@azure/msal-browser 2.24.0 → 2.25.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.24.0 2022-05-02 */
+/*! @azure/msal-browser v2.25.0 2022-06-06 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -107,7 +107,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -194,7 +194,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -561,9 +561,14 @@
         CacheOutcome["NO_CACHED_ACCESS_TOKEN"] = "2";
         CacheOutcome["CACHED_ACCESS_TOKEN_EXPIRED"] = "3";
         CacheOutcome["REFRESH_CACHED_ACCESS_TOKEN"] = "4";
-    })(CacheOutcome || (CacheOutcome = {}));
+    })(CacheOutcome || (CacheOutcome = {}));
+    var JsonTypes;
+    (function (JsonTypes) {
+        JsonTypes["Jwt"] = "JWT";
+        JsonTypes["Jwk"] = "JWK";
+    })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -607,7 +612,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -682,7 +687,7 @@
         }
     };
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -872,6 +877,10 @@
         logoutNotSupported: {
             code: "end_session_endpoint_not_supported",
             desc: "Provided authority does not support logout."
+        },
+        keyIdMissing: {
+            code: "key_id_missing",
+            desc: "A keyId value is missing from the requested bound token's cache record and is required to match the token to it's stored binding key."
         }
     };
     /**
@@ -1141,10 +1150,16 @@
         ClientAuthError.createLogoutNotSupportedError = function () {
             return new ClientAuthError(ClientAuthErrorMessage.logoutNotSupported.code, ClientAuthErrorMessage.logoutNotSupported.desc);
         };
+        /**
+         * Create an error when kid attribute is missing from a PoP token's cache record
+         */
+        ClientAuthError.createKeyIdMissingError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.keyIdMissing.code, ClientAuthErrorMessage.keyIdMissing.desc);
+        };
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1269,7 +1284,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1449,12 +1464,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "6.3.0";
+    var version$1 = "6.4.0";
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1475,7 +1490,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1634,7 +1649,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1889,7 +1904,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2073,7 +2088,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2111,7 +2126,7 @@
         };
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2125,7 +2140,7 @@
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2363,7 +2378,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2401,7 +2416,7 @@
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3243,7 +3258,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3337,7 +3352,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS }, authOptions);
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3357,7 +3372,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3453,7 +3468,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3502,7 +3517,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3513,7 +3528,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3602,7 +3617,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3688,7 +3703,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4001,14 +4016,14 @@
          * @param username
          */
         RequestParameterBuilder.prototype.addUsername = function (username) {
-            this.parameters.set(PasswordGrantConstants.username, username);
+            this.parameters.set(PasswordGrantConstants.username, encodeURIComponent(username));
         };
         /**
          * adds `password` for Password Grant flow
          * @param password
          */
         RequestParameterBuilder.prototype.addPassword = function (password) {
-            this.parameters.set(PasswordGrantConstants.password, password);
+            this.parameters.set(PasswordGrantConstants.password, encodeURIComponent(password));
         };
         /**
          * add pop_jwk to query params
@@ -4062,7 +4077,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4127,7 +4142,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4177,7 +4192,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4291,7 +4306,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4358,7 +4373,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4422,7 +4437,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4438,7 +4453,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4509,7 +4524,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4710,7 +4725,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4727,34 +4742,30 @@
         }
         /**
          * Generates the req_cnf validated at the RP in the POP protocol for SHR parameters
+         * and returns an object containing the keyid, the full req_cnf string and the req_cnf string hash
          * @param request
          * @returns
          */
         PopTokenGenerator.prototype.generateCnf = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var reqCnf;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var reqCnf, reqCnfString, _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0: return [4 /*yield*/, this.generateKid(request)];
                         case 1:
-                            reqCnf = _a.sent();
-                            return [2 /*return*/, this.cryptoUtils.base64Encode(JSON.stringify(reqCnf))];
+                            reqCnf = _b.sent();
+                            reqCnfString = this.cryptoUtils.base64Encode(JSON.stringify(reqCnf));
+                            _a = {
+                                kid: reqCnf.kid,
+                                reqCnfString: reqCnfString
+                            };
+                            return [4 /*yield*/, this.cryptoUtils.hashString(reqCnfString)];
+                        case 2: return [2 /*return*/, (_a.reqCnfHash = _b.sent(),
+                                _a)];
                     }
                 });
             });
         };
-        /**
-         * Generates the hash of the req_cnf
-         * @param cnf
-         * @returns
-         */
-        PopTokenGenerator.prototype.generateCnfHash = function (cnf) {
-            return __awaiter(this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    return [2 /*return*/, this.cryptoUtils.hashString(cnf)];
-                });
-            });
-        };
         /**
          * Generates key_id for a SHR token request
          * @param request
@@ -4782,16 +4793,10 @@
          * @param request
          * @returns
          */
-        PopTokenGenerator.prototype.signPopToken = function (accessToken, request) {
-            var _a;
+        PopTokenGenerator.prototype.signPopToken = function (accessToken, keyId, request) {
             return __awaiter(this, void 0, void 0, function () {
-                var tokenClaims;
-                return __generator(this, function (_b) {
-                    tokenClaims = AuthToken.extractTokenClaims(accessToken, this.cryptoUtils);
-                    if (!((_a = tokenClaims === null || tokenClaims === void 0 ? void 0 : tokenClaims.cnf) === null || _a === void 0 ? void 0 : _a.kid)) {
-                        throw ClientAuthError.createTokenClaimsRequiredError();
-                    }
-                    return [2 /*return*/, this.signPayload(accessToken, tokenClaims.cnf.kid, request)];
+                return __generator(this, function (_a) {
+                    return [2 /*return*/, this.signPayload(accessToken, keyId, request)];
                 });
             });
         };
@@ -4803,7 +4808,7 @@
          * @param claims
          * @returns
          */
-        PopTokenGenerator.prototype.signPayload = function (payload, kid, request, claims) {
+        PopTokenGenerator.prototype.signPayload = function (payload, keyId, request, claims) {
             return __awaiter(this, void 0, void 0, function () {
                 var resourceRequestMethod, resourceRequestUri, shrClaims, shrNonce, resourceUrlString, resourceUrlComponents;
                 return __generator(this, function (_a) {
@@ -4812,7 +4817,7 @@
                             resourceRequestMethod = request.resourceRequestMethod, resourceRequestUri = request.resourceRequestUri, shrClaims = request.shrClaims, shrNonce = request.shrNonce;
                             resourceUrlString = (resourceRequestUri) ? new UrlString(resourceRequestUri) : undefined;
                             resourceUrlComponents = resourceUrlString === null || resourceUrlString === void 0 ? void 0 : resourceUrlString.getUrlComponents();
-                            return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), kid, request.correlationId)];
+                            return [4 /*yield*/, this.cryptoUtils.signJwt(__assign({ at: payload, ts: TimeUtils.nowSeconds(), m: resourceRequestMethod === null || resourceRequestMethod === void 0 ? void 0 : resourceRequestMethod.toUpperCase(), u: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.HostNameAndPort, nonce: shrNonce || this.cryptoUtils.createNewGuid(), p: resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.AbsolutePath, q: (resourceUrlComponents === null || resourceUrlComponents === void 0 ? void 0 : resourceUrlComponents.QueryString) ? [[], resourceUrlComponents.QueryString] : undefined, client_claims: shrClaims || undefined }, claims), keyId, request.correlationId)];
                         case 1: return [2 /*return*/, _a.sent()];
                     }
                 });
@@ -4821,7 +4826,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4891,7 +4896,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4927,7 +4932,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5136,9 +5141,9 @@
         ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
             var _a, _b, _c;
             return __awaiter(this, void 0, void 0, function () {
-                var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, uid, tid;
-                return __generator(this, function (_d) {
-                    switch (_d.label) {
+                var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
+                return __generator(this, function (_e) {
+                    switch (_e.label) {
                         case 0:
                             accessToken = Constants.EMPTY_STRING;
                             responseScopes = [];
@@ -5147,18 +5152,22 @@
                             if (!cacheRecord.accessToken) return [3 /*break*/, 4];
                             if (!(cacheRecord.accessToken.tokenType === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             popTokenGenerator = new PopTokenGenerator(cryptoObj);
-                            return [4 /*yield*/, popTokenGenerator.signPopToken(cacheRecord.accessToken.secret, request)];
+                            _d = cacheRecord.accessToken, secret = _d.secret, keyId = _d.keyId;
+                            if (!keyId) {
+                                throw ClientAuthError.createKeyIdMissingError();
+                            }
+                            return [4 /*yield*/, popTokenGenerator.signPopToken(secret, keyId, request)];
                         case 1:
-                            accessToken = _d.sent();
+                            accessToken = _e.sent();
                             return [3 /*break*/, 3];
                         case 2:
                             accessToken = cacheRecord.accessToken.secret;
-                            _d.label = 3;
+                            _e.label = 3;
                         case 3:
                             responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
                             expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
                             extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
-                            _d.label = 4;
+                            _e.label = 4;
                         case 4:
                             if (cacheRecord.appMetadata) {
                                 familyId = cacheRecord.appMetadata.familyId === THE_FAMILY_ID ? THE_FAMILY_ID : Constants.EMPTY_STRING;
@@ -5193,7 +5202,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5360,7 +5369,7 @@
          */
         AuthorizationCodeClient.prototype.createTokenRequestBody = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, clientAssertion, popTokenGenerator, cnfString, correlationId, ccsCred, clientInfo, clientInfo;
+                var parameterBuilder, clientAssertion, popTokenGenerator, reqCnfData, correlationId, ccsCred, clientInfo, clientInfo;
                 var _a;
                 return __generator(this, function (_b) {
                     switch (_b.label) {
@@ -5397,8 +5406,8 @@
                             if (this.config.clientCredentials.clientSecret) {
                                 parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                             }
-                            if (this.config.clientCredentials.clientAssertion) {
-                                clientAssertion = this.config.clientCredentials.clientAssertion;
+                            clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+                            if (clientAssertion) {
                                 parameterBuilder.addClientAssertion(clientAssertion.assertion);
                                 parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                             }
@@ -5408,8 +5417,9 @@
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            cnfString = _b.sent();
-                            parameterBuilder.addPopToken(cnfString);
+                            reqCnfData = _b.sent();
+                            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                             return [3 /*break*/, 3];
                         case 2:
                             if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5480,7 +5490,7 @@
          */
         AuthorizationCodeClient.prototype.createAuthCodeUrlQueryString = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, cnf, cnfHash;
+                var parameterBuilder, requestScopes, correlationId, accountSid, clientInfo, clientInfo, popTokenGenerator, reqCnfData;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5572,20 +5582,17 @@
                             if (request.extraQueryParameters) {
                                 parameterBuilder.addExtraQueryParameters(request.extraQueryParameters);
                             }
-                            if (!request.nativeBroker) return [3 /*break*/, 3];
+                            if (!request.nativeBroker) return [3 /*break*/, 2];
                             // signal ests that this is a WAM call
                             parameterBuilder.addNativeBroker();
-                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            cnf = _a.sent();
-                            return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
-                        case 2:
-                            cnfHash = _a.sent();
-                            parameterBuilder.addPopToken(cnfHash);
-                            _a.label = 3;
-                        case 3: return [2 /*return*/, parameterBuilder.createQueryString()];
+                            reqCnfData = _a.sent();
+                            parameterBuilder.addPopToken(reqCnfData.reqCnfHash);
+                            _a.label = 2;
+                        case 2: return [2 /*return*/, parameterBuilder.createQueryString()];
                     }
                 });
             });
@@ -5630,7 +5637,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5771,7 +5778,7 @@
          */
         RefreshTokenClient.prototype.createTokenRequestBody = function (request) {
             return __awaiter(this, void 0, void 0, function () {
-                var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, cnfString, clientInfo;
+                var parameterBuilder, correlationId, clientAssertion, popTokenGenerator, reqCnfData, clientInfo;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5792,8 +5799,8 @@
                             if (this.config.clientCredentials.clientSecret) {
                                 parameterBuilder.addClientSecret(this.config.clientCredentials.clientSecret);
                             }
-                            if (this.config.clientCredentials.clientAssertion) {
-                                clientAssertion = this.config.clientCredentials.clientAssertion;
+                            clientAssertion = request.clientAssertion || this.config.clientCredentials.clientAssertion;
+                            if (clientAssertion) {
                                 parameterBuilder.addClientAssertion(clientAssertion.assertion);
                                 parameterBuilder.addClientAssertionType(clientAssertion.assertionType);
                             }
@@ -5801,8 +5808,9 @@
                             popTokenGenerator = new PopTokenGenerator(this.cryptoUtils);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(request)];
                         case 1:
-                            cnfString = _a.sent();
-                            parameterBuilder.addPopToken(cnfString);
+                            reqCnfData = _a.sent();
+                            // SPA PoP requires full Base64Url encoded req_cnf string (unhashed)
+                            parameterBuilder.addPopToken(reqCnfData.reqCnfString);
                             return [3 /*break*/, 3];
                         case 2:
                             if (request.authenticationScheme === exports.AuthenticationScheme.SSH) {
@@ -5842,7 +5850,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5958,7 +5966,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5969,7 +5977,7 @@
             response.hasOwnProperty("issuer"));
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5983,7 +5991,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6058,7 +6066,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6068,7 +6076,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6190,7 +6198,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6780,7 +6788,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6841,7 +6849,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6872,7 +6880,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6900,7 +6908,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6917,7 +6925,92 @@
         }
     };
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * ClientAuthErrorMessage class containing string constants used by error codes and messages.
+     */
+    var JoseHeaderErrorMessage = {
+        missingKidError: {
+            code: "missing_kid_error",
+            desc: "The JOSE Header for the requested JWT, JWS or JWK object requires a keyId to be configured as the 'kid' header claim. No 'kid' value was provided."
+        },
+        missingAlgError: {
+            code: "missing_alg_error",
+            desc: "The JOSE Header for the requested JWT, JWS or JWK object requires an algorithm to be specified as the 'alg' header claim. No 'alg' value was provided."
+        },
+    };
+    /**
+     * Error thrown when there is an error in the client code running on the browser.
+     */
+    var JoseHeaderError = /** @class */ (function (_super) {
+        __extends(JoseHeaderError, _super);
+        function JoseHeaderError(errorCode, errorMessage) {
+            var _this = _super.call(this, errorCode, errorMessage) || this;
+            _this.name = "JoseHeaderError";
+            Object.setPrototypeOf(_this, JoseHeaderError.prototype);
+            return _this;
+        }
+        /**
+         * Creates an error thrown when keyId isn't set on JOSE header.
+         */
+        JoseHeaderError.createMissingKidError = function () {
+            return new JoseHeaderError(JoseHeaderErrorMessage.missingKidError.code, JoseHeaderErrorMessage.missingKidError.desc);
+        };
+        /**
+         * Creates an error thrown when algorithm isn't set on JOSE header.
