@azure/msal-browser 2.28.3 → 2.30.0

package/lib/msal-browser.js

@@ -1,4 +1,4 @@
-/*! @azure/msal-browser v2.28.3 2022-09-12 */
+/*! @azure/msal-browser v2.30.0 2022-10-10 */
 'use strict';
 (function (global, factory) {
     typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
@@ -119,7 +119,7 @@
         return ar;
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*! *****************************************************************************
     Copyright (c) Microsoft Corporation.
 
@@ -206,7 +206,7 @@
         return r;
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -223,6 +223,7 @@
         DEFAULT_COMMON_TENANT: "common",
         // ADFS String
         ADFS: "adfs",
+        DSTS: "dstsv2",
         // Default AAD Instance Discovery Endpoint
         AAD_INSTANCE_DISCOVERY_ENDPT: "https://login.microsoftonline.com/common/discovery/instance?api-version=1.1&authorization_endpoint=",
         // Resource delimiter - used for certain cache entries
@@ -254,6 +255,7 @@
         IMDS_TIMEOUT: 2000,
         AZURE_REGION_AUTO_DISCOVER_FLAG: "TryAutoDetect",
         REGIONAL_AUTH_PUBLIC_CLOUD_SUFFIX: "login.microsoft.com",
+        REGIONAL_AUTH_NON_MSI_QUERY_STRING: "allowestsrnonmsi=true",
         KNOWN_PUBLIC_CLOUDS: ["login.microsoftonline.com", "login.windows.net", "login.microsoft.com", "sts.windows.net"],
         TOKEN_RESPONSE_TYPE: "token",
         ID_TOKEN_RESPONSE_TYPE: "id_token",
@@ -277,6 +279,7 @@
         HeaderNames["CCS_HEADER"] = "X-AnchorMailbox";
         HeaderNames["WWWAuthenticate"] = "WWW-Authenticate";
         HeaderNames["AuthenticationInfo"] = "Authentication-Info";
+        HeaderNames["X_MS_REQUEST_ID"] = "x-ms-request-id";
     })(HeaderNames || (HeaderNames = {}));
     /**
      * Persistent cache keys MSAL which stay while user is logged in.
@@ -372,7 +375,8 @@
         SELECT_ACCOUNT: "select_account",
         CONSENT: "consent",
         NONE: "none",
-        CREATE: "create"
+        CREATE: "create",
+        NO_SESSION: "no_session"
     };
     /**
      * SSO Types - generated to populate hints
@@ -583,7 +587,7 @@
         JsonTypes["Jwk"] = "JWK";
     })(JsonTypes || (JsonTypes = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -639,7 +643,7 @@
         return AuthError;
     }(Error));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -714,7 +718,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -780,6 +784,16 @@
             code: "nonce_not_found",
             desc: "nonce not found"
         },
+        authTimeNotFoundError: {
+            code: "auth_time_not_found",
+            desc: "Max Age was requested and the ID token is missing the auth_time variable." +
+                " auth_time is an optional claim and is not enabled by default - it must be enabled." +
+                " See https://aka.ms/msaljs/optional-claims for more information."
+        },
+        maxAgeTranspiredError: {
+            code: "max_age_transpired",
+            desc: "Max Age is set to 0, or too much time has elapsed since the last end-user authentication."
+        },
         noTokensFoundError: {
             code: "no_tokens_found",
             desc: "No tokens were found for the given scopes, and no authorization code was passed to acquireToken. You must retrieve an authorization code before making a call to acquireToken()."
@@ -1000,6 +1014,19 @@
         ClientAuthError.createNonceMismatchError = function () {
             return new ClientAuthError(ClientAuthErrorMessage.nonceMismatchError.code, ClientAuthErrorMessage.nonceMismatchError.desc);
         };
+        /**
+         * Creates an error thrown when max_age was provided in the request, but auth_time is not in the token claims
+         * @param missingNonce
+         */
+        ClientAuthError.createAuthTimeNotFoundError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.authTimeNotFoundError.code, ClientAuthErrorMessage.authTimeNotFoundError.desc);
+        };
+        /**
+         * Creates an error thrown when too much time has elapsed since the last end-user authentication
+         */
+        ClientAuthError.createMaxAgeTranspiredError = function () {
+            return new ClientAuthError(ClientAuthErrorMessage.maxAgeTranspiredError.code, ClientAuthErrorMessage.maxAgeTranspiredError.desc);
+        };
         /**
          * Creates an error thrown when the mnonce is not present
          * @param missingNonce
@@ -1186,7 +1213,7 @@
         return ClientAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1311,7 +1338,7 @@
         return StringUtils;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1491,12 +1518,12 @@
         return Logger;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /* eslint-disable header/header */
     var name$1 = "@azure/msal-common";
-    var version$1 = "7.4.1";
+    var version$1 = "7.6.0";
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -1517,7 +1544,7 @@
         AzureCloudInstance["AzureUsGovernment"] = "https://login.microsoftonline.us";
     })(exports.AzureCloudInstance || (exports.AzureCloudInstance = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1676,7 +1703,7 @@
         return CredentialEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1724,7 +1751,7 @@
         },
         invalidPrompt: {
             code: "invalid_prompt_value",
-            desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create' and 'none'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
+            desc: "Supported prompt values are 'login', 'select_account', 'consent', 'create', 'none' and 'no_session'.  Please see here for valid configuration options: https://azuread.github.io/microsoft-authentication-library-for-js/ref/modules/_azure_msal_common.html#commonauthorizationurlrequest",
         },
         invalidClaimsRequest: {
             code: "invalid_claims",
@@ -1931,7 +1958,7 @@
         return ClientConfigurationError;
     }(ClientAuthError));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2115,7 +2142,7 @@
         return ScopeSet;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2153,7 +2180,7 @@
         };
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -2165,9 +2192,10 @@
     (function (AuthorityType) {
         AuthorityType[AuthorityType["Default"] = 0] = "Default";
         AuthorityType[AuthorityType["Adfs"] = 1] = "Adfs";
+        AuthorityType[AuthorityType["Dsts"] = 2] = "Dsts";
     })(AuthorityType || (AuthorityType = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2289,10 +2317,13 @@
                 // How do you account for MSA CID here?
                 account.localAccountId = ((_b = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _b === void 0 ? void 0 : _b.oid) || ((_c = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _c === void 0 ? void 0 : _c.sub) || Constants.EMPTY_STRING;
                 /*
-                 * In B2C scenarios the emails claim is used instead of preferred_username and it is an array. In most cases it will contain a single email.
-                 * This field should not be relied upon if a custom policy is configured to return more than 1 email.
+                 * In B2C scenarios the emails claim is used instead of preferred_username and it is an array.
+                 * In most cases it will contain a single email. This field should not be relied upon if a custom
+                 * policy is configured to return more than 1 email.
                  */
-                account.username = ((_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username) || (((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : Constants.EMPTY_STRING);
+                var preferredUsername = (_d = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _d === void 0 ? void 0 : _d.preferred_username;
+                var email = ((_e = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _e === void 0 ? void 0 : _e.emails) ? idToken.claims.emails[0] : null;
+                account.username = preferredUsername || email || Constants.EMPTY_STRING;
                 account.name = (_f = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _f === void 0 ? void 0 : _f.name;
             }
             account.cloudGraphHostName = cloudGraphHostName;
@@ -2307,7 +2338,8 @@
         AccountEntity.createGenericAccount = function (homeAccountId, idToken, authority, cloudGraphHostName, msGraphHost, environment) {
             var _a, _b, _c, _d;
             var account = new AccountEntity();
-            account.authorityType = (authority && authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
+            account.authorityType = (authority &&
+                authority.authorityType === AuthorityType.Adfs) ? CacheAccountType.ADFS_ACCOUNT_TYPE : CacheAccountType.GENERIC_ACCOUNT_TYPE;
             account.homeAccountId = homeAccountId;
             // non AAD scenarios can have empty realm
             account.realm = Constants.EMPTY_STRING;
@@ -2341,7 +2373,7 @@
             var _a;
             var accountId = ((_a = idToken === null || idToken === void 0 ? void 0 : idToken.claims) === null || _a === void 0 ? void 0 : _a.sub) ? idToken.claims.sub : Constants.EMPTY_STRING;
             // since ADFS does not have tid and does not set client_info
-            if (authType === AuthorityType.Adfs) {
+            if (authType === AuthorityType.Adfs || authType === AuthorityType.Dsts) {
                 return accountId;
             }
             // for cases where there is clientInfo
@@ -2402,7 +2434,7 @@
         return AccountEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2437,10 +2469,24 @@
                 throw ClientAuthError.createTokenParsingError(err);
             }
         };
+        /**
+         * Determine if the token's max_age has transpired
+         */
+        AuthToken.checkMaxAge = function (authTime, maxAge) {
+            /*
+             * per https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
+             * To force an immediate re-authentication: If an app requires that a user re-authenticate prior to access,
+             * provide a value of 0 for the max_age parameter and the AS will force a fresh login.
+             */
+            var fiveMinuteSkew = 300000; // five minutes in milliseconds
+            if ((maxAge === 0) || ((Date.now() - fiveMinuteSkew) > (authTime + maxAge))) {
+                throw ClientAuthError.createMaxAgeTranspiredError();
+            }
+        };
         return AuthToken;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2642,7 +2688,11 @@
                 if (!!userAssertionHash && !_this.matchUserAssertionHash(entity, userAssertionHash)) {
                     return;
                 }
-                if (!!homeAccountId && !_this.matchHomeAccountId(entity, homeAccountId)) {
+                /*
+                 * homeAccountId can undefined, and we want to filter out cached items that have a homeAccountId of ""
+                 * because we don't want a client_credential request to return a cached token that has a homeAccountId
+                 */
+                if ((typeof homeAccountId === "string") && !_this.matchHomeAccountId(entity, homeAccountId)) {
                     return;
                 }
                 if (!!environment && !_this.matchEnvironment(entity, environment)) {
@@ -3061,7 +3111,7 @@
          * @param homeAccountId
          */
         CacheManager.prototype.matchHomeAccountId = function (entity, homeAccountId) {
-            return !!(entity.homeAccountId && homeAccountId === entity.homeAccountId);
+            return !!((typeof entity.homeAccountId === "string") && (homeAccountId === entity.homeAccountId));
         };
         /**
          * helper to match assertion
@@ -3315,7 +3365,7 @@
         return DefaultStorageClass;
     }(CacheManager));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3409,7 +3459,7 @@
         return __assign({ clientCapabilities: [], azureCloudOptions: DEFAULT_AZURE_CLOUD_OPTIONS, skipAuthorityMetadataCache: false }, authOptions);
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3429,7 +3479,7 @@
         return ServerError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3525,7 +3575,7 @@
         return ThrottlingUtils;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3574,7 +3624,7 @@
         return NetworkManager;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -3585,7 +3635,7 @@
         CcsCredentialType["UPN"] = "UPN";
     })(CcsCredentialType || (CcsCredentialType = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3676,7 +3726,7 @@
         return BaseClient;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3762,7 +3812,7 @@
         return RequestValidator;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4140,7 +4190,7 @@
         return RequestParameterBuilder;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4204,7 +4254,7 @@
         return IdTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4254,7 +4304,7 @@
         return TimeUtils;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4368,7 +4418,7 @@
         return AccessTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4435,7 +4485,7 @@
         return RefreshTokenEntity;
     }(CredentialEntity));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4510,7 +4560,7 @@
         return InteractionRequiredAuthError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -4526,7 +4576,7 @@
         return CacheRecord;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4597,7 +4647,7 @@
         return ProtocolUtils;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4831,7 +4881,7 @@
         return UrlString;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4932,7 +4982,7 @@
         return PopTokenGenerator;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5002,7 +5052,7 @@
         return AppMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5038,7 +5088,7 @@
         return TokenCacheContext;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5099,9 +5149,9 @@
          * @param serverTokenResponse
          * @param authority
          */
-        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse) {
+        ResponseHandler.prototype.handleServerTokenResponse = function (serverTokenResponse, authority, reqTimestamp, request, authCodePayload, userAssertionHash, handlingRefreshTokenResponse, forceCacheRefreshTokenResponse, serverRequestId) {
             return __awaiter(this, void 0, void 0, function () {
-                var idTokenObj, requestStateObj, cacheRecord, cacheContext, key, account;
+                var idTokenObj, authTime, requestStateObj, cacheRecord, cacheContext, key, account;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -5113,6 +5163,14 @@
                                         throw ClientAuthError.createNonceMismatchError();
                                     }
                                 }
+                                // token max_age check
+                                if (request.maxAge || (request.maxAge === 0)) {
+                                    authTime = idTokenObj.claims.auth_time;
+                                    if (!authTime) {
+                                        throw ClientAuthError.createAuthTimeNotFoundError();
+                                    }
+                                    AuthToken.checkMaxAge(authTime, request.maxAge);
+                                }
                             }
                             // generate homeAccountId
                             this.homeAccountIdentifier = AccountEntity.generateHomeAccountId(serverTokenResponse.client_info || Constants.EMPTY_STRING, authority.authorityType, this.logger, this.cryptoObj, idTokenObj);
@@ -5144,7 +5202,7 @@
                                 account = this.cacheStorage.getAccount(key);
                                 if (!account) {
                                     this.logger.warning("Account used to refresh tokens not in persistence, refreshed tokens will not be stored in the cache");
-                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined)];
+                                    return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, undefined, serverRequestId)];
                                 }
                             }
                             return [4 /*yield*/, this.cacheStorage.saveCacheRecord(cacheRecord)];
@@ -5159,7 +5217,7 @@
                             _a.sent();
                             _a.label = 7;
                         case 7: return [7 /*endfinally*/];
-                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code)];
+                        case 8: return [2 /*return*/, ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenObj, requestStateObj, serverTokenResponse.spa_code, serverRequestId)];
                     }
                 });
             });
@@ -5245,7 +5303,7 @@
          * @param fromTokenCache
          * @param stateString
          */
-        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code) {
+        ResponseHandler.generateAuthenticationResult = function (cryptoObj, authority, cacheRecord, fromTokenCache, request, idTokenObj, requestState, code, requestId) {
             var _a, _b, _c;
             return __awaiter(this, void 0, void 0, function () {
                 var accessToken, responseScopes, expiresOn, extExpiresOn, familyId, popTokenGenerator, _d, secret, keyId, uid, tid;
@@ -5293,6 +5351,7 @@
                                     fromCache: fromTokenCache,
                                     expiresOn: expiresOn,
                                     correlationId: request.correlationId,
+                                    requestId: requestId || Constants.EMPTY_STRING,
                                     extExpiresOn: extExpiresOn,
                                     familyId: familyId,
                                     tokenType: ((_a = cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
@@ -5309,7 +5368,7 @@
         return ResponseHandler;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5355,10 +5414,11 @@
          * @param request
          */
         AuthorizationCodeClient.prototype.acquireToken = function (request, authCodePayload) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var reqTimestamp, response, responseHandler;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var reqTimestamp, response, requestId, responseHandler;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             this.logger.info("in acquireToken call");
                             if (!request || StringUtils.isEmpty(request.code)) {
@@ -5367,12 +5427,13 @@
                             reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.executeTokenRequest(this.authority, request)];
                         case 1:
-                            response = _a.sent();
+                            response = _b.sent();
+                            requestId = (_a = response.headers) === null || _a === void 0 ? void 0 : _a[HeaderNames.X_MS_REQUEST_ID];
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             // Validate response. This function throws a server error if an error is returned by the server.
                             responseHandler.validateTokenResponse(response.body);
-                            return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload)];
-                        case 2: return [2 /*return*/, _a.sent()];
+                            return [4 /*yield*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, authCodePayload, undefined, undefined, undefined, requestId)];
+                        case 2: return [2 /*return*/, _b.sent()];
                     }
                 });
             });
@@ -5760,7 +5821,7 @@
         return AuthorizationCodeClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -5843,10 +5904,6 @@
          * Used to acquire a token from Native component when native brokering is enabled.
          */
         PerformanceEvents["NativeInteractionClientAcquireToken"] = "nativeInteractionClientAcquireToken";
-        /**
-         * Time spent on the network for refresh token acquisition
-         */
-        PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
         /**
          * Time spent creating default headers for requests to token endpoint
          */
@@ -5860,10 +5917,21 @@
          */
         PerformanceEvents["AcquireTokenByRefreshTokenInBroker"] = "acquireTokenByRefreshTokenInBroker";
         /**
-         * acquireToken API in BrokerClientApplication.
-         * Used to acquire a token on behalf of the embedded application (PW-Broker).
+         * Time taken for token acquisition by broker
          */
         PerformanceEvents["AcquireTokenByBroker"] = "acquireTokenByBroker";
+        /**
+         * Time spent on the network for refresh token acquisition
+         */
+        PerformanceEvents["RefreshTokenClientExecuteTokenRequest"] = "refreshTokenClientExecuteTokenRequest";
+        /**
+         * Time taken for acquiring refresh token , records RT size
+         */
+        PerformanceEvents["RefreshTokenClientAcquireToken"] = "refreshTokenClientAcquireToken";
+        /**
+         * Time taken for acquiring cached refresh token
+         */
+        PerformanceEvents["RefreshTokenClientAcquireTokenWