                _a.trys.push([0, 2, , 3]);
+                                                return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
+                                            case 1:
+                                                tokenRenewalResult = _a.sent();
+                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
+                                                return [2 /*return*/, tokenRenewalResult];
+                                            case 2:
+                                                tokenRenewalError_1 = _a.sent();
+                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
+                                                throw tokenRenewalError_1;
+                                            case 3: return [2 /*return*/];
+                                        }
+                                    });
+                                }); })];
+                    }
                 });
             });
         };