+         */
+        JoseHeaderError.createMissingAlgError = function () {
+            return new JoseHeaderError(JoseHeaderErrorMessage.missingAlgError.code, JoseHeaderErrorMessage.missingAlgError.desc);
+        };
+        return JoseHeaderError;
+    }(AuthError));
+
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var JoseHeader = /** @class */ (function () {
+        function JoseHeader(options) {
+            this.typ = options.typ;
+            this.alg = options.alg;
+            this.kid = options.kid;
+        }
+        /**
+         * Builds SignedHttpRequest formatted JOSE Header from the
+         * JOSE Header options provided or previously set on the object and returns
+         * the stringified header object.
+         * Throws if keyId or algorithm aren't provided since they are required for Access Token Binding.
+         * @param shrHeaderOptions
+         * @returns
+         */
+        JoseHeader.getShrHeaderString = function (shrHeaderOptions) {
+            // KeyID is required on the SHR header
+            if (!shrHeaderOptions.kid) {
+                throw JoseHeaderError.createMissingKidError();
+            }
+            // Alg is required on the SHR header
+            if (!shrHeaderOptions.alg) {
+                throw JoseHeaderError.createMissingAlgError();
+            }
+            var shrHeader = new JoseHeader({
+                // Access Token PoP headers must have type JWT, but the type header can be overriden for special cases
+                typ: shrHeaderOptions.typ || JsonTypes.Jwt,
+                kid: shrHeaderOptions.kid,
+                alg: shrHeaderOptions.alg
+            });
+            return JSON.stringify(shrHeader);
+        };
+        return JoseHeader;
+    }());
+
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6976,7 +7069,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7138,7 +7231,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -7235,7 +7328,7 @@
         PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
     })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7505,7 +7598,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v6.3.0 2022-05-02 */
+    /*! @azure/msal-common v6.4.0 2022-06-06 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7563,7 +7656,7 @@
         },
         hashEmptyError: {
             code: "hash_empty_error",
-            desc: "Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash."
+            desc: "Hash value cannot be processed because it is empty. Please verify that your redirectUri is not clearing the hash. For more visit: aka.ms/msaljs/browser-errors."
         },
         hashDoesNotContainStateError: {
             code: "no_state_in_hash",
@@ -7571,7 +7664,7 @@
         },
         hashDoesNotContainKnownPropertiesError: {
             code: "hash_does_not_contain_known_properties",
-            desc: "Hash does not contain known properites. Please verify that your redirectUri is not changing the hash."
+            desc: "Hash does not contain known properites. Please verify that your redirectUri is not changing the hash. For more visit: aka.ms/msaljs/browser-errors."
         },
         unableToParseStateError: {
             code: "unable_to_parse_state",
@@ -9301,7 +9394,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.24.0";
+    var version = "2.25.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10154,11 +10247,11 @@
      * Abstract class which defines operations for a browser interaction handling class.
      */
     var InteractionHandler = /** @class */ (function () {
-        function InteractionHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) {
+        function InteractionHandler(authCodeModule, storageImpl, authCodeRequest, logger) {
             this.authModule = authCodeModule;
             this.browserStorage = storageImpl;
             this.authCodeRequest = authCodeRequest;
-            this.browserRequestLogger = browserRequestLogger;
+            this.logger = logger;
         }
         /**
          * Function to handle response parameters from hash.
@@ -10168,7 +10261,7 @@
             return __awaiter$1(this, void 0, void 0, function () {
                 var stateKey, requestState, authCodeResponse;
                 return __generator$1(this, function (_a) {
-                    this.browserRequestLogger.verbose("InteractionHandler.handleCodeResponse called");
+                    this.logger.verbose("InteractionHandler.handleCodeResponse called");
                     // Check that location hash isn't empty.
                     if (StringUtils.isEmpty(locationHash)) {
                         throw BrowserAuthError.createEmptyHashError(locationHash);
@@ -10209,7 +10302,7 @@
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            this.browserRequestLogger.trace("InteractionHandler.handleCodeResponseFromServer called");
+                            this.logger.trace("InteractionHandler.handleCodeResponseFromServer called");
                             stateKey = this.browserStorage.generateStateKey(state);
                             requestState = this.browserStorage.getTemporaryCache(stateKey);
                             if (!requestState) {
@@ -10297,8 +10390,8 @@
      */
     var RedirectHandler = /** @class */ (function (_super) {
         __extends$1(RedirectHandler, _super);
-        function RedirectHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger, browserCrypto) {
-            var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
+        function RedirectHandler(authCodeModule, storageImpl, authCodeRequest, logger, browserCrypto) {
+            var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
             _this.browserCrypto = browserCrypto;
             return _this;
         }
@@ -10312,38 +10405,38 @@
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest called");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest called");
                             if (!!StringUtils.isEmpty(requestUrl)) return [3 /*break*/, 7];
                             // Cache start page, returns to this page after redirectUri if navigateToLoginRequestUrl is true
                             if (params.redirectStartPage) {
-                                this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
+                                this.logger.verbose("RedirectHandler.initiateAuthRequest: redirectStartPage set, caching start page");
                                 this.browserStorage.setTemporaryCache(TemporaryCacheKeys.ORIGIN_URI, params.redirectStartPage, true);
                             }
                             // Set interaction status in the library.
                             this.browserStorage.setTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, this.authCodeRequest.correlationId, true);
                             this.browserStorage.cacheCodeRequest(this.authCodeRequest, this.browserCrypto);
-                            this.browserRequestLogger.infoPii("RedirectHandler.initiateAuthRequest: Navigate to: " + requestUrl);
+                            this.logger.infoPii("RedirectHandler.initiateAuthRequest: Navigate to: " + requestUrl);
                             navigationOptions = {
                                 apiId: exports.ApiId.acquireTokenRedirect,
                                 timeout: params.redirectTimeout,
                                 noHistory: false
                             };
                             if (!(typeof params.onRedirectNavigate === "function")) return [3 /*break*/, 4];
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest: Invoking onRedirectNavigate callback");
                             navigate = params.onRedirectNavigate(requestUrl);
                             if (!(navigate !== false)) return [3 /*break*/, 2];
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate did not return false, navigating");
                             return [4 /*yield*/, params.navigationClient.navigateExternal(requestUrl, navigationOptions)];
                         case 1:
                             _a.sent();
                             return [2 /*return*/];
                         case 2:
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest: onRedirectNavigate returned false, stopping navigation");
                             return [2 /*return*/];
                         case 3: return [3 /*break*/, 6];
                         case 4:
                             // Navigate window to request URL
-                            this.browserRequestLogger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
+                            this.logger.verbose("RedirectHandler.initiateAuthRequest: Navigating window to navigate url");
                             return [4 /*yield*/, params.navigationClient.navigateExternal(requestUrl, navigationOptions)];
                         case 5:
                             _a.sent();
@@ -10351,7 +10444,7 @@
                         case 6: return [3 /*break*/, 8];
                         case 7:
                             // Throw error if request URL is empty.
-                            this.browserRequestLogger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
+                            this.logger.info("RedirectHandler.initiateAuthRequest: Navigate url is empty");
                             throw BrowserAuthError.createEmptyNavigationUriError();
                         case 8: return [2 /*return*/];
                     }
@@ -10368,7 +10461,7 @@
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
-                            this.browserRequestLogger.verbose("RedirectHandler.handleCodeResponse called");
+                            this.logger.verbose("RedirectHandler.handleCodeResponse called");
                             // Check that location hash isn't empty.
                             if (StringUtils.isEmpty(locationHash)) {
                                 throw BrowserAuthError.createEmptyHashError(locationHash);
@@ -10469,6 +10562,7 @@
         NativeStatusCode["NO_NETWORK"] = "NO_NETWORK";
         NativeStatusCode["TRANSIENT_ERROR"] = "TRANSIENT_ERROR";
         NativeStatusCode["PERSISTENT_ERROR"] = "PERSISTENT_ERROR";
+        NativeStatusCode["DISABLED"] = "DISABLED";
     })(NativeStatusCode || (NativeStatusCode = {}));
     var NativeAuthErrorMessage = {
         extensionError: {
@@ -10492,7 +10586,7 @@
          * These errors should result in a fallback to the 'standard' browser based auth flow.
          */
         NativeAuthError.prototype.isFatal = function () {
-            if (this.ext && this.ext.status && this.ext.status === NativeStatusCode.PERSISTENT_ERROR) {
+            if (this.ext && this.ext.status && (this.ext.status === NativeStatusCode.PERSISTENT_ERROR || this.ext.status === NativeStatusCode.DISABLED)) {
                 return true;
             }
             switch (this.errorCode) {
@@ -10721,7 +10815,7 @@
                             uid = accountProperties["UID"] || idTokenObj.claims.oid || idTokenObj.claims.sub || Constants.EMPTY_STRING;
                             tid = accountProperties["TenantId"] || idTokenObj.claims.tid || Constants.EMPTY_STRING;
                             responseTokenType = exports.AuthenticationScheme.BEARER;
-                            _a = request.token_type;
+                            _a = request.tokenType;
                             switch (_a) {
                                 case exports.AuthenticationScheme.POP: return [3 /*break*/, 2];
                             }
@@ -10742,7 +10836,14 @@
                                 shrClaims: request.shrClaims,
                                 shrNonce: request.shrNonce
                             };
-                            return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, shrParameters)];
+                            /**
+                             * KeyID must be present in the native request from when the PoP key was generated in order for
+                             * PopTokenGenerator to query the full key for signing
+                             */
+                            if (!request.keyId) {
+                                throw ClientAuthError.createKeyIdMissingError();
+                            }
+                            return [4 /*yield*/, popTokenGenerator.signPopToken(response.access_token, request.keyId, shrParameters)];
                         case 3:
                             responseAccessToken = _b.sent();
                             return [3 /*break*/, 5];
@@ -10800,9 +10901,9 @@
          */
         NativeInteractionClient.prototype.initializeNativeRequest = function (request) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var authority, canonicalAuthority, scopes, scopeSet, instanceAware, validatedRequest, shrParameters, popTokenGenerator, cnf, _a;
-                return __generator$1(this, function (_b) {
-                    switch (_b.label) {
+                var authority, canonicalAuthority, scopes, scopeSet, validatedRequest, shrParameters, popTokenGenerator, reqCnfData;
+                return __generator$1(this, function (_a) {
+                    switch (_a.label) {
                         case 0:
                             this.logger.trace("NativeInteractionClient - initializeNativeRequest called");
                             authority = request.authority || this.config.auth.authority;
@@ -10822,10 +10923,9 @@
                                         throw BrowserAuthError.createNativePromptParameterNotSupportedError();
                                 }
                             }
-                            instanceAware = !!(request.extraQueryParameters && request.extraQueryParameters.instance_aware);
-                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, instance_aware: instanceAware, token_type: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
+                            validatedRequest = __assign$1(__assign$1({}, request), { accountId: this.accountId, clientId: this.config.auth.clientId, authority: canonicalAuthority.urlString, scopes: scopeSet.printScopes(), redirectUri: this.getRedirectUri(request.redirectUri), correlationId: this.correlationId, tokenType: request.authenticationScheme, windowTitleSubstring: document.title, extraParameters: __assign$1(__assign$1({}, request.extraQueryParameters), request.tokenQueryParameters), extendedExpiryToken: false // Make this configurable?
                              });
-                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 3];
+                            if (!(request.authenticationScheme === exports.AuthenticationScheme.POP)) return [3 /*break*/, 2];
                             shrParameters = {
                                 resourceRequestUri: request.resourceRequestUri,
                                 resourceRequestMethod: request.resourceRequestMethod,
@@ -10835,15 +10935,12 @@
                             popTokenGenerator = new PopTokenGenerator(this.browserCrypto);
                             return [4 /*yield*/, popTokenGenerator.generateCnf(shrParameters)];
                         case 1:
-                            cnf = _b.sent();
+                            reqCnfData = _a.sent();
                             // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                            _a = validatedRequest;
-                            return [4 /*yield*/, popTokenGenerator.generateCnfHash(cnf)];
+                            validatedRequest.reqCnf = reqCnfData.reqCnfHash;
+                            validatedRequest.keyId = reqCnfData.kid;
+                            _a.label = 2;
                         case 2:
-                            // to reduce the URL length, it is recommended to send the hash of the req_cnf instead of the whole string
-                            _a.req_cnf = _b.sent();
-                            _b.label = 3;
-                        case 3:
                             if (this.apiId === exports.ApiId.ssoSilent || this.apiId === exports.ApiId.acquireTokenSilent_silentFlow) {
                                 validatedRequest.prompt = PromptValue.NONE;
                             }
@@ -11419,249 +11516,17 @@
         return RedirectClient;
     }(StandardInteractionClient));
 
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    var PopupUtils = /** @class */ (function () {
-        function PopupUtils(storageImpl, logger) {
-            this.browserStorage = storageImpl;
-            this.logger = logger;
-            // Properly sets this reference for the unload event.
-            this.unloadWindow = this.unloadWindow.bind(this);
-        }
-        /**
-         * @hidden
-         *
-         * Configures popup window for login.
-         *
-         * @param urlNavigate
-         * @param title
-         * @param popUpWidth
-         * @param popUpHeight
-         * @param popupWindowAttributes
-         * @ignore
-         * @hidden
-         */
-        PopupUtils.prototype.openPopup = function (urlNavigate, popupParams) {
-            try {
-                var popupWindow = void 0;
-                // Popup window passed in, setting url to navigate to
-                if (popupParams.popup) {
-                    popupWindow = popupParams.popup;
-                    this.logger.verbosePii("Navigating popup window to: " + urlNavigate);
-                    popupWindow.location.assign(urlNavigate);
-                }
-                else if (typeof popupParams.popup === "undefined") {
-                    // Popup will be undefined if it was not passed in
-                    this.logger.verbosePii("Opening popup window to: " + urlNavigate);
-                    popupWindow = PopupUtils.openSizedPopup(urlNavigate, popupParams.popupName, popupParams.popupWindowAttributes, this.logger);
-                }
-                // Popup will be null if popups are blocked
-                if (!popupWindow) {
-                    throw BrowserAuthError.createEmptyWindowCreatedError();
-                }
-                if (popupWindow.focus) {
-                    popupWindow.focus();
-                }
-                this.currentWindow = popupWindow;
-                window.addEventListener("beforeunload", this.unloadWindow);
-                return popupWindow;
-            }
-            catch (e) {
-                this.logger.error("error opening popup " + e.message);
-                this.browserStorage.setInteractionInProgress(false);
-                throw BrowserAuthError.createPopupWindowError(e.toString());
-            }
-        };
-        /**
-         * Helper function to set popup window dimensions and position
-         * @param urlNavigate
-         * @param popupName
-         * @param popupWindowAttributes
-         * @returns
-         */
-        PopupUtils.openSizedPopup = function (urlNavigate, popupName, popupWindowAttributes, logger) {
-            var _a, _b, _c, _d;
-            /**
-             * adding winLeft and winTop to account for dual monitor
-             * using screenLeft and screenTop for IE8 and earlier
-             */
-            var winLeft = window.screenLeft ? window.screenLeft : window.screenX;
-            var winTop = window.screenTop ? window.screenTop : window.screenY;
-            /**
-             * window.innerWidth displays browser window"s height and width excluding toolbars
-             * using document.documentElement.clientWidth for IE8 and earlier
-             */
-            var winWidth = window.innerWidth || document.documentElement.clientWidth || document.body.clientWidth;
-            var winHeight = window.innerHeight || document.documentElement.clientHeight || document.body.clientHeight;
-            var width = (_a = popupWindowAttributes.popupSize) === null || _a === void 0 ? void 0 : _a.width;
-            var height = (_b = popupWindowAttributes.popupSize) === null || _b === void 0 ? void 0 : _b.height;
-            var top = (_c = popupWindowAttributes.popupPosition) === null || _c === void 0 ? void 0 : _c.top;
-            var left = (_d = popupWindowAttributes.popupPosition) === null || _d === void 0 ? void 0 : _d.left;
-            if (!width || width < 0 || width > winWidth) {
-                logger.verbose("Default popup window width used. Window width not configured or invalid.");
-                width = BrowserConstants.POPUP_WIDTH;
-            }
-            if (!height || height < 0 || height > winHeight) {
-                logger.verbose("Default popup window height used. Window height not configured or invalid.");
-                height = BrowserConstants.POPUP_HEIGHT;
-            }
-            if (!top || top < 0 || top > winHeight) {
-                logger.verbose("Default popup window top position used. Window top not configured or invalid.");
-                top = Math.max(0, ((winHeight / 2) - (BrowserConstants.POPUP_HEIGHT / 2)) + winTop);
-            }
-            if (!left || left < 0 || left > winWidth) {
-                logger.verbose("Default popup window left position used. Window left not configured or invalid.");
-                left = Math.max(0, ((winWidth / 2) - (BrowserConstants.POPUP_WIDTH / 2)) + winLeft);
-            }
-            return window.open(urlNavigate, popupName, "width=" + width + ", height=" + height + ", top=" + top + ", left=" + left + ", scrollbars=yes");
-        };
-        /**
-         * Event callback to unload main window.
-         */
-        PopupUtils.prototype.unloadWindow = function (e) {
-            this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Popup);
-            if (this.currentWindow) {
-                this.currentWindow.close();
-            }
-            // Guarantees browser unload will happen, so no other errors will be thrown.
-            e.preventDefault();
-        };
-        /**
-         * Closes popup, removes any state vars created during popup calls.
-         * @param popupWindow
-         */
-        PopupUtils.prototype.cleanPopup = function (popupWindow) {
-            if (popupWindow) {
-                // Close window.
-                popupWindow.close();
-            }
-            // Remove window unload function
-            window.removeEventListener("beforeunload", this.unloadWindow);
-            // Interaction is completed - remove interaction status.
-            this.browserStorage.setInteractionInProgress(false);
-        };
-        /**
-         * Monitors a window until it loads a url with the same origin.
-         * @param popupWindow - window that is being monitored
-         */
-        PopupUtils.prototype.monitorPopupForSameOrigin = function (popupWindow) {
-            var _this = this;
-            return new Promise(function (resolve, reject) {
-                var intervalId = setInterval(function () {
-                    if (popupWindow.closed) {
-                        // Window is closed
-                        _this.cleanPopup();
-                        clearInterval(intervalId);
-                        reject(BrowserAuthError.createUserCancelledError());
-                        return;
-                    }
-                    var href = Constants.EMPTY_STRING;
-                    try {
-                        /*
-                         * Will throw if cross origin,
-                         * which should be caught and ignored
-                         * since we need the interval to keep running while on STS UI.
-                         */
-                        href = popupWindow.location.href;
-                    }
-                    catch (e) { }
-                    // Don't process blank pages or cross domain
-                    if (StringUtils.isEmpty(href) || href === "about:blank") {
-                        return;
-                    }
-                    clearInterval(intervalId);
-                    resolve();
-                }, BrowserConstants.POLL_INTERVAL_MS);
-            });
-        };
-        /**
-         * Generates the name for the popup based on the client id and request
-         * @param clientId
-         * @param request
-         */
-        PopupUtils.generatePopupName = function (clientId, scopes, authority, correlationId) {
-            return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + scopes.join("-") + "." + authority + "." + correlationId;
-        };
-        /**
-         * Generates the name for the popup based on the client id and request for logouts
-         * @param clientId
-         * @param request
-         */
-        PopupUtils.generateLogoutPopupName = function (clientId, request) {
-            var homeAccountId = request.account && request.account.homeAccountId;
-            return BrowserConstants.POPUP_NAME_PREFIX + "." + clientId + "." + homeAccountId + "." + request.correlationId;
-        };
-        return PopupUtils;
-    }());
-
-    /*
-     * Copyright (c) Microsoft Corporation. All rights reserved.
-     * Licensed under the MIT License.
-     */
-    /**
-     * This class implements the interaction handler base class for browsers. It is written specifically for handling
-     * popup window scenarios. It includes functions for monitoring the popup window for a hash.
-     */
-    var PopupHandler = /** @class */ (function (_super) {
-        __extends$1(PopupHandler, _super);
-        function PopupHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) {
-            var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
-            // Properly sets this reference for the unload event.
-            _this.popupUtils = new PopupUtils(storageImpl, browserRequestLogger);
-            return _this;
-        }
-        /**
-         * Opens a popup window with given request Url.
-         * @param requestUrl
-         */
-        PopupHandler.prototype.initiateAuthRequest = function (requestUrl, params) {
-            // Check that request url is not empty.
-            if (!StringUtils.isEmpty(requestUrl)) {
-                this.browserRequestLogger.infoPii("Navigate to: " + requestUrl);
-                // Open the popup window to requestUrl.
-                return this.popupUtils.openPopup(requestUrl, params);
-            }
-            else {
-                // Throw error if request URL is empty.
-                this.browserRequestLogger.error("Navigate url is empty");
-                throw BrowserAuthError.createEmptyNavigationUriError();
-            }
-        };
-        /**
-         * Monitors a window until it loads a url with a known hash, or hits a specified timeout.
-         * @param popupWindow - window that is being monitored
-         * @param timeout - milliseconds until timeout
-         */
-        PopupHandler.prototype.monitorPopupForHash = function (popupWindow) {
-            var _this = this;
-            return this.popupUtils.monitorPopupForSameOrigin(popupWindow).then(function () {
-                var contentHash = popupWindow.location.hash;
-                BrowserUtils.clearHash(popupWindow);
-                _this.popupUtils.cleanPopup(popupWindow);
-                if (!contentHash) {
-                    throw BrowserAuthError.createEmptyHashError(popupWindow.location.href);
-                }
-                if (UrlString.hashContainsKnownProperties(contentHash)) {
-                    return contentHash;
-                }
-                else {
-                    throw BrowserAuthError.createHashDoesNotContainKnownPropertiesError();
-                }
-            });
-        };
-        return PopupHandler;
-    }(InteractionHandler));
-
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
     var PopupClient = /** @class */ (function (_super) {
         __extends$1(PopupClient, _super);
-        function PopupClient() {
-            return _super !== null && _super.apply(this, arguments) || this;
+        function PopupClient(config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) {
+            var _this = _super.call(this, config, storageImpl, browserCrypto, logger, eventHandler, navigationClient, performanceClient, nativeMessageHandler, correlationId) || this;
+            // Properly sets this reference for the unload event.
+            _this.unloadWindow = _this.unloadWindow.bind(_this);
+            return _this;
         }
         /**
          * Acquires tokens by opening a popup window to the /authorize endpoint of the authority
@@ -11669,7 +11534,7 @@
          */
         PopupClient.prototype.acquireToken = function (request) {
             try {
-                var popupName = PopupUtils.generatePopupName(this.config.auth.clientId, request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority, this.correlationId);
+                var popupName = this.generatePopupName(request.scopes || OIDC_DEFAULT_SCOPES, request.authority || this.config.auth.authority);
                 var popupWindowAttributes = request.popupWindowAttributes || {};
                 // asyncPopups flag is true. Acquires token without first opening popup. Popup will be opened later asynchronously.
                 if (this.config.system.asyncPopups) {
@@ -11680,7 +11545,7 @@
                 else {
                     // asyncPopups flag is set to false. Opens popup before acquiring token.
                     this.logger.verbose("asyncPopup set to false, opening popup before acquiring token");
-                    var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                    var popup = this.openSizedPopup("about:blank", popupName, popupWindowAttributes);
                     return this.acquireTokenPopupAsync(request, popupName, popupWindowAttributes, popup);
                 }
             }
@@ -11696,7 +11561,7 @@
             try {
                 this.logger.verbose("logoutPopup called");
                 var validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
-                var popupName = PopupUtils.generateLogoutPopupName(this.config.auth.clientId, validLogoutRequest);
+                var popupName = this.generateLogoutPopupName(validLogoutRequest);
                 var authority = logoutRequest && logoutRequest.authority;
                 var mainWindowRedirectUri = logoutRequest && logoutRequest.mainWindowRedirectUri;
                 var popupWindowAttributes = (logoutRequest === null || logoutRequest === void 0 ? void 0 : logoutRequest.popupWindowAttributes) || {};
@@ -11709,7 +11574,7 @@
                 else {
                     // asyncPopups flag is set to false. Opens popup before logging out.
                     this.logger.verbose("asyncPopup set to false, opening popup");
-                    var popup = PopupUtils.openSizedPopup("about:blank", popupName, popupWindowAttributes, this.logger);
+                    var popup = this.openSizedPopup("about:blank", popupName, popupWindowAttributes);
                     return this.logoutPopupAsync(validLogoutRequest, popupName, popupWindowAttributes, authority, popup, mainWindowRedirectUri);
                 }
             }
@@ -11758,15 +11623,15 @@
                             return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, validRequest), { nativeBroker: isNativeBroker }))];
                         case 5:
                             navigateUrl = _a.sent();
-                            interactionHandler = new PopupHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
+                            interactionHandler = new InteractionHandler(authClient, this.browserStorage, authCodeRequest, this.logger);
                             popupParameters = {
                                 popup: popup,
                                 popupName: popupName,
                                 popupWindowAttributes: popupWindowAttributes
                             };
-                            popupWindow = interactionHandler.initiateAuthRequest(navigateUrl, popupParameters);
+                            popupWindow = this.initiateAuthRequest(navigateUrl, popupParameters);
                             this.eventHandler.emitEvent(exports.EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow: popupWindow }, null);
-                            return [4 /*yield*/, interactionHandler.monitorPopupForHash(popupWindow)];
+                            return [4 /*yield*/, this.monitorPopupForHash(popupWindow)];
                         case 6:
                             hash = _a.sent();
                             serverParams = UrlString.getDeserializedHash(hash);
@@ -11824,7 +11689,7 @@
          */
         PopupClient.prototype.logoutPopupAsync = function (validRequest, popupName, popupWindowAttributes, requestAuthority, popup, mainWindowRedirectUri) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var serverTelemetryManager, authClient, logoutUri, popupUtils, popupWindow, e_2, navigationOptions, absoluteUrl, e_3;
+                var serverTelemetryManager, authClient, logoutUri, popupWindow, navigationOptions, absoluteUrl, e_2;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -11833,7 +11698,7 @@
                             serverTelemetryManager = this.initializeServerTelemetryManager(exports.ApiId.logoutPopup);
                             _a.label = 1;
                         case 1:
-                            _a.trys.push([1, 8, , 9]);
+                            _a.trys.push([1, 5, , 6]);
                             // Clear cache on logout
                             return [4 /*yield*/, this.clearCacheOnLogout(validRequest.account)];
                         case 2:
@@ -11845,25 +11710,11 @@
                             this.logger.verbose("Auth code client created");
                             logoutUri = authClient.getLogoutUri(validRequest);
                             this.eventHandler.emitEvent(exports.EventType.LOGOUT_SUCCESS, exports.InteractionType.Popup, validRequest);
-                            popupUtils = new PopupUtils(this.browserStorage, this.logger);
-                            popupWindow = popupUtils.openPopup(logoutUri, { popupName: popupName, popupWindowAttributes: popupWindowAttributes, popup: popup });
+                            popupWindow = this.openPopup(logoutUri, { popupName: popupName, popupWindowAttributes: popupWindowAttributes, popup: popup });
                             this.eventHandler.emitEvent(exports.EventType.POPUP_OPENED, exports.InteractionType.Popup, { popupWindow: popupWindow }, null);
-                            _a.label = 4;
+                            return [4 /*yield*/, this.waitForLogoutPopup(popupWindow)];
                         case 4:
-                            _a.trys.push([4, 6, , 7]);
-                            // Don't care if this throws an error (User Cancelled)
-                            return [4 /*yield*/, popupUtils.monitorPopupForSameOrigin(popupWindow)];
-                        case 5:
-                            // Don't care if this throws an error (User Cancelled)
                             _a.sent();
-                            this.logger.verbose("Popup successfully redirected to postLogoutRedirectUri");
-                            return [3 /*break*/, 7];
-                        case 6:
-                            e_2 = _a.sent();
-                            this.logger.verbose("Error occurred while monitoring popup for same origin. Session on server may remain active. Error: " + e_2);
-                            return [3 /*break*/, 7];
-                        case 7:
-                            popupUtils.cleanPopup(popupWindow);
                             if (mainWindowRedirectUri) {
                                 navigationOptions = {
                                     apiId: exports.ApiId.logoutPopup,
@@ -11878,28 +11729,280 @@
                             else {
                                 this.logger.verbose("No main window navigation requested");
                             }
-                            return [3 /*break*/, 9];
-                        case 8:
-                            e_3 = _a.sent();
+                            return [3 /*break*/, 6];
+                        case 5:
+                            e_2 = _a.sent();
                             if (popup) {
                                 // Close the synchronous popup if an error is thrown before the window unload event is registered
                                 popup.close();
                             }
-                            if (e_3 instanceof AuthError) {
-                                e_3.setCorrelationId(this.correlationId);
+                            if (e_2 instanceof AuthError) {
+                                e_2.setCorrelationId(this.correlationId);
                             }
                             this.browserStorage.setInteractionInProgress(false);
-                            this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_3);
+                            this.eventHandler.emitEvent(exports.EventType.LOGOUT_FAILURE, exports.InteractionType.Popup, null, e_2);
                             this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
-                            serverTelemetryManager.cacheFailedRequest(e_3);
-                            throw e_3;
-                        case 9:
+                            serverTelemetryManager.cacheFailedRequest(e_2);
+                            throw e_2;
+                        case 6:
                             this.eventHandler.emitEvent(exports.EventType.LOGOUT_END, exports.InteractionType.Popup);
                             return [2 /*return*/];
                     }
                 });
             });
         };
+        /**
+         * Opens a popup window with given request Url.
+         * @param requestUrl
+         */
+        PopupClient.prototype.initiateAuthRequest = function (requestUrl, params) {
+            // Check that request url is not empty.
+            if (!StringUtils.isEmpty(requestUrl)) {
+                this.logger.infoPii("Navigate to: " + requestUrl);
+                // Open the popup window to requestUrl.
+                return this.openPopup(requestUrl, params);
+            }
+            else {
+                // Throw error if request URL is empty.
+                this.logger.error("Navigate url is empty");
+                throw BrowserAuthError.createEmptyNavigationUriError();
+            }
+        };
+        /**
+         * Monitors a window until it loads a url with the same origin.
+         * @param popupWindow - window that is being monitored
+         * @param timeout - timeout for processing hash once popup is redirected back to application
+         */
+        PopupClient.prototype.monitorPopupForHash = function (popupWindow) {
+            var _this = this;
+            return new Promise(function (resolve, reject) {
+                /*
+                 * Polling for popups needs to be tick-based,
+                 * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
+                 */
+                var maxTicks = _this.config.system.windowHashTimeout / BrowserConstants.POLL_INTERVAL_MS;
+                var ticks = 0;
+                _this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
+                var intervalId = setInterval(function () {
+                    // Window is closed
+                    if (popupWindow.closed) {
+                        _this.logger.error("PopupHandler.monitorPopupForHash - window closed");
+                        _this.cleanPopup();
+                        clearInterval(intervalId);
+                        reject(BrowserAuthError.createUserCancelledError());
+                        return;
+                    }
+                    var href = Constants.EMPTY_STRING;
+                    var hash = Constants.EMPTY_STRING;
+                    try {
+                        /*
+                         * Will throw if cross origin,
+                         * which should be caught and ignored
+                         * since we need the interval to keep running while on STS UI.
+                         */
+                        href = popupWindow.location.href;
+                        hash = popupWindow.location.hash;
+                    }
+                    catch (e) { }
+                    // Don't process blank pages or cross domain
+                    if (StringUtils.isEmpty(href) || href === "about:blank") {
+                        return;
+                    }
+                    _this.logger.verbose("PopupHandler.monitorPopupForHash - popup window is on same origin as caller");
+                    /*
+                     * Only run clock when we are on same domain for popups
+                     * as popup operations can take a long time.
+                     */
+                    ticks++;
+                    if (hash) {
+                        _this.logger.verbose("PopupHandler.monitorPopupForHash - found hash in url");
+                        clearInterval(intervalId);
+                        _this.cleanPopup(popupWindow);
+                        if (UrlString.hashContainsKnownProperties(hash)) {
+                            _this.logger.verbose("PopupHandler.monitorPopupForHash - hash contains known properties, returning.");
+                            resolve(hash);
+                        }
+                        else {
+                            _this.logger.error("PopupHandler.monitorPopupForHash - found hash in url but it does not contain known properties. Check that your router is not changing the hash prematurely.");
+                            _this.logger.errorPii("PopupHandler.monitorPopupForHash - hash found: " + hash);
+                            reject(BrowserAuthError.createHashDoesNotContainKnownPropertiesError());
+                        }
+                    }
+                    else if (ticks > maxTicks) {
+                        _this.logger.error("PopupHandler.monitorPopupForHash - unable to find hash in url, timing out");
+                        clearInterval(intervalId);
+                        reject(BrowserAuthError.createMonitorPopupTimeoutError());
+                    }
+                }, BrowserConstants.POLL_INTERVAL_MS);
+            });
+        };
+        /**
+         * Waits for user interaction in logout popup window
+         * @param popupWindow
+         * @returns
+         */
+        PopupClient.prototype.waitForLogoutPopup = function (popupWindow) {
+            var _this = this;
+            return new Promise(function (resolve) {
+                _this.logger.verbose("PopupHandler.waitForLogoutPopup - polling started");
+                var intervalId = setInterval(function () {
+                    // Window is closed
+                    if (popupWindow.closed) {
+                        _this.logger.error("PopupHandler.waitForLogoutPopup - window closed");
+                        _this.cleanPopup();
+                        clearInterval(intervalId);
+                        resolve();
+                    }
+                    var href = Constants.EMPTY_STRING;
+                    try {
+                        /*
+                         * Will throw if cross origin,
+                         * which should be caught and ignored
+                         * since we need the interval to keep running while on STS UI.
+                         */
+                        href = popupWindow.location.href;
+                    }
+                    catch (e) { }
+                    // Don't process blank pages or cross domain
+                    if (StringUtils.isEmpty(href) || href === "about:blank") {
+                        return;
+                    }
+                    _this.logger.verbose("PopupHandler.waitForLogoutPopup - popup window is on same origin as caller, closing.");
+                    clearInterval(intervalId);
+                    _this.cleanPopup(popupWindow);
+                    resolve();
+                }, BrowserConstants.POLL_INTERVAL_MS);
+            });
+        };
+        /**
+         * @hidden
+         *
+         * Configures popup window for login.
+         *
+         * @param urlNavigate
+         * @param title
+         * @param popUpWidth
+         * @param popUpHeight
+         * @param popupWindowAttributes
+         * @ignore
+         * @hidden
+         */
+        PopupClient.prototype.openPopup = function (urlNavigate, popupParams) {
+            try {
+                var popupWindow = void 0;
+                // Popup window passed in, setting url to navigate to
+                if (popupParams.popup) {
+                    popupWindow = popupParams.popup;
+                    this.logger.verbosePii("Navigating popup window to: " + urlNavigate);
+                    popupWindow.location.assign(urlNavigate);
+                }
+                else if (typeof popupParams.popup === "undefined") {
+                    // Popup will be undefined if it was not passed in
+                    this.logger.verbosePii("Opening popup window to: " + urlNavigate);
+                    popupWindow = this.openSizedPopup(urlNavigate, popupParams.popupName, popupParams.popupWindowAttributes);
+                }
+                // Popup will be null if popups are blocked
+                if (!popupWindow) {
+                    throw BrowserAuthError.createEmptyWindowCreatedError();
+                }
+                if (popupWindow.focus) {
+                    popupWindow.focus();
+                }
+                this.currentWindow = popupWindow;
+                window.addEventListener("beforeunload", this.unloadWindow);
+                return popupWindow;
+            }
+            catch (e) {
+                this.logger.error("error opening popup " + e.message);
+                this.browserStorage.setInteractionInProgress(false);
+                throw BrowserAuthError.createPopupWindowError(e.toString());
+            }
+        };
+        /**
+         * Helper function to set popup window dimensions and position
+         * @param urlNavigate
+         * @param popupName
+         * @param popupWindowAttributes
+         * @returns
+         */
+        PopupClient.prototype.openSizedPopup = function (urlNavigate, popupName, popupWindowAttributes) {
+            var _a, _b, _c, _d;
+            /**
+             * adding winLeft and winTop to account for dual monitor
+             * using screenLeft and screenTop for IE8 and earlier
+             */
+            var winLeft = window.screenLeft ? window.screenLeft : window.screenX;
+            var winTop = window.screenTop ? window.screenTop : window.screenY;
+            /**
+             * window.innerWidth displays browser window"s height and width excluding toolbars
+             * using document.documentElement.clientWidth for IE8 and earlier
+             */
+            var winWidth = window.innerWidth || document.documentElement.clientWidth || document.body.clientWidth;
+            var winHeight = window.innerHeight || document.documentElement.clientHeight || document.body.clientHeight;
+            var width = (_a = popupWindowAttributes.popupSize) === null || _a === void 0 ? void 0 : _a.width;
+            var height = (_b = popupWindowAttributes.popupSize) === null || _b === void 0 ? void 0 : _b.height;
+            var top = (_c = popupWindowAttributes.popupPosition) === null || _c === void 0 ? void 0 : _c.top;
+            var left = (_d = popupWindowAttributes.popupPosition) === null || _d === void 0 ? void 0 : _d.left;
+            if (!width || width < 0 || width > winWidth) {
+                this.logger.verbose("Default popup window width used. Window width not configured or invalid.");
+                width = BrowserConstants.POPUP_WIDTH;
+            }
+            if (!height || height < 0 || height > winHeight) {
+                this.logger.verbose("Default popup window height used. Window height not configured or invalid.");
+                height = BrowserConstants.POPUP_HEIGHT;
+            }
+            if (!top || top < 0 || top > winHeight) {
+                this.logger.verbose("Default popup window top position used. Window top not configured or invalid.");
+                top = Math.max(0, ((winHeight / 2) - (BrowserConstants.POPUP_HEIGHT / 2)) + winTop);
+            }
+            if (!left || left < 0 || left > winWidth) {
+                this.logger.verbose("Default popup window left position used. Window left not configured or invalid.");
+                left = Math.max(0, ((winWidth / 2) - (BrowserConstants.POPUP_WIDTH / 2)) + winLeft);
+            }
+            return window.open(urlNavigate, popupName, "width=" + width + ", height=" + height + ", top=" + top + ", left=" + left + ", scrollbars=yes");
+        };
+        /**
+         * Event callback to unload main window.
+         */
+        PopupClient.prototype.unloadWindow = function (e) {
+            this.browserStorage.cleanRequestByInteractionType(exports.InteractionType.Popup);
+            if (this.currentWindow) {
+                this.currentWindow.close();
+            }
+            // Guarantees browser unload will happen, so no other errors will be thrown.
+            e.preventDefault();
+        };
+        /**
+         * Closes popup, removes any state vars created during popup calls.
+         * @param popupWindow
+         */
+        PopupClient.prototype.cleanPopup = function (popupWindow) {
+            if (popupWindow) {
+                // Close window.
+                popupWindow.close();
+            }
+            // Remove window unload function
+            window.removeEventListener("beforeunload", this.unloadWindow);
+            // Interaction is completed - remove interaction status.
+            this.browserStorage.setInteractionInProgress(false);
+        };
+        /**
+         * Generates the name for the popup based on the client id and request
+         * @param clientId
+         * @param request
+         */
+        PopupClient.prototype.generatePopupName = function (scopes, authority) {
+            return BrowserConstants.POPUP_NAME_PREFIX + "." + this.config.auth.clientId + "." + scopes.join("-") + "." + authority + "." + this.correlationId;
+        };
+        /**
+         * Generates the name for the popup based on the client id and request for logouts
+         * @param clientId
+         * @param request
+         */
+        PopupClient.prototype.generateLogoutPopupName = function (request) {
+            var homeAccountId = request.account && request.account.homeAccountId;
+            return BrowserConstants.POPUP_NAME_PREFIX + "." + this.config.auth.clientId + "." + homeAccountId + "." + this.correlationId;
+        };
         return PopupClient;
     }(StandardInteractionClient));
 
@@ -12022,8 +12125,8 @@
      */
     var SilentHandler = /** @class */ (function (_super) {
         __extends$1(SilentHandler, _super);
-        function SilentHandler(authCodeModule, storageImpl, authCodeRequest, browserRequestLogger, navigateFrameWait) {
-            var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, browserRequestLogger) || this;
+        function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, navigateFrameWait) {
+            var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
             _this.navigateFrameWait = navigateFrameWait;
             return _this;
         }
@@ -12040,7 +12143,7 @@
                         case 0:
                             if (StringUtils.isEmpty(requestUrl)) {
                                 // Throw error if request URL is empty.
-                                this.browserRequestLogger.info("Navigate url is empty");
+                                this.logger.info("Navigate url is empty");
                                 throw BrowserAuthError.createEmptyNavigationUriError();
                             }
                             if (!this.navigateFrameWait) return [3 /*break*/, 2];
@@ -12065,7 +12168,7 @@
             var _this = this;
             return new Promise(function (resolve, reject) {
                 if (timeout < DEFAULT_IFRAME_TIMEOUT_MS) {
-                    _this.browserRequestLogger.warning("system.loadFrameTimeout or system.iframeHashTimeout set to lower (" + timeout + "ms) than the default (" + DEFAULT_IFRAME_TIMEOUT_MS + "ms). This may result in timeouts.");
+                    _this.logger.warning("system.loadFrameTimeout or system.iframeHashTimeout set to lower (" + timeout + "ms) than the default (" + DEFAULT_IFRAME_TIMEOUT_MS + "ms). This may result in timeouts.");
                 }
                 /*
                  * Polling for iframes can be purely timing based,
@@ -12602,8 +12705,7 @@
         EventHandler: EventHandler,
         NativeMessageHandler: NativeMessageHandler,
         BrowserConstants: BrowserConstants,
-        get TemporaryCacheKeys () { return TemporaryCacheKeys; },
-        PopupUtils: PopupUtils
+        get TemporaryCacheKeys () { return TemporaryCacheKeys; }
     });
 
     /*
@@ -13971,7 +14073,7 @@
         CryptoOps.prototype.signJwt = function (payload, kid, correlationId) {
             var _a;
             return __awaiter$1(this, void 0, void 0, function () {
-                var signJwtMeasurement, cachedKeyPair, publicKeyJwk, publicKeyJwkString, header, encodedHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature, signedJwt;
+                var signJwtMeasurement, cachedKeyPair, publicKeyJwk, publicKeyJwkString, encodedKeyIdThumbprint, shrHeader, encodedShrHeader, encodedPayload, tokenString, tokenBuffer, signatureBuffer, encodedSignature, signedJwt;
                 return __generator$1(this, function (_b) {
                     switch (_b.label) {
                         case 0:
@@ -13986,17 +14088,15 @@
                         case 2:
                             publicKeyJwk = _b.sent();
                             publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
-                            header = {
-                                alg: publicKeyJwk.alg,
-                                type: KEY_FORMAT_JWK
-                            };
-                            encodedHeader = this.b64Encode.urlEncode(JSON.stringify(header));
+                            encodedKeyIdThumbprint = this.b64Encode.urlEncode(JSON.stringify({ kid: kid }));
+                            shrHeader = JoseHeader.getShrHeaderString({ kid: encodedKeyIdThumbprint, alg: publicKeyJwk.alg });
+                            encodedShrHeader = this.b64Encode.urlEncode(shrHeader);
                             // Generate payload
                             payload.cnf = {
                                 jwk: JSON.parse(publicKeyJwkString)
                             };
                             encodedPayload = this.b64Encode.urlEncode(JSON.stringify(payload));
-                            tokenString = encodedHeader + "." + encodedPayload;
+                            tokenString = encodedShrHeader + "." + encodedPayload;
                             tokenBuffer = BrowserStringUtils.stringToArrayBuffer(tokenString);
                             return [4 /*yield*/, this.browserCrypto.sign(cachedKeyPair.privateKey, tokenBuffer)];
                         case 3:
@@ -14140,7 +14240,7 @@
                 throw BrowserAuthError.createUnableToLoadTokenError("Please provide an extendedExpiresOn value in the options.");
             }
             var scopes = new ScopeSet(request.scopes).printScopes();
-            var expiresOn = response.expires_in;
+            var expiresOn = options.expiresOn || (response.expires_in + new Date().getTime() / 1000);
             var extendedExpiresOn = options.extendedExpiresOn;
             var accessTokenEntity = AccessTokenEntity.createAccessTokenEntity(homeAccountId, environment, response.access_token, this.config.auth.clientId, tenantId, scopes, expiresOn, extendedExpiresOn, this.cryptoObj);
             if (this.isBrowserEnvironment) {
@@ -14414,7 +14514,7 @@
                         case 0:
                             this.logger.trace("initialize called");
                             if (this.initialized) {
-                                this.logger.warning("initialize has already been called. This function only needs to be run once.");
+                                this.logger.info("initialize has already been called, exiting early.");
                                 return [2 /*return*/];
                             }
                             this.eventHandler.emitEvent(exports.EventType.INITIALIZE_START);