@azure/msal-browser 2.20.0 → 2.22.1

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.20.0 2021-12-07 */
+/*! @azure/msal-browser v2.22.1 2022-03-07 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -208,6 +208,7 @@
         // default authority
         DEFAULT_AUTHORITY: "https://login.microsoftonline.com/common/",
         DEFAULT_AUTHORITY_HOST: "login.microsoftonline.com",
+        DEFAULT_COMMON_TENANT: "common",
         // ADFS String
         ADFS: "adfs",
         // Default AAD Instance Discovery Endpoint
@@ -332,6 +333,7 @@
         AADServerParamKeys["FOCI"] = "foci";
         AADServerParamKeys["CCS_HEADER"] = "X-AnchorMailbox";
         AADServerParamKeys["RETURN_SPA_CODE"] = "return_spa_code";
+        AADServerParamKeys["LOGOUT_HINT"] = "logout_hint";
     })(AADServerParamKeys || (AADServerParamKeys = {}));
     /**
      * Claims request keys
@@ -556,7 +558,7 @@
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
     })(CacheOutcome || (CacheOutcome = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -600,7 +602,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -663,10 +665,19 @@
                     throw AuthError.createUnexpectedError(notImplErr);
                 });
             });
+        },
+        hashString: function () {
+            return __awaiter(this, void 0, void 0, function () {
+                var notImplErr;
+                return __generator(this, function (_a) {
+                    notImplErr = "Crypto interface - hashString() has not been implemented";
+                    throw AuthError.createUnexpectedError(notImplErr);
+                });
+            });
         }
     };
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1128,7 +1139,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1253,7 +1264,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1433,12 +1444,31 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "5.2.0";
+    var version$1 = "6.1.0";
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    exports.AzureCloudInstance = void 0;
+    (function (AzureCloudInstance) {
+        // AzureCloudInstance is not specified.
+        AzureCloudInstance[AzureCloudInstance["None"] = 0] = "None";
+        // Microsoft Azure public cloud
+        AzureCloudInstance["AzurePublic"] = "https://login.microsoftonline.com";
+        // Microsoft Chinese national cloud
+        AzureCloudInstance["AzureChina"] = "https://login.chinacloudapi.cn";
+        // Microsoft German national cloud ("Black Forest")
+        AzureCloudInstance["AzureGermany"] = "https://login.microsoftonline.de";
+        // US Government cloud
+        AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
+    })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
+
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1449,7 +1479,7 @@
      *
      * Key:Value Schema:
      *
-     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<scheme>
+     * Key: <home_account_id*>-<environment>-<credential_type>-<client_id>-<realm*>-<target*>-<requestedClaims*>-<scheme*>
      *
      * Value Schema:
      * {
@@ -1463,6 +1493,7 @@
      *      target: Permissions that are included in the token, or for refresh tokens, the resource identifier.
      *      oboAssertion: access token passed in as part of OBO request
      *      tokenType: Matches the authentication scheme for which the token was issued (i.e. Bearer or pop)
+     *      requestedClaimsHash: Matches the SHA 256 hash of the claims object included in the token request
      * }
      */
     var CredentialEntity = /** @class */ (function () {
@@ -1490,7 +1521,7 @@
          * generates credential key
          */
         CredentialEntity.prototype.generateCredentialKey = function () {
-            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType);
+            return CredentialEntity.generateCredentialCacheKey(this.homeAccountId, this.environment, this.credentialType, this.clientId, this.realm, this.target, this.familyId, this.tokenType, this.requestedClaimsHash);
         };
         /**
          * returns the type of the cache (in this case credential)
@@ -1534,16 +1565,14 @@
          * generates credential key
          * <home_account_id*>-\<environment>-<credential_type>-<client_id>-<realm\*>-<target\*>-<scheme\*>
          */
-        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType) {
+        CredentialEntity.generateCredentialCacheKey = function (homeAccountId, environment, credentialType, clientId, realm, target, familyId, tokenType, requestedClaimsHash) {
             var credentialKey = [
                 this.generateAccountIdForCacheKey(homeAccountId, environment),
                 this.generateCredentialIdForCacheKey(credentialType, clientId, realm, familyId),
-                this.generateTargetForCacheKey(target)
+                this.generateTargetForCacheKey(target),
+                this.generateClaimsHashForCacheKey(requestedClaimsHash),
+                this.generateSchemeForCacheKey(tokenType)
             ];
-            // PoP Tokens and SSH certs include scheme in cache key
-            if (tokenType && tokenType !== exports.AuthenticationScheme.BEARER) {
-                credentialKey.push(tokenType.toLowerCase());
-            }
             return credentialKey.join(Separators.CACHE_KEY_SEPARATOR).toLowerCase();
         };
         /**
@@ -1579,10 +1608,26 @@
         CredentialEntity.generateTargetForCacheKey = function (scopes) {
             return (scopes || "").toLowerCase();
         };
+        /**
+         * Generate requested claims key component as per schema: <requestedClaims>
+         */
+        CredentialEntity.generateClaimsHashForCacheKey = function (requestedClaimsHash) {
+            return (requestedClaimsHash || "").toLowerCase();
+        };
+        /**
+         * Generate scheme key componenet as per schema: <scheme>
+         */
+        CredentialEntity.generateSchemeForCacheKey = function (tokenType) {
+            /*
+             * PoP Tokens and SSH certs include scheme in cache key
+             * Cast to lowercase to handle "bearer" from ADFS
+             */
+            return (tokenType && tokenType.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? tokenType.toLowerCase() : "";
+        };
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1664,6 +1709,10 @@
             code: "untrusted_authority",
             desc: "The provided authority is not a trusted authority. Please include this authority in the knownAuthorities config parameter."
         },
+        invalidAzureCloudInstance: {
+            code: "invalid_azure_cloud_instance",
+            desc: "Invalid AzureCloudInstance provided. Please refer MSAL JS docs: aks.ms/msaljs/azure_cloud_instance for valid values"
+        },
         missingSshJwk: {
             code: "missing_ssh_jwk",
             desc: "Missing sshJwk in SSH certificate request. A stringified JSON Web Key is required when using the SSH authentication scheme."
@@ -1800,7 +1849,13 @@
         ClientConfigurationError.createUntrustedAuthorityError = function () {
             return new ClientConfigurationError(ClientConfigurationErrorMessage.untrustedAuthority.code, ClientConfigurationErrorMessage.untrustedAuthority.desc);
         };
-        /*
+        /**
+         * Throws error when the AzureCloudInstance is set to an invalid value
+         */
+        ClientConfigurationError.createInvalidAzureCloudInstanceError = function () {
+            return new ClientConfigurationError(ClientConfigurationErrorMessage.invalidAzureCloudInstance.code, ClientConfigurationErrorMessage.invalidAzureCloudInstance.desc);
+        };
+        /**
          * Throws an error when the authentication scheme is set to SSH but the SSH public key is omitted from the request
          */
         ClientConfigurationError.createMissingSshJwkError = function () {
@@ -1827,7 +1882,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2011,7 +2066,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2049,7 +2104,7 @@
         };
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2063,7 +2118,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2297,7 +2352,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2335,7 +2390,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2425,7 +2480,8 @@
                                 environment: credential.environment,
                                 homeAccountId: credential.homeAccountId,
                                 realm: credential.realm,
-                                tokenType: credential.tokenType
+                                tokenType: credential.tokenType,
+                                requestedClaimsHash: credential.requestedClaimsHash
                             });
                             currentScopes = ScopeSet.fromString(credential.target);
                             currentAccessTokens = Object.keys(currentTokenCache.accessTokens).map(function (key) { return currentTokenCache.accessTokens[key]; });
@@ -2497,7 +2553,7 @@
          * @param target
          */
         CacheManager.prototype.getCredentialsFilteredBy = function (filter) {
-            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId);
+            return this.getCredentialsFilteredByInternal(filter.homeAccountId, filter.environment, filter.credentialType, filter.clientId, filter.familyId, filter.realm, filter.target, filter.oboAssertion, filter.tokenType, filter.keyId, filter.requestedClaimsHash);
         };
         /**
          * Support function to help match credentials
@@ -2510,7 +2566,7 @@
          * @param oboAssertion
          * @param tokenType
          */
-        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId) {
+        CacheManager.prototype.getCredentialsFilteredByInternal = function (homeAccountId, environment, credentialType, clientId, familyId, realm, target, oboAssertion, tokenType, keyId, requestedClaimsHash) {
             var _this = this;
             var allCacheKeys = this.getKeys();
             var matchingCredentials = {
@@ -2557,38 +2613,37 @@
                 if (!!target && !_this.matchTarget(entity, target)) {
                     return;
                 }
+                // If request OR cached entity has requested Claims Hash, check if they match
+                if (requestedClaimsHash || entity.requestedClaimsHash) {
+                    // Don't match if either is undefined or they are different
+                    if (entity.requestedClaimsHash !== requestedClaimsHash) {
+                        return;
+                    }
+                }
                 // Access Token with Auth Scheme specific matching
                 if (credentialType === CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME) {
                     if (!!tokenType && !_this.matchTokenType(entity, tokenType)) {
                         return;
                     }
-                    switch (tokenType) {
-                        case exports.AuthenticationScheme.POP:
-                            // This check avoids matching outdated POP tokens that don't have the <-scheme> in the cache key
-                            if (cacheKey.indexOf(exports.AuthenticationScheme.POP) === -1) {
-                                // AccessToken_With_AuthScheme that doesn't have "-pop" in the key is outdated and needs to be removed
-                                _this.removeItem(cacheKey, CacheSchemaType.CREDENTIAL);
-                                return;
-                            }
-                            break;
-                        case exports.AuthenticationScheme.SSH:
-                            // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
-                            if (keyId && !_this.matchKeyId(entity, keyId)) {
-                                return;
-                            }
-                            break;
+                    // KeyId (sshKid) in request must match cached SSH certificate keyId because SSH cert is bound to a specific key
+                    if (tokenType === exports.AuthenticationScheme.SSH) {
+                        if (keyId && !_this.matchKeyId(entity, keyId)) {
+                            return;
+                        }
                     }
                 }
+                // At this point, the entity matches the request, update cache key if key schema has changed
+                var updatedCacheKey = _this.updateCredentialCacheKey(cacheKey, entity);
                 switch (credType) {
                     case CredentialType.ID_TOKEN:
-                        matchingCredentials.idTokens[cacheKey] = entity;
+                        matchingCredentials.idTokens[updatedCacheKey] = entity;
                         break;
                     case CredentialType.ACCESS_TOKEN:
                     case CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME:
-                        matchingCredentials.accessTokens[cacheKey] = entity;
+                        matchingCredentials.accessTokens[updatedCacheKey] = entity;
                         break;
                     case CredentialType.REFRESH_TOKEN:
-                        matchingCredentials.refreshTokens[cacheKey] = entity;
+                        matchingCredentials.refreshTokens[updatedCacheKey] = entity;
                         break;
                 }
             });
@@ -2787,10 +2842,10 @@
          * @param environment
          * @param authScheme
          */
-        CacheManager.prototype.readCacheRecord = function (account, clientId, scopes, environment, authScheme, keyId) {
+        CacheManager.prototype.readCacheRecord = function (account, clientId, request, environment) {
             var cachedAccount = this.readAccountFromCache(account);
             var cachedIdToken = this.readIdTokenFromCache(clientId, account);
-            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, scopes, authScheme, keyId);
+            var cachedAccessToken = this.readAccessTokenFromCache(clientId, account, request);
             var cachedRefreshToken = this.readRefreshTokenFromCache(clientId, account, false);
             var cachedAppMetadata = this.readAppMetadataFromCache(environment, clientId);
             if (cachedAccount && cachedIdToken) {
@@ -2844,9 +2899,14 @@
          * @param scopes
          * @param authScheme
          */
-        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, scopes, authScheme, keyId) {
-            // Distinguish between Bearer and PoP/SSH token cache types
-            var credentialType = (authScheme && authScheme !== exports.AuthenticationScheme.BEARER) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
+        CacheManager.prototype.readAccessTokenFromCache = function (clientId, account, request) {
+            var scopes = new ScopeSet(request.scopes || []);
+            var authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
+            /*
+             * Distinguish between Bearer and PoP/SSH token cache types
+             * Cast to lowercase to handle "bearer" from ADFS
+             */
+            var credentialType = (authScheme && authScheme.toLowerCase() !== exports.AuthenticationScheme.BEARER.toLowerCase()) ? CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME : CredentialType.ACCESS_TOKEN;
             var accessTokenFilter = {
                 homeAccountId: account.homeAccountId,
                 environment: account.environment,
@@ -2855,7 +2915,8 @@
                 realm: account.tenantId,
                 target: scopes.printScopesLowerCase(),
                 tokenType: authScheme,
-                keyId: keyId
+                keyId: request.sshKid,
+                requestedClaimsHash: request.requestedClaimsHash
             };
             var credentialCache = this.getCredentialsFilteredBy(accessTokenFilter);
             var accessTokens = Object.keys(credentialCache.accessTokens).map(function (key) { return credentialCache.accessTokens[key]; });
@@ -3164,10 +3225,14 @@
                 });
             });
         };
+        DefaultStorageClass.prototype.updateCredentialCacheKey = function () {
+            var notImplErr = "Storage interface - updateCredentialCacheKey() has not been implemented for the cacheStorage interface.";
+            throw AuthError.createUnexpectedError(notImplErr);
+        };
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3177,7 +3242,8 @@
     var DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
     var DEFAULT_SYSTEM_OPTIONS = {
         tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
-        preventCorsPreflight: false
+        preventCorsPreflight: false,
+        proxyUrl: "",
     };
     var DEFAULT_LOGGER_IMPLEMENTATION = {
         loggerCallback: function () {
@@ -3217,6 +3283,10 @@
         clientSecret: "",
         clientAssertion: undefined
     };
+    var DEFAULT_AZURE_CLOUD_OPTIONS = {
+        azureCloudInstance: exports.AzureCloudInstance.None,
+        tenant: "" + Constants.DEFAULT_COMMON_TENANT
+    };
     /**
      * Function that sets the default options when not explicitly configured from app developer
      *
@@ -3246,10 +3316,10 @@
      * @param authOptions
      */
     function buildAuthOptions(authOptions) {
-        return __assign({ clientCapabilities: [] }, authOptions);
+        return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3269,7 +3339,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3352,11 +3422,11 @@
                 authority: request.authority,
                 scopes: request.scopes,
                 homeAccountIdentifier: homeAccountIdentifier,
+                claims: request.claims,
                 authenticationScheme: request.authenticationScheme,
                 resourceRequestMethod: request.resourceRequestMethod,
                 resourceRequestUri: request.resourceRequestUri,
                 shrClaims: request.shrClaims,
-                sshJwk: request.sshJwk,
                 sshKid: request.sshKid
             };
             var key = this.generateThrottlingStorageKey(thumbprint);
@@ -3365,7 +3435,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3414,7 +3484,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3425,7 +3495,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3489,7 +3559,7 @@
                 var response;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers })];
+                        case 0: return [4 /*yield*/, this.networkManager.sendPostRequest(thumbprint, tokenEndpoint, { body: queryString, headers: headers, proxyUrl: this.config.systemOptions.proxyUrl })];
                         case 1:
                             response = _a.sent();
                             if (this.config.serverTelemetryManager && response.status < 500 && response.status !== 429) {
@@ -3514,7 +3584,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3600,7 +3670,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3927,6 +3997,12 @@
         RequestParameterBuilder.prototype.addThrottling = function () {
             this.parameters.set(AADServerParamKeys.X_MS_LIB_CAPABILITY, ThrottlingConstants.X_MS_LIB_CAPABILITY_VALUE);
         };
+        /**
+         * Adds logout_hint parameter for "silent" logout which prevent server account picker
+         */
+        RequestParameterBuilder.prototype.addLogoutHint = function (logoutHint) {
+            this.parameters.set(AADServerParamKeys.LOGOUT_HINT, encodeURIComponent(logoutHint));
+        };
         /**
          * Utility to create a URL from the params map
          */
@@ -3940,7 +4016,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4005,7 +4081,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4055,7 +4131,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4101,8 +4177,8 @@
          * @param expiresOn
          * @param extExpiresOn
          */
-        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId) {
-            var _a;
+        AccessTokenEntity.createAccessTokenEntity = function (homeAccountId, environment, accessToken, clientId, tenantId, scopes, expiresOn, extExpiresOn, cryptoUtils, refreshOn, tokenType, oboAssertion, keyId, requestedClaims, requestedClaimsHash) {
+            var _a, _b;
             var atEntity = new AccessTokenEntity();
             atEntity.homeAccountId = homeAccountId;
             atEntity.credentialType = CredentialType.ACCESS_TOKEN;
@@ -4124,14 +4200,21 @@
             atEntity.target = scopes;
             atEntity.oboAssertion = oboAssertion;
             atEntity.tokenType = StringUtils.isEmpty(tokenType) ? exports.AuthenticationScheme.BEARER : tokenType;
-            // Create Access Token With Auth Scheme instead of regular access token
-            if (atEntity.tokenType !== exports.AuthenticationScheme.BEARER) {
+            if (requestedClaims) {
+                atEntity.requestedClaims = requestedClaims;
+                atEntity.requestedClaimsHash = requestedClaimsHash;
+            }
+            /*
+             * Create Access Token With Auth Scheme instead of regular access token
+             * Cast to lower to handle "bearer" from ADFS
+             */
+            if (((_a = atEntity.tokenType) === null || _a === void 0 ? void 0 : _a.toLowerCase()) !== exports.AuthenticationScheme.BEARER.toLowerCase()) {
                 atEntity.credentialType = CredentialType.ACCESS_TOKEN_WITH_AUTH_SCHEME;
                 switch (atEntity.tokenType) {
                     case exports.AuthenticationScheme.POP:
                         // Make sure keyId is present and add it to credential
                         var tokenClaims = AuthToken.extractTokenClaims(accessToken, cryptoUtils);
-                        if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
+                        if (!((_b = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _b === void 0 ? void 0 : _b.kid)) {
                             throw ClientAuthError.createTokenClaimsRequiredError();
                         }
                         atEntity.keyId = tokenClaims.cnf.kid;
@@ -4162,7 +4245,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4229,7 +4312,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4293,7 +4376,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4309,7 +4392,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4380,7 +4463,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4581,7 +4664,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4656,7 +4739,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4726,7 +4809,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4762,7 +4845,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4845,7 +4928,7 @@
                             }
                             // Add keyId from request to serverTokenResponse if defined
                             serverTokenResponse.key_id = serverTokenResponse.key_id || request.sshKid || undefined;
-                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, idTokenObj, request.scopes, oboAssertion, authCodePayload);
+                            cacheRecord = this.generateCacheRecord(serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload);
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, , 5, 8]);
@@ -4893,7 +4976,7 @@
          * @param idTokenObj
          * @param authority
          */
-        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, idTokenObj, requestScopes, oboAssertion, authCodePayload) {
+        ResponseHandler.prototype.generateCacheRecord = function (serverTokenResponse, authority, reqTimestamp, request, idTokenObj, oboAssertion, authCodePayload) {
             var env = authority.getPreferredCache();
             if (StringUtils.isEmpty(env)) {
                 throw ClientAuthError.createInvalidCacheEnvironmentError();
@@ -4909,7 +4992,7 @@
             var cachedAccessToken = null;
             if (!StringUtils.isEmpty(serverTokenResponse.access_token)) {
                 // If scopes not returned in server response, use request scopes
-                var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(requestScopes || []);
+                var responseScopes = serverTokenResponse.scope ? ScopeSet.fromString(serverTokenResponse.scope) : new ScopeSet(request.scopes || []);
                 /*
                  * Use timestamp calculated before request
                  * Server may return timestamps as strings, parse to numbers if so.
@@ -4921,7 +5004,7 @@
                 var extendedTokenExpirationSeconds = tokenExpirationSeconds + extExpiresIn;
                 var refreshOnSeconds = refreshIn && refreshIn > 0 ? reqTimestamp + refreshIn : undefined;
                 // non AAD scenarios can have empty realm
-                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id);
+                cachedAccessToken = AccessTokenEntity.createAccessTokenEntity(this.homeAccountIdentifier, env, serverTokenResponse.access_token || Constants.EMPTY_STRING, this.clientId, idTokenObj ? idTokenObj.claims.tid || Constants.EMPTY_STRING : authority.tenant, responseScopes.printScopes(), tokenExpirationSeconds, extendedTokenExpirationSeconds, this.cryptoObj, refreshOnSeconds, serverTokenResponse.token_type, oboAssertion, serverTokenResponse.key_id, request.claims, request.requestedClaimsHash);
             }
             // refreshToken
             var cachedRefreshToken = null;
@@ -5027,7 +5110,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5142,11 +5225,11 @@
                                 clientId: this.config.authOptions.clientId,
                                 authority: authority.canonicalAuthority,
                                 scopes: request.scopes,
+                                claims: request.claims,
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
                                 shrClaims: request.shrClaims,
-                                sshJwk: request.sshJwk,
                                 sshKid: request.sshKid
                             };
                             return [4 /*yield*/, this.createTokenRequestBody(request)];
@@ -5416,6 +5499,9 @@
             if (request.state) {
                 parameterBuilder.addState(request.state);
             }
+            if (request.logoutHint) {
+                parameterBuilder.addLogoutHint(request.logoutHint);
+            }
             if (request.extraQueryParameters) {
                 parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
             }
@@ -5435,7 +5521,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5546,11 +5632,11 @@
                                 clientId: this.config.authOptions.clientId,
                                 authority: authority.canonicalAuthority,
                                 scopes: request.scopes,
+                                claims: request.claims,
                                 authenticationScheme: request.authenticationScheme,
                                 resourceRequestMethod: request.resourceRequestMethod,
                                 resourceRequestUri: request.resourceRequestUri,
                                 shrClaims: request.shrClaims,
-                                sshJwk: request.sshJwk,
                                 sshKid: request.sshKid
                             };
                             endpoint = UrlString.appendQueryString(authority.tokenEndpoint, queryParameters);
@@ -5646,7 +5732,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5692,7 +5778,7 @@
         SilentFlowClient.prototype.acquireCachedToken = function (request) {
             var _a, _b, _c, _d;
             return __awaiter(this, void 0, void 0, function () {
-                var requestScopes, environment, authScheme, cacheRecord;
+                var environment, cacheRecord;
                 return __generator(this, function (_e) {
                     switch (_e.label) {
                         case 0:
@@ -5706,19 +5792,12 @@
                                 this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because forceRefresh is true.");
                                 throw ClientAuthError.createRefreshRequiredError();
                             }
-                            else if (!StringUtils.isEmptyObj(request.claims)) {
-                                // Must refresh due to request parameters.
-                                this.logger.info("SilentFlowClient:acquireCachedToken - Skipping cache because claims are requested.");
-                                throw ClientAuthError.createRefreshRequiredError();
-                            }
                             // We currently do not support silent flow for account === null use cases; This will be revisited for confidential flow usecases
                             if (!request.account) {
                                 throw ClientAuthError.createNoAccountInSilentRequestError();
                             }
-                            requestScopes = new ScopeSet(request.scopes || []);
                             environment = request.authority || this.authority.getPreferredCache();
-                            authScheme = request.authenticationScheme || exports.AuthenticationScheme.BEARER;
-                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, requestScopes, environment, authScheme, request.sshKid);
+                            cacheRecord = this.cacheManager.readCacheRecord(request.account, this.config.authOptions.clientId, request, environment);
                             if (!cacheRecord.accessToken) {
                                 // Must refresh due to non-existent access_token.
                                 (_b = this.serverTelemetryManager) === null || _b === void 0 ? void 0 : _b.setCacheOutcome(CacheOutcome.NO_CACHED_ACCESS_TOKEN);
@@ -5769,7 +5848,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5780,7 +5859,7 @@
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5794,7 +5873,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5869,7 +5948,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5879,7 +5958,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5894,18 +5973,22 @@
          *
          * @returns Promise<string | null>
          */
-        RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata) {
+        RegionDiscovery.prototype.detectRegion = function (environmentRegion, regionDiscoveryMetadata, proxyUrl) {
             return __awaiter(this, void 0, void 0, function () {
-                var autodetectedRegionName, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
+                var autodetectedRegionName, options, localIMDSVersionResponse, currentIMDSVersion, currentIMDSVersionResponse;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             autodetectedRegionName = environmentRegion;
                             if (!!autodetectedRegionName) return [3 /*break*/, 8];
+                            options = RegionDiscovery.IMDS_OPTIONS;
+                            if (proxyUrl) {
+                                options.proxyUrl = proxyUrl;
+                            }
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 6, , 7]);
-                            return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION)];
+                            return [4 /*yield*/, this.getRegionFromIMDS(Constants.IMDS_VERSION, options)];
                         case 2:
                             localIMDSVersionResponse = _a.sent();
                             if (localIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -5913,14 +5996,14 @@
                                 regionDiscoveryMetadata.region_source = RegionDiscoverySources.IMDS;
                             }
                             if (!(localIMDSVersionResponse.status === ResponseCodes.httpBadRequest)) return [3 /*break*/, 5];
-                            return [4 /*yield*/, this.getCurrentVersion()];
+                            return [4 /*yield*/, this.getCurrentVersion(options)];
                         case 3:
                             currentIMDSVersion = _a.sent();
                             if (!currentIMDSVersion) {
                                 regionDiscoveryMetadata.region_source = RegionDiscoverySources.FAILED_AUTO_DETECTION;
                                 return [2 /*return*/, null];
                             }
-                            return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion)];
+                            return [4 /*yield*/, this.getRegionFromIMDS(currentIMDSVersion, options)];
                         case 4:
                             currentIMDSVersionResponse = _a.sent();
                             if (currentIMDSVersionResponse.status === ResponseCodes.httpSuccess) {
@@ -5953,10 +6036,10 @@
          * @param imdsEndpointUrl
          * @returns Promise<NetworkResponse<string>>
          */
-        RegionDiscovery.prototype.getRegionFromIMDS = function (version) {
+        RegionDiscovery.prototype.getRegionFromIMDS = function (version, options) {
             return __awaiter(this, void 0, void 0, function () {
                 return __generator(this, function (_a) {
-                    return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", RegionDiscovery.IMDS_OPTIONS, Constants.IMDS_TIMEOUT)];
+                    return [2 /*return*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?api-version=" + version + "&format=text", options, Constants.IMDS_TIMEOUT)];
                 });
             });
         };
@@ -5965,14 +6048,14 @@
          *
          * @returns Promise<string | null>
          */
-        RegionDiscovery.prototype.getCurrentVersion = function () {
+        RegionDiscovery.prototype.getCurrentVersion = function (options) {
             return __awaiter(this, void 0, void 0, function () {
                 var response;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             _a.trys.push([0, 2, , 3]);
-                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", RegionDiscovery.IMDS_OPTIONS)];
+                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(Constants.IMDS_ENDPOINT + "?format=json", options)];
                         case 1:
                             response = _a.sent();
                             // When IMDS endpoint is called without the api version query param, bad request response comes back with latest version.
@@ -5989,11 +6072,15 @@
             });
         };
         // Options for the IMDS endpoint request
-        RegionDiscovery.IMDS_OPTIONS = { headers: { "Metadata": "true" } };
+        RegionDiscovery.IMDS_OPTIONS = {
+            headers: {
+                Metadata: "true",
+            },
+        };
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6004,7 +6091,7 @@
      * endpoint. It will store the pertinent config data in this object for use during token calls.
      */
     var Authority = /** @class */ (function () {
-        function Authority(authority, networkInterface, cacheManager, authorityOptions) {
+        function Authority(authority, networkInterface, cacheManager, authorityOptions, proxyUrl) {
             this.canonicalAuthority = authority;
             this._canonicalAuthority.validateAsUri();
             this.networkInterface = networkInterface;
@@ -6012,6 +6099,7 @@
             this.authorityOptions = authorityOptions;
             this.regionDiscovery = new RegionDiscovery(networkInterface);
             this.regionDiscoveryMetadata = { region_used: undefined, region_source: undefined, region_outcome: undefined };
+            this.proxyUrl = proxyUrl || Constants.EMPTY_STRING;
         }
         Object.defineProperty(Authority.prototype, "authorityType", {
             // See above for AuthorityType
@@ -6280,7 +6368,7 @@
                             metadata = _b.sent();
                             if (!metadata) return [3 /*break*/, 4];
                             if (!((_a = this.authorityOptions.azureRegionConfiguration) === null || _a === void 0 ? void 0 : _a.azureRegion)) return [3 /*break*/, 3];
-                            return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata)];
+                            return [4 /*yield*/, this.regionDiscovery.detectRegion(this.authorityOptions.azureRegionConfiguration.environmentRegion, this.regionDiscoveryMetadata, this.proxyUrl)];
                         case 2:
                             autodetectedRegionName = _b.sent();
                             azureRegion = this.authorityOptions.azureRegionConfiguration.azureRegion === Constants.AZURE_REGION_AUTO_DISCOVER_FLAG
@@ -6343,19 +6431,25 @@
          */
         Authority.prototype.getEndpointMetadataFromNetwork = function () {
             return __awaiter(this, void 0, void 0, function () {
-                var response;
+                var options, response;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            _a.trys.push([0, 2, , 3]);
-                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint)];
+                            options = {};
+                            if (this.proxyUrl) {
+                                options.proxyUrl = this.proxyUrl;
+                            }
+                            _a.label = 1;
                         case 1:
+                            _a.trys.push([1, 3, , 4]);
+                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                        case 2:
                             response = _a.sent();
                             return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
-                        case 2:
+                        case 3:
                             _a.sent();
                             return [2 /*return*/, null];
-                        case 3: return [2 /*return*/];
+                        case 4: return [2 /*return*/];
                     }
                 });
             });
@@ -6425,16 +6519,20 @@
          */
         Authority.prototype.getCloudDiscoveryMetadataFromNetwork = function () {
             return __awaiter(this, void 0, void 0, function () {
-                var instanceDiscoveryEndpoint, match, response, metadata;
+                var instanceDiscoveryEndpoint, options, match, response, metadata;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             instanceDiscoveryEndpoint = "" + Constants.AAD_INSTANCE_DISCOVERY_ENDPT + this.canonicalAuthority + "oauth2/v2.0/authorize";
+                            options = {};
+                            if (this.proxyUrl) {
+                                options.proxyUrl = this.proxyUrl;
+                            }
                             match = null;
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 4]);
-                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint)];
+                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(instanceDiscoveryEndpoint, options)];
                         case 2:
                             response = _a.sent();
                             metadata = isCloudInstanceDiscoveryResponse(response.body) ? response.body.metadata : [];
@@ -6449,7 +6547,7 @@
                             return [2 /*return*/, null];
                         case 4:
                             if (!match) {
-                                // Custom Domain scenario, host is trusted because Instance Discovery call succeeded 
+                                // Custom Domain scenario, host is trusted because Instance Discovery call succeeded
                                 match = Authority.createCloudDiscoveryMetadataFromHost(this.hostnameAndPort);
                             }
                             return [2 /*return*/, match];
@@ -6467,6 +6565,19 @@
             });
             return matches.length > 0;
         };
+        /**
+         * helper function to populate the authority based on azureCloudOptions
+         * @param authorityString
+         * @param azureCloudOptions
+         */
+        Authority.generateAuthority = function (authorityString, azureCloudOptions) {
+            var authorityAzureCloudInstance;
+            if (azureCloudOptions && azureCloudOptions.azureCloudInstance !== exports.AzureCloudInstance.None) {
+                var tenant = azureCloudOptions.tenant ? azureCloudOptions.tenant : Constants.DEFAULT_COMMON_TENANT;
+                authorityAzureCloudInstance = azureCloudOptions.azureCloudInstance + "/" + tenant + "/";
+            }
+            return authorityAzureCloudInstance ? authorityAzureCloudInstance : authorityString;
+        };
         /**
          * Creates cloud discovery metadata object from a given host
          * @param host
@@ -6559,7 +6670,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6578,13 +6689,13 @@
          * @param networkClient
          * @param protocolMode
          */
-        AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions) {
+        AuthorityFactory.createDiscoveredInstance = function (authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl) {
             return __awaiter(this, void 0, void 0, function () {
                 var acquireTokenAuthority, e_1;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions);
+                            acquireTokenAuthority = AuthorityFactory.createInstance(authorityUri, networkClient, cacheManager, authorityOptions, proxyUrl);
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 4]);
@@ -6610,17 +6721,17 @@
          * @param networkInterface
          * @param protocolMode
          */
-        AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions) {
+        AuthorityFactory.createInstance = function (authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl) {
             // Throw error if authority url is empty
             if (StringUtils.isEmpty(authorityUrl)) {
                 throw ClientConfigurationError.createUrlEmptyError();
             }
-            return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions);
+            return new Authority(authorityUrl, networkInterface, cacheManager, authorityOptions, proxyUrl);
         };
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6651,7 +6762,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6679,7 +6790,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6696,7 +6807,7 @@
         }
     };
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6755,7 +6866,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v5.2.0 2021-12-07 */
+    /*! @azure/msal-common v6.1.0 2022-03-07 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6971,7 +7082,7 @@
     /**
      * Temporary cache keys for MSAL, deleted after any request.
      */
-    var TemporaryCacheKeys;
+    exports.TemporaryCacheKeys = void 0;
     (function (TemporaryCacheKeys) {
         TemporaryCacheKeys["AUTHORITY"] = "authority";
         TemporaryCacheKeys["ACQUIRE_TOKEN_ACCOUNT"] = "acquireToken.account";
@@ -6986,7 +7097,7 @@
         TemporaryCacheKeys["INTERACTION_STATUS_KEY"] = "interaction.status";
         TemporaryCacheKeys["CCS_CREDENTIAL"] = "ccs.credential";
         TemporaryCacheKeys["CORRELATION_ID"] = "request.correlationId";
-    })(TemporaryCacheKeys || (TemporaryCacheKeys = {}));
+    })(exports.TemporaryCacheKeys || (exports.TemporaryCacheKeys = {}));
     /**
      * Cache keys stored in-memory
      */
@@ -7021,6 +7132,7 @@
         InteractionType["Redirect"] = "redirect";
         InteractionType["Popup"] = "popup";
         InteractionType["Silent"] = "silent";
+        InteractionType["None"] = "none";
     })(exports.InteractionType || (exports.InteractionType = {}));
     /**
      * Types of interaction currently in progress.
@@ -8697,7 +8809,7 @@
          */
         CryptoOps.prototype.getPublicKeyThumbprint = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkBuffer, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
+                var keyPair, publicKeyJwk, pubKeyThumprintObj, publicJwkString, publicJwkHash, privateKeyJwk, unextractablePrivateKey;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0: return [4 /*yield*/, this.browserCrypto.generateKeyPair(CryptoOps.EXTRACTABLE, CryptoOps.POP_KEY_USAGES)];
@@ -8712,10 +8824,9 @@
                                 n: publicKeyJwk.n
                             };
                             publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
-                            return [4 /*yield*/, this.browserCrypto.sha256Digest(publicJwkString)];
+                            return [4 /*yield*/, this.hashString(publicJwkString)];
                         case 3:
-                            publicJwkBuffer = _a.sent();
-                            publicJwkHash = this.b64Encode.urlEncodeArr(new Uint8Array(publicJwkBuffer));
+                            publicJwkHash = _a.sent();
                             return [4 /*yield*/, this.browserCrypto.exportJwk(keyPair.privateKey)];
                         case 4:
                             privateKeyJwk = _a.sent();
@@ -8822,6 +8933,24 @@
                 });
             });
         };
+        /**
+         * Returns the SHA-256 hash of an input string
+         * @param plainText
+         */
+        CryptoOps.prototype.hashString = function (plainText) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var hashBuffer, hashBytes;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, this.browserCrypto.sha256Digest(plainText)];
+                        case 1:
+                            hashBuffer = _a.sent();
+                            hashBytes = new Uint8Array(hashBuffer);
+                            return [2 /*return*/, this.b64Encode.urlEncodeArr(hashBytes)];
+                    }
+                });
+            });
+        };
         CryptoOps.POP_KEY_USAGES = ["sign", "verify"];
         CryptoOps.EXTRACTABLE = true;
         return CryptoOps;
@@ -9611,7 +9740,7 @@
          */
         BrowserCacheManager.prototype.generateAuthorityKey = function (stateString) {
             var stateId = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString).libraryState.id;
-            return this.generateCacheKey(TemporaryCacheKeys.AUTHORITY + "." + stateId);
+            return this.generateCacheKey(exports.TemporaryCacheKeys.AUTHORITY + "." + stateId);
         };
         /**
          * Create Nonce key to cache nonce
@@ -9619,7 +9748,7 @@
          */
         BrowserCacheManager.prototype.generateNonceKey = function (stateString) {
             var stateId = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString).libraryState.id;
-            return this.generateCacheKey(TemporaryCacheKeys.NONCE_IDTOKEN + "." + stateId);
+            return this.generateCacheKey(exports.TemporaryCacheKeys.NONCE_IDTOKEN + "." + stateId);
         };
         /**
          * Creates full cache key for the request state
@@ -9628,7 +9757,7 @@
         BrowserCacheManager.prototype.generateStateKey = function (stateString) {
             // Use the library state id to key temp storage for uniqueness for multiple concurrent requests
             var stateId = ProtocolUtils.parseRequestState(this.cryptoImpl, stateString).libraryState.id;
-            return this.generateCacheKey(TemporaryCacheKeys.REQUEST_STATE + "." + stateId);
+            return this.generateCacheKey(exports.TemporaryCacheKeys.REQUEST_STATE + "." + stateId);
         };
         /**
          * Gets the cached authority based on the cached state. Returns empty if no cached state found.
@@ -9663,14 +9792,14 @@
                     credential: account.homeAccountId,
                     type: CcsCredentialType.HOME_ACCOUNT_ID
                 };
-                this.setTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
+                this.setTemporaryCache(exports.TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
             }
             else if (!StringUtils.isEmpty(loginHint)) {
                 var ccsCredential = {
                     credential: loginHint,
                     type: CcsCredentialType.UPN
                 };
-                this.setTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
+                this.setTemporaryCache(exports.TemporaryCacheKeys.CCS_CREDENTIAL, JSON.stringify(ccsCredential), true);
             }
         };
         /**
@@ -9694,11 +9823,11 @@
                 this.removeItem(this.generateNonceKey(state));
                 this.removeItem(this.generateAuthorityKey(state));
             }
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.ORIGIN_URI));
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.URL_HASH));
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.CORRELATION_ID));
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.CCS_CREDENTIAL));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.REQUEST_PARAMS));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.ORIGIN_URI));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.URL_HASH));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CORRELATION_ID));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.CCS_CREDENTIAL));
             this.setInteractionInProgress(false);
         };
         /**
@@ -9727,7 +9856,7 @@
             // Loop through all keys to find state key
             this.getKeys().forEach(function (key) {
                 // If this key is not the state key, move on
-                if (key.indexOf(TemporaryCacheKeys.REQUEST_STATE) === -1) {
+                if (key.indexOf(exports.TemporaryCacheKeys.REQUEST_STATE) === -1) {
                     return;
                 }
                 // Retrieve state value, return if not a valid value
@@ -9743,11 +9872,12 @@
                 }
             });
             this.clearMsalCookies();
+            this.setInteractionInProgress(false);
         };
         BrowserCacheManager.prototype.cacheCodeRequest = function (authCodeRequest, browserCrypto) {
             this.logger.trace("BrowserCacheManager.cacheCodeRequest called");
             var encodedValue = browserCrypto.base64Encode(JSON.stringify(authCodeRequest));
-            this.setTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, encodedValue, true);
+            this.setTemporaryCache(exports.TemporaryCacheKeys.REQUEST_PARAMS, encodedValue, true);
         };
         /**
          * Gets the token exchange parameters from the cache. Throws an error if nothing is found.
@@ -9755,7 +9885,7 @@
         BrowserCacheManager.prototype.getCachedRequest = function (state, browserCrypto) {
             this.logger.trace("BrowserCacheManager.getCachedRequest called");
             // Get token request from cache and parse as TokenExchangeParameters.
-            var encodedTokenRequest = this.getTemporaryCache(TemporaryCacheKeys.REQUEST_PARAMS, true);
+            var encodedTokenRequest = this.getTemporaryCache(exports.TemporaryCacheKeys.REQUEST_PARAMS, true);
             if (!encodedTokenRequest) {
                 throw BrowserAuthError.createNoTokenRequestCacheError();
             }
@@ -9763,7 +9893,7 @@
             if (!parsedRequest) {
                 throw BrowserAuthError.createUnableToParseTokenRequestCacheError();
             }
-            this.removeItem(this.generateCacheKey(TemporaryCacheKeys.REQUEST_PARAMS));
+            this.removeItem(this.generateCacheKey(exports.TemporaryCacheKeys.REQUEST_PARAMS));
             // Get cached authority and use if no authority is cached with request.
             if (StringUtils.isEmpty(parsedRequest.authority)) {
                 var authorityCacheKey = this.generateAuthorityKey(state);
@@ -9785,18 +9915,22 @@
             }
         };
         BrowserCacheManager.prototype.getInteractionInProgress = function () {
-            var key = Constants.CACHE_PREFIX + "." + TemporaryCacheKeys.INTERACTION_STATUS_KEY;
+            var key = Constants.CACHE_PREFIX + "." + exports.TemporaryCacheKeys.INTERACTION_STATUS_KEY;
             return this.getTemporaryCache(key, false);
         };
         BrowserCacheManager.prototype.setInteractionInProgress = function (inProgress) {
-            var clientId = this.getInteractionInProgress();
             // Ensure we don't overwrite interaction in progress for a different clientId
-            var key = Constants.CACHE_PREFIX + "." + TemporaryCacheKeys.INTERACTION_STATUS_KEY;
-            if (inProgress && !clientId) {
-                // No interaction is in progress
-                this.setTemporaryCache(key, this.clientId, false);
+            var key = Constants.CACHE_PREFIX + "." + exports.TemporaryCacheKeys.INTERACTION_STATUS_KEY;
+            if (inProgress) {
+                if (this.getInteractionInProgress()) {
+                    throw BrowserAuthError.createInteractionInProgressError();
+                }
+                else {
+                    // No interaction is in progress
+                    this.setTemporaryCache(key, this.clientId, false);
+                }
             }
-            else if (!inProgress && clientId === this.clientId) {
+            else if (!inProgress && this.getInteractionInProgress() === this.clientId) {
                 this.removeItem(key);
             }
         };
@@ -9833,6 +9967,25 @@
             }
             return null;
         };
+        /**
+         * Updates a credential's cache key if the current cache key is outdated
+         */
+        BrowserCacheManager.prototype.updateCredentialCacheKey = function (currentCacheKey, credential) {
+            var updatedCacheKey = credential.generateCredentialKey();
+            if (currentCacheKey !== updatedCacheKey) {
+                var cacheItem = this.getItem(currentCacheKey);
+                if (cacheItem) {
+                    this.removeItem(currentCacheKey);
+                    this.setItem(updatedCacheKey, cacheItem);
+                    this.logger.verbose("Updated an outdated " + credential.credentialType + " cache key");
+                    return updatedCacheKey;
+                }
+                else {
+                    this.logger.error("Attempted to update an outdated " + credential.credentialType + " cache key but no item matching the outdated key was found in storage");
+                }
+            }
+            return currentCacheKey;
+        };
         return BrowserCacheManager;
     }(CacheManager));
     var DEFAULT_BROWSER_CACHE_MANAGER = function (clientId, logger) {
@@ -10304,7 +10457,11 @@
             postLogoutRedirectUri: "",
             navigateToLoginRequestUrl: true,
             clientCapabilities: [],
-            protocolMode: exports.ProtocolMode.AAD
+            protocolMode: exports.ProtocolMode.AAD,
+            azureCloudOptions: {
+                azureCloudInstance: exports.AzureCloudInstance.None,
+                tenant: ""
+            },
         };
         // Default cache options for browser
         var DEFAULT_CACHE_OPTIONS = {
@@ -10333,7 +10490,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.20.0";
+    var version = "2.22.1";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10550,28 +10707,42 @@
          * @param request
          */
         BaseInteractionClient.prototype.initializeBaseRequest = function (request) {
-            this.logger.verbose("Initializing BaseAuthRequest");
-            var authority = request.authority || this.config.auth.authority;
-            var scopes = __spread(((request && request.scopes) || []));
-            // Set authenticationScheme to BEARER if not explicitly set in the request
-            if (!request.authenticationScheme) {
-                request.authenticationScheme = exports.AuthenticationScheme.BEARER;
-                this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
-            }
-            else {
-                if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
-                    if (!request.sshJwk) {
-                        throw ClientConfigurationError.createMissingSshJwkError();
-                    }
-                    if (!request.sshKid) {
-                        throw ClientConfigurationError.createMissingSshKidError();
+            return __awaiter$1(this, void 0, void 0, function () {
+                var authority, scopes, validatedRequest, _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.verbose("Initializing BaseAuthRequest");
+                            authority = request.authority || this.config.auth.authority;
+                            scopes = __spread(((request && request.scopes) || []));
+                            validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
+                                scopes: scopes });
+                            // Set authenticationScheme to BEARER if not explicitly set in the request
+                            if (!validatedRequest.authenticationScheme) {
+                                validatedRequest.authenticationScheme = exports.AuthenticationScheme.BEARER;
+                                this.logger.verbose("Authentication Scheme wasn't explicitly set in request, defaulting to \"Bearer\" request");
+                            }
+                            else {
+                                if (validatedRequest.authenticationScheme === exports.AuthenticationScheme.SSH) {
+                                    if (!request.sshJwk) {
+                                        throw ClientConfigurationError.createMissingSshJwkError();
+                                    }
+                                    if (!request.sshKid) {
+                                        throw ClientConfigurationError.createMissingSshKidError();
+                                    }
+                                }
+                                this.logger.verbose("Authentication Scheme set to \"" + validatedRequest.authenticationScheme + "\" as configured in Auth request");
+                            }
+                            if (!(request.claims && !StringUtils.isEmpty(request.claims))) return [3 /*break*/, 2];
+                            _a = validatedRequest;
+                            return [4 /*yield*/, this.browserCrypto.hashString(request.claims)];
+                        case 1:
+                            _a.requestedClaimsHash = _b.sent();
+                            _b.label = 2;
+                        case 2: return [2 /*return*/, validatedRequest];
                     }
-                }
-                this.logger.verbose("Authentication Scheme set to \"" + request.authenticationScheme + "\" as configured in Auth request");
-            }
-            var validatedRequest = __assign$1(__assign$1({}, request), { correlationId: this.correlationId, authority: authority,
-                scopes: scopes });
-            return validatedRequest;
+                });
+            });
         };
         /**
          *
@@ -10648,11 +10819,32 @@
          */
         StandardInteractionClient.prototype.initializeLogoutRequest = function (logoutRequest) {
             this.logger.verbose("initializeLogoutRequest called", logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.correlationId);
-            // Check if interaction is in progress. Throw error if true.
-            if (this.browserStorage.isInteractionInProgress()) {
-                throw BrowserAuthError.createInteractionInProgressError();
-            }
             var validLogoutRequest = __assign$1({ correlationId: this.browserCrypto.createNewGuid() }, logoutRequest);
+            /**
+             * Set logout_hint to be login_hint from ID Token Claims if present
+             * and logoutHint attribute wasn't manually set in logout request
+             */
+            if (logoutRequest) {
+                // If logoutHint isn't set and an account was passed in, try to extract logoutHint from ID Token Claims
+                if (!logoutRequest.logoutHint) {
+                    if (logoutRequest.account) {
+                        var logoutHint = this.getLogoutHintFromIdTokenClaims(logoutRequest.account);
+                        if (logoutHint) {
+                            this.logger.verbose("Setting logoutHint to login_hint ID Token Claim value for the account provided");
+                            validLogoutRequest.logoutHint = logoutHint;
+                        }
+                    }
+                    else {
+                        this.logger.verbose("logoutHint was not set and account was not passed into logout request, logoutHint will not be set");
+                    }
+                }
+                else {
+                    this.logger.verbose("logoutHint has already been set in logoutRequest");
+                }
+            }
+            else {
+                this.logger.verbose("logoutHint will not be set since no logout request was configured");
+            }
             /*
              * Only set redirect uri if logout request isn't provided or the set uri isn't null.
              * Otherwise, use passed uri, config, or current page.
@@ -10679,17 +10871,37 @@
             }
             return validLogoutRequest;
         };
+        /**
+         * Parses login_hint ID Token Claim out of AccountInfo object to be used as
+         * logout_hint in end session request.
+         * @param account
+         */
+        StandardInteractionClient.prototype.getLogoutHintFromIdTokenClaims = function (account) {
+            var idTokenClaims = account.idTokenClaims;
+            if (idTokenClaims) {
+                if (idTokenClaims.login_hint) {
+                    return idTokenClaims.login_hint;
+                }
+                else {
+                    this.logger.verbose("The ID Token Claims tied to the provided account do not contain a login_hint claim, logoutHint will not be added to logout request");
+                }
+            }
+            else {
+                this.logger.verbose("The provided account does not contain ID Token Claims, logoutHint will not be added to logout request");
+            }
+            return null;
+        };
         /**
          * Creates an Authorization Code Client with the given authority, or the default authority.
          * @param serverTelemetryManager
          * @param authorityUrl
          */
-        StandardInteractionClient.prototype.createAuthCodeClient = function (serverTelemetryManager, authorityUrl) {
+        StandardInteractionClient.prototype.createAuthCodeClient = function (serverTelemetryManager, authorityUrl, requestAzureCloudOptions) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var clientConfig;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl)];
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, requestAzureCloudOptions)];
                         case 1:
                             clientConfig = _a.sent();
                             return [2 /*return*/, new AuthorizationCodeClient(clientConfig)];
@@ -10703,14 +10915,14 @@
          * @param requestAuthority
          * @param requestCorrelationId
          */
-        StandardInteractionClient.prototype.getClientConfiguration = function (serverTelemetryManager, requestAuthority) {
+        StandardInteractionClient.prototype.getClientConfiguration = function (serverTelemetryManager, requestAuthority, requestAzureCloudOptions) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var discoveredAuthority;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             this.logger.verbose("getClientConfiguration called");
-                            return [4 /*yield*/, this.getDiscoveredAuthority(requestAuthority)];
+                            return [4 /*yield*/, this.getDiscoveredAuthority(requestAuthority, requestAzureCloudOptions)];
                         case 1:
                             discoveredAuthority = _a.sent();
                             return [2 /*return*/, {
@@ -10770,9 +10982,9 @@
          * @param requestAuthority
          * @param requestCorrelationId
          */
-        StandardInteractionClient.prototype.getDiscoveredAuthority = function (requestAuthority) {
+        StandardInteractionClient.prototype.getDiscoveredAuthority = function (requestAuthority, requestAzureCloudOptions) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var authorityOptions;
+                var authorityOptions, userAuthority, builtAuthority;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -10781,63 +10993,55 @@
                                 protocolMode: this.config.auth.protocolMode,
                                 knownAuthorities: this.config.auth.knownAuthorities,
                                 cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                                authorityMetadata: this.config.auth.authorityMetadata
+                                authorityMetadata: this.config.auth.authorityMetadata,
                             };
-                            if (!requestAuthority) return [3 /*break*/, 2];
-                            this.logger.verbose("Creating discovered authority with request authority");
-                            return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(requestAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
-                        case 1: return [2 /*return*/, _a.sent()];
-                        case 2:
+                            userAuthority = requestAuthority ? requestAuthority : this.config.auth.authority;
+                            builtAuthority = Authority.generateAuthority(userAuthority, requestAzureCloudOptions || this.config.auth.azureCloudOptions);
                             this.logger.verbose("Creating discovered authority with configured authority");
-                            return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(this.config.auth.authority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
-                        case 3: return [2 /*return*/, _a.sent()];
+                            return [4 /*yield*/, AuthorityFactory.createDiscoveredInstance(builtAuthority, this.config.system.networkClient, this.browserStorage, authorityOptions)];
+                        case 1: return [2 /*return*/, _a.sent()];
                     }
                 });
             });
         };
-        /**
-         * Helper to validate app environment before making a request.
-         * @param request
-         * @param interactionType
-         */
-        StandardInteractionClient.prototype.preflightInteractiveRequest = function (request, interactionType) {
-            this.logger.verbose("preflightInteractiveRequest called, validating app environment", request === null || request === void 0 ? void 0 : request.correlationId);
-            // block the reload if it occurred inside a hidden iframe
-            BrowserUtils.blockReloadInHiddenIframes();
-            // Check if interaction is in progress. Throw error if true.
-            if (this.browserStorage.isInteractionInProgress(false)) {
-                throw BrowserAuthError.createInteractionInProgressError();
-            }
-            return this.initializeAuthorizationRequest(request, interactionType);
-        };
         /**
          * Helper to initialize required request parameters for interactive APIs and ssoSilent()
          * @param request
          * @param interactionType
          */
         StandardInteractionClient.prototype.initializeAuthorizationRequest = function (request, interactionType) {
-            this.logger.verbose("initializeAuthorizationRequest called");
-            var redirectUri = this.getRedirectUri(request.redirectUri);
-            var browserState = {
-                interactionType: interactionType
-            };
-            var state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || "", browserState);
-            var validatedRequest = __assign$1(__assign$1({}, this.initializeBaseRequest(request)), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT });
-            var account = request.account || this.browserStorage.getActiveAccount();
-            if (account) {
-                this.logger.verbose("Setting validated request account");
-                this.logger.verbosePii("Setting validated request account: " + account);
-                validatedRequest.account = account;
-            }
-            // Check for ADAL/MSAL v1 SSO
-            if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
-                var legacyLoginHint = this.browserStorage.getLegacyLoginHint();
-                if (legacyLoginHint) {
-                    validatedRequest.loginHint = legacyLoginHint;
-                }
-            }
-            this.browserStorage.updateCacheEntries(validatedRequest.state, validatedRequest.nonce, validatedRequest.authority, validatedRequest.loginHint || "", validatedRequest.account || null);
-            return validatedRequest;
+            return __awaiter$1(this, void 0, void 0, function () {
+                var redirectUri, browserState, state, validatedRequest, _a, account, legacyLoginHint;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            this.logger.verbose("initializeAuthorizationRequest called");
+                            redirectUri = this.getRedirectUri(request.redirectUri);
+                            browserState = {
+                                interactionType: interactionType
+                            };
+                            state = ProtocolUtils.setRequestState(this.browserCrypto, (request && request.state) || Constants.EMPTY_STRING, browserState);
+                            _a = [{}];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1:
+                            validatedRequest = __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { redirectUri: redirectUri, state: state, nonce: request.nonce || this.browserCrypto.createNewGuid(), responseMode: ResponseMode.FRAGMENT }]);
+                            account = request.account || this.browserStorage.getActiveAccount();
+                            if (account) {
+                                this.logger.verbose("Setting validated request account");
+                                this.logger.verbosePii("Setting validated request account: " + account);
+                                validatedRequest.account = account;
+                            }
+                            // Check for ADAL/MSAL v1 SSO
+                            if (StringUtils.isEmpty(validatedRequest.loginHint) && !account) {
+                                legacyLoginHint = this.browserStorage.getLegacyLoginHint();
+                                if (legacyLoginHint) {
+                                    validatedRequest.loginHint = legacyLoginHint;
+                                }
+                            }
+                            return [2 /*return*/, validatedRequest];
+                    }
+                });
+            });
         };
         return StandardInteractionClient;
     }(BaseInteractionClient));
@@ -11004,8 +11208,8 @@
          * @param clientId
          * @param request
          */
-        PopupUtils.generatePopupName = function (clientId, request) {
-            return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + request.scopes.join("-") + "." + request.authority + "." + request.correlationId;
+        PopupUtils.generatePopupName = function (clientId, scopes, authority, correlationId) {
+            return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + scopes.join("-") + "." + authority + "." + correlationId;
         };
         /**
          * Generates the name for the popup based on the client id and request for logouts
@@ -11138,7 +11342,7 @@
          */
         InteractionHandler.prototype.checkCcsCredentials = function () {
             // Look up ccs credential in temp cache
-            var cachedCcsCred = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CCS_CREDENTIAL, true);
+            var cachedCcsCred = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CCS_CREDENTIAL, true);
             if (cachedCcsCred) {
                 try {
                     return JSON.parse(cachedCcsCred);
@@ -11176,8 +11380,6 @@
         PopupHandler.prototype.initiateAuthRequest = function (requestUrl, params) {
             // Check that request url is not empty.
             if (!StringUtils.isEmpty(requestUrl)) {
-                // Set interaction status in the library.
-                this.browserStorage.setInteractionInProgress(true);
                 this.browserRequestLogger.infoPii("Navigate to: " + requestUrl);
                 // Open the popup window to requestUrl.
                 return this.popupUtils.openPopup(requestUrl, params);
@@ -11228,20 +11430,19 @@
          */
         PopupClient.prototype.acquireToken = function (request) {
             try {
-                var validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Popup);
-                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, validRequest);
+                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
                 var popupWindowAttributes = request.popupWindowAttributes || {};
                 // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
                 if (this.config.system.asyncPopups) {
                     this.logger.verbose("asyncPopups set to true, acquiring token");
                     // Passes on popup position and dimensions if in request
-                    return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes);
+                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes);
                 }
                 else {
                     // asyncPopups flag is set to false. Opens popup before acquiring token.
                     this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
                     var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
-                    return this.acquireTokenPopupAsync(validRequest, popupName, popupWindowAttributes, popup);
+                    return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
                 }
             }
             catch (e) {
@@ -11287,26 +11488,30 @@
          *
          * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
          */
-        PopupClient.prototype.acquireTokenPopupAsync = function (validRequest, popupName, popupWindowAttributes, popup) {
+        PopupClient.prototype.acquireTokenPopupAsync = function (request, popupName, popupWindowAttributes, popup) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
+                var serverTelemetryManager, validRequest, authCodeRequest, authClient, navigateUrl, interactionHandler, popupParameters, popupWindow, hash, state, result, e_1;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             this.logger.verbose("acquireTokenPopupAsync called");
                             serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenPopup);
-                            _a.label = 1;
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Popup)];
                         case 1:
-                            _a.trys.push([1, 7, , 8]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                            validRequest = _a.sent();
+                            this.browserStorage.updateCacheEntries(validRequest.state, validRequest.nonce, validRequest.authority, validRequest.loginHint || "", validRequest.account || null);
+                            _a.label = 2;
                         case 2:
-                            authCodeRequest = _a.sent();
-                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority)];
+                            _a.trys.push([2, 8, , 9]);
+                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
                         case 3:
+                            authCodeRequest = _a.sent();
+                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority, validRequest.azureCloudOptions)];
+                        case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
-                        case 4:
+                        case 5:
                             navigateUrl = _a.sent();
                             interactionHandler = new PopupHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
                             popupParameters = {
@@ -11317,16 +11522,16 @@
                             popupWindow = interactionHandler.initiateAuthRequest(navigateUrl, popupParameters);
                             this.eventHandler.emitEvent(exports.EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow: popupWindow }, null);
                             return [4 /*yield*/, interactionHandler.monitorPopupForHash(popupWindow)];
-                        case 5:
+                        case 6:
                             hash = _a.sent();
                             state = this.validateAndExtractStateFromHash(hash, exports.InteractionType.Popup, validRequest.correlationId);
                             // Remove throttle if it exists
                             ThrottlingUtils.removeThrottle(this.browserStorage, this.config.auth.clientId, authCodeRequest);
                             return [4 /*yield*/, interactionHandler.handleCodeResponseFromHash(hash, state, authClient.authority, this.networkClient)];
-                        case 6:
+                        case 7:
                             result = _a.sent();
                             return [2 /*return*/, result];
-                        case 7:
+                        case 8:
                             e_1 = _a.sent();
                             if (popup) {
                                 // Close the synchronous popup if an error is thrown before the window unload event is registered
@@ -11338,7 +11543,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(validRequest.state);
                             throw e_1;
-                        case 8: return [2 /*return*/];
+                        case 9: return [2 /*return*/];
                     }
                 });
             });
@@ -11369,7 +11574,6 @@
                         case 2:
                             // Clear cache on logout
                             _a.sent();
-                            this.browserStorage.setInteractionInProgress(true);
                             return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, requestAuthority)];
                         case 3:
                             authClient = _a.sent();
@@ -11403,7 +11607,7 @@
                                 };
                                 absoluteUrl = UrlString.getAbsoluteUrl(mainWindowRedirectUri, BrowserUtils.getCurrentUri());
                                 this.logger.verbose("Redirecting main window to url specified in the request");
-                                this.logger.verbosePii("Redirecing main window to: " + absoluteUrl);
+                                this.logger.verbosePii("Redirecting main window to: " + absoluteUrl);
                                 this.navigationClient.navigateInternal(absoluteUrl, navigationOptions);
                             }
                             else {
@@ -11460,11 +11664,10 @@
                             // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
                             if (params.redirectStartPage) {
                                 this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
-                                this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, params.redirectStartPage, true);
+                                this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.ORIGIN_URI, params.redirectStartPage, true);
                             }
                             // Set interaction status in the library.
-                            this.browserStorage.setInteractionInProgress(true);
-                            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, this.authCodeRequest.correlationId, true);
+                            this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, this.authCodeRequest.correlationId, true);
                             this.browserStorage.cacheCodeRequest(this.authCodeRequest, this.browserCrypto);
                             this.browserRequestLogger.infoPii("RedirectHandler.initiateAuthRequest: Navigate to: " + requestUrl);
                             navigationOptions = {
@@ -11578,46 +11781,59 @@
          */
         RedirectClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var validRequest, serverTelemetryManager, authCodeRequest, authClient, interactionHandler, navigateUrl, redirectStartPage, e_1;
+                var validRequest, serverTelemetryManager, handleBackButton, authCodeRequest, authClient, interactionHandler, navigateUrl, redirectStartPage, e_1;
+                var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0:
-                            validRequest = this.preflightInteractiveRequest(request, exports.InteractionType.Redirect);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
-                            _a.label = 1;
+                        case 0: return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Redirect)];
                         case 1:
-                            _a.trys.push([1, 6, , 7]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
+                            validRequest = _a.sent();
+                            this.browserStorage.updateCacheEntries(validRequest.state, validRequest.nonce, validRequest.authority, validRequest.loginHint || "", validRequest.account || null);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenRedirect);
+                            handleBackButton = function (event) {
+                                // Clear temporary cache if the back button is clicked during the redirect flow.
+                                if (event.persisted) {
+                                    _this.logger.verbose("Page was restored from back/forward cache. Clearing temporary cache.");
+                                    _this.browserStorage.cleanRequestByState(validRequest.state);
+                                }
+                            };
+                            _a.label = 2;
                         case 2:
-                            authCodeRequest = _a.sent();
-                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority)];
+                            _a.trys.push([2, 7, , 8]);
+                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(validRequest)];
                         case 3:
+                            authCodeRequest = _a.sent();
+                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, validRequest.authority, validRequest.azureCloudOptions)];
+                        case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             interactionHandler = new RedirectHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.browserCrypto);
                             return [4 /*yield*/, authClient.getAuthCodeUrl(validRequest)];
-                        case 4:
+                        case 5:
                             navigateUrl = _a.sent();
                             redirectStartPage = this.getRedirectStartPage(request.redirectStartPage);
                             this.logger.verbosePii("Redirect start page: " + redirectStartPage);
+                            // Clear temporary cache if the back button is clicked during the redirect flow.
+                            window.addEventListener("pageshow", handleBackButton);
                             return [4 /*yield*/, interactionHandler.initiateAuthRequest(navigateUrl, {
                                     navigationClient: this.navigationClient,
                                     redirectTimeout: this.config.system.redirectNavigationTimeout,
                                     redirectStartPage: redirectStartPage,
                                     onRedirectNavigate: request.onRedirectNavigate
                                 })];
-                        case 5: 
+                        case 6: 
                         // Show the UI once the url has been created. Response will come back in the hash, which will be handled in the handleRedirectCallback function.
                         return [2 /*return*/, _a.sent()];
-                        case 6:
+                        case 7:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
                             }
+                            window.removeEventListener("pageshow", handleBackButton);
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(validRequest.state);
                             throw e_1;
-                        case 7: return [2 /*return*/];
+                        case 8: return [2 /*return*/];
                     }
                 });
             });
@@ -11652,7 +11868,6 @@
                             state = void 0;
                             try {
                                 state = this.validateAndExtractStateFromHash(responseHash, exports.InteractionType.Redirect);
-                                BrowserUtils.clearHash(window);
                                 this.logger.verbose("State extracted from hash");
                             }
                             catch (e) {
@@ -11660,7 +11875,7 @@
                                 this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Redirect);
                                 return [2 /*return*/, null];
                             }
-                            loginRequestUrl = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, true) || "";
+                            loginRequestUrl = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.ORIGIN_URI, true) || "";
                             loginRequestUrlNormalized = UrlString.removeHashFromUrl(loginRequestUrl);
                             currentUrlNormalized = UrlString.removeHashFromUrl(window.location.href);
                             if (!(loginRequestUrlNormalized === currentUrlNormalized && this.config.auth.navigateToLoginRequestUrl)) return [3 /*break*/, 3];
@@ -11684,7 +11899,7 @@
                              * Returned from authority using redirect - need to perform navigation before processing response
                              * Cache the hash to be retrieved after the next redirect
                              */
-                            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.URL_HASH, responseHash, true);
+                            this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.URL_HASH, responseHash, true);
                             navigationOptions = {
                                 apiId: exports.ApiId.handleRedirectPromise,
                                 timeout: this.config.system.redirectNavigationTimeout,
@@ -11694,7 +11909,7 @@
                             if (!(!loginRequestUrl || loginRequestUrl === "null")) return [3 /*break*/, 6];
                             homepage = BrowserUtils.getHomepage();
                             // Cache the homepage under ORIGIN_URI to ensure cached hash is processed on homepage
-                            this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, homepage, true);
+                            this.browserStorage.setTemporaryCache(exports.TemporaryCacheKeys.ORIGIN_URI, homepage, true);
                             this.logger.warning("Unable to get valid login request url from cache, redirecting to home page");
                             return [4 /*yield*/, this.navigationClient.navigateInternal(homepage, navigationOptions)];
                         case 5:
@@ -11736,12 +11951,13 @@
             this.logger.verbose("getRedirectResponseHash called");
             // Get current location hash from window or cache.
             var isResponseHash = UrlString.hashContainsKnownProperties(hash);
-            var cachedHash = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.URL_HASH, true);
-            this.browserStorage.removeItem(this.browserStorage.generateCacheKey(TemporaryCacheKeys.URL_HASH));
             if (isResponseHash) {
+                BrowserUtils.clearHash(window);
                 this.logger.verbose("Hash contains known properties, returning response hash");
                 return hash;
             }
+            var cachedHash = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.URL_HASH, true);
+            this.browserStorage.removeItem(this.browserStorage.generateCacheKey(exports.TemporaryCacheKeys.URL_HASH));
             this.logger.verbose("Hash does not contain known properties, returning cached hash");
             return cachedHash;
         };
@@ -12033,24 +12249,27 @@
                             if (request.prompt && request.prompt !== PromptValue.NONE) {
                                 throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                             }
-                            silentRequest = this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                            _a.label = 1;
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
                         case 1:
-                            _a.trys.push([1, 6, , 7]);
-                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
+                            silentRequest = _a.sent();
+                            this.browserStorage.updateCacheEntries(silentRequest.state, silentRequest.nonce, silentRequest.authority, silentRequest.loginHint || "", silentRequest.account || null);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                            _a.label = 2;
                         case 2:
-                            authCodeRequest = _a.sent();
-                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority)];
+                            _a.trys.push([2, 7, , 8]);
+                            return [4 /*yield*/, this.initializeAuthorizationCodeRequest(silentRequest)];
                         case 3:
+                            authCodeRequest = _a.sent();
+                            return [4 /*yield*/, this.createAuthCodeClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                        case 4:
                             authClient = _a.sent();
                             this.logger.verbose("Auth code client created");
                             return [4 /*yield*/, authClient.getAuthCodeUrl(silentRequest)];
-                        case 4:
+                        case 5:
                             navigateUrl = _a.sent();
                             return [4 /*yield*/, this.silentTokenHelper(navigateUrl, authCodeRequest, authClient, this.logger)];
-                        case 5: return [2 /*return*/, _a.sent()];
-                        case 6:
+                        case 6: return [2 /*return*/, _a.sent()];
+                        case 7:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -12058,7 +12277,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(silentRequest.state);
                             throw e_1;
-                        case 7: return [2 /*return*/];
+                        case 8: return [2 /*return*/];
                     }
                 });
             });
@@ -12114,16 +12333,19 @@
          */
         SilentRefreshClient.prototype.acquireToken = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var silentRequest, serverTelemetryManager, refreshTokenClient;
+                var silentRequest, _a, serverTelemetryManager, refreshTokenClient;
                 var _this = this;
-                return __generator$1(this, function (_a) {
-                    switch (_a.label) {
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
-                            silentRequest = __assign$1(__assign$1({}, request), this.initializeBaseRequest(request));
-                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                            return [4 /*yield*/, this.createRefreshTokenClient(serverTelemetryManager, silentRequest.authority)];
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
                         case 1:
-                            refreshTokenClient = _a.sent();
+                            silentRequest = __assign$1.apply(void 0, _a.concat([_b.sent()]));
+                            serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
+                            return [4 /*yield*/, this.createRefreshTokenClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
+                        case 2:
+                            refreshTokenClient = _b.sent();
                             this.logger.verbose("Refresh token client created");
                             // Send request to renew token. Auth module will throw errors if token cannot be renewed.
                             return [2 /*return*/, refreshTokenClient.acquireTokenByRefreshToken(silentRequest).catch(function (e) {
@@ -12149,12 +12371,12 @@
          * @param serverTelemetryManager
          * @param authorityUrl
          */
-        SilentRefreshClient.prototype.createRefreshTokenClient = function (serverTelemetryManager, authorityUrl) {
+        SilentRefreshClient.prototype.createRefreshTokenClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var clientConfig;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl)];
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
                         case 1:
                             clientConfig = _a.sent();
                             return [2 /*return*/, new RefreshTokenClient(clientConfig)];
@@ -12197,13 +12419,14 @@
                 this.loadAccessToken(request, response, request.account.homeAccountId, request.account.environment, request.account.tenantId, options);
             }
             else if (request.authority) {
+                var authorityUrl = Authority.generateAuthority(request.authority, request.azureCloudOptions);
                 var authorityOptions = {
                     protocolMode: this.config.auth.protocolMode,
                     knownAuthorities: this.config.auth.knownAuthorities,
                     cloudDiscoveryMetadata: this.config.auth.cloudDiscoveryMetadata,
-                    authorityMetadata: this.config.auth.authorityMetadata
+                    authorityMetadata: this.config.auth.authorityMetadata,
                 };
-                var authority = new Authority(request.authority, this.config.system.networkClient, this.storage, authorityOptions);
+                var authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
                 // "clientInfo" from options takes precedence over "clientInfo" in response
                 if (options.clientInfo) {
                     this.logger.trace("TokenCache - homeAccountId from options");
@@ -12322,14 +12545,17 @@
                             if (!request.code) {
                                 throw BrowserAuthError.createAuthCodeRequiredError();
                             }
-                            silentRequest = this.initializeAuthorizationRequest(request, exports.InteractionType.Silent);
-                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
-                            _a.label = 1;
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(request, exports.InteractionType.Silent)];
                         case 1:
-                            _a.trys.push([1, 3, , 4]);
+                            silentRequest = _a.sent();
+                            this.browserStorage.updateCacheEntries(silentRequest.state, silentRequest.nonce, silentRequest.authority, silentRequest.loginHint || "", silentRequest.account || null);
+                            serverTelemetryManager = this.initializeServerTelemetryManager(this.apiId);
+                            _a.label = 2;
+                        case 2:
+                            _a.trys.push([2, 4, , 5]);
                             authCodeRequest = __assign$1(__assign$1({}, silentRequest), { code: request.code });
                             return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, silentRequest.authority)];
-                        case 2:
+                        case 3:
                             clientConfig = _a.sent();
                             authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
                             this.logger.verbose("Auth code client created");
@@ -12341,7 +12567,7 @@
                                     cloud_graph_host_name: request.cloudGraphHostName,
                                     cloud_instance_host_name: request.cloudInstanceHostName
                                 }, silentRequest.state, authClient.authority, this.networkClient, false)];
-                        case 3:
+                        case 4:
                             e_1 = _a.sent();
                             if (e_1 instanceof AuthError) {
                                 e_1.setCorrelationId(this.correlationId);
@@ -12349,7 +12575,7 @@
                             serverTelemetryManager.cacheFailedRequest(e_1);
                             this.browserStorage.cleanRequestByState(silentRequest.state);
                             throw e_1;
-                        case 4: return [2 /*return*/];
+                        case 5: return [2 /*return*/];
                     }
                 });
             });
@@ -12440,7 +12666,7 @@
                         if (typeof response === "undefined") {
                             this.eventHandler.emitEvent(exports.EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
                             this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise");
-                            correlationId = this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
+                            correlationId = this.browserStorage.getTemporaryCache(exports.TemporaryCacheKeys.CORRELATION_ID, true) || "";
                             redirectClient = new RedirectClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, correlationId);
                             response = redirectClient.handleRedirectPromise(hash)
                                 .then(function (result) {
@@ -12497,8 +12723,8 @@
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     // Preflight request
-                    this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
                     this.logger.verbose("acquireTokenRedirect called");
+                    this.preflightBrowserEnvironmentCheck(exports.InteractionType.Redirect);
                     isLoggedIn = this.getAllAccounts().length > 0;
                     if (isLoggedIn) {
                         this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Redirect, request);
@@ -12532,8 +12758,8 @@
         ClientApplication.prototype.acquireTokenPopup = function (request) {
             var _this = this;
             try {
-                this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
                 this.logger.verbose("acquireTokenPopup called", request.correlationId);
+                this.preflightBrowserEnvironmentCheck(exports.InteractionType.Popup);
             }
             catch (e) {
                 // Since this function is syncronous we need to reject
@@ -12868,6 +13094,21 @@
                 !this.config.cache.storeAuthStateInCookie) {
                 throw BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError();
             }
+            if (interactionType === exports.InteractionType.Redirect || interactionType === exports.InteractionType.Popup) {
+                this.preflightInteractiveRequest();
+            }
+        };
+        /**
+         * Helper to validate app environment before making a request.
+         * @param request
+         * @param interactionType
+         */
+        ClientApplication.prototype.preflightInteractiveRequest = function () {
+            this.logger.verbose("preflightInteractiveRequest called, validating app environment");
+            // block the reload if it occurred inside a hidden iframe
+            BrowserUtils.blockReloadInHiddenIframes();
+            // Set interaction in progress temporary cache or throw if alread set.
+            this.browserStorage.setInteractionInProgress(true);
         };
         /**
          * Adds event callbacks to array
@@ -12959,7 +13200,7 @@
                     switch (_a.label) {
                         case 0:
                             serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.acquireTokenSilent_silentFlow);
-                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority)];
+                            return [4 /*yield*/, this.createSilentFlowClient(serverTelemetryManager, silentRequest.authority, silentRequest.azureCloudOptions)];
                         case 1:
                             silentAuthClient = _a.sent();
                             this.logger.verbose("Silent auth client created");
@@ -12994,12 +13235,12 @@
          * @param serverTelemetryManager
          * @param authorityUrl
          */
-        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl) {
+        SilentCacheClient.prototype.createSilentFlowClient = function (serverTelemetryManager, authorityUrl, azureCloudOptions) {
             return __awaiter$1(this, void 0, void 0, function () {
                 var clientConfig;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
-                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl)];
+                        case 0: return [4 /*yield*/, this.getClientConfiguration(serverTelemetryManager, authorityUrl, azureCloudOptions)];
                         case 1:
                             clientConfig = _a.sent();
                             return [2 /*return*/, new SilentFlowClient(clientConfig)];
@@ -13008,7 +13249,17 @@
             });
         };
         SilentCacheClient.prototype.initializeSilentRequest = function (request, account) {
-            return __assign$1(__assign$1(__assign$1({}, request), this.initializeBaseRequest(request)), { account: account, forceRefresh: request.forceRefresh || false });
+            return __awaiter$1(this, void 0, void 0, function () {
+                var _a;
+                return __generator$1(this, function (_b) {
+                    switch (_b.label) {
+                        case 0:
+                            _a = [__assign$1({}, request)];
+                            return [4 /*yield*/, this.initializeBaseRequest(request)];
+                        case 1: return [2 /*return*/, __assign$1.apply(void 0, [__assign$1.apply(void 0, _a.concat([_b.sent()])), { account: account, forceRefresh: request.forceRefresh || false }])];
+                    }
+                });
+            });
         };
         return SilentCacheClient;
     }(StandardInteractionClient));
@@ -13099,11 +13350,11 @@
                         authority: request.authority || "",
                         scopes: request.scopes,
                         homeAccountIdentifier: account.homeAccountId,
+                        claims: request.claims,
                         authenticationScheme: request.authenticationScheme,
                         resourceRequestMethod: request.resourceRequestMethod,
                         resourceRequestUri: request.resourceRequestUri,
                         shrClaims: request.shrClaims,
-                        sshJwk: request.sshJwk,
                         sshKid: request.sshKid
                     };
                     silentRequestKey = JSON.stringify(thumbprint);
@@ -13140,28 +13391,33 @@
                 var silentCacheClient, silentRequest;
                 var _this = this;
                 return __generator$1(this, function (_a) {
-                    silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
-                    silentRequest = silentCacheClient.initializeSilentRequest(request, account);
-                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
-                    return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                            var tokenRenewalResult, tokenRenewalError_1;
-                            return __generator$1(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        _a.trys.push([0, 2, , 3]);
-                                        return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
-                                    case 1:
-                                        tokenRenewalResult = _a.sent();
-                                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
-                                        return [2 /*return*/, tokenRenewalResult];
-                                    case 2:
-                                        tokenRenewalError_1 = _a.sent();
-                                        this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
-                                        throw tokenRenewalError_1;
-                                    case 3: return [2 /*return*/];
-                                }
-                            });
-                        }); })];
+                    switch (_a.label) {
+                        case 0:
+                            silentCacheClient = new SilentCacheClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, request.correlationId);
+                            return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
+                        case 1:
+                            silentRequest = _a.sent();
+                            this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_START, exports.InteractionType.Silent, request);
+                            return [2 /*return*/, silentCacheClient.acquireToken(silentRequest).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
+                                    var tokenRenewalResult, tokenRenewalError_1;
+                                    return __generator$1(this, function (_a) {
+                                        switch (_a.label) {
+                                            case 0:
+                                                _a.trys.push([0, 2, , 3]);
+                                                return [4 /*yield*/, this.acquireTokenByRefreshToken(silentRequest)];
+                                            case 1:
+                                                tokenRenewalResult = _a.sent();
+                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, tokenRenewalResult);
+                                                return [2 /*return*/, tokenRenewalResult];
+                                            case 2:
+                                                tokenRenewalError_1 = _a.sent();
+                                                this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Silent, null, tokenRenewalError_1);
+                                                throw tokenRenewalError_1;
+                                            case 3: return [2 /*return*/];
+                                        }
+                                    });
+                                }); })];
+                    }
                 });
             });
         };
@@ -13387,21 +13643,34 @@
     exports.AuthenticationHeaderParser = AuthenticationHeaderParser;
     exports.BrowserAuthError = BrowserAuthError;
     exports.BrowserAuthErrorMessage = BrowserAuthErrorMessage;
+    exports.BrowserCacheManager = BrowserCacheManager;
     exports.BrowserConfigurationAuthError = BrowserConfigurationAuthError;
     exports.BrowserConfigurationAuthErrorMessage = BrowserConfigurationAuthErrorMessage;
+    exports.BrowserConstants = BrowserConstants;
     exports.BrowserUtils = BrowserUtils;
     exports.ClientAuthError = ClientAuthError;
     exports.ClientAuthErrorMessage = ClientAuthErrorMessage;
     exports.ClientConfigurationError = ClientConfigurationError;
     exports.ClientConfigurationErrorMessage = ClientConfigurationErrorMessage;
+    exports.DEFAULT_IFRAME_TIMEOUT_MS = DEFAULT_IFRAME_TIMEOUT_MS;
+    exports.EventHandler = EventHandler;
     exports.EventMessageUtils = EventMessageUtils;
     exports.InteractionRequiredAuthError = InteractionRequiredAuthError;
     exports.InteractionRequiredAuthErrorMessage = InteractionRequiredAuthErrorMessage;
     exports.Logger = Logger;
     exports.NavigationClient = NavigationClient;
+    exports.OIDC_DEFAULT_SCOPES = OIDC_DEFAULT_SCOPES;
+    exports.PopupClient = PopupClient;
+    exports.PopupUtils = PopupUtils;
     exports.PublicClientApplication = PublicClientApplication;
+    exports.RedirectClient = RedirectClient;
+    exports.RedirectHandler = RedirectHandler;
     exports.ServerError = ServerError;
     exports.SignedHttpRequest = SignedHttpRequest;
+    exports.SilentCacheClient = SilentCacheClient;
+    exports.SilentIframeClient = SilentIframeClient;
+    exports.SilentRefreshClient = SilentRefreshClient;
+    exports.StandardInteractionClient = StandardInteractionClient;
     exports.StringUtils = StringUtils;
     exports.UrlString = UrlString;
     exports.stubbedPublicClientApplication = stubbedPublicClientApplication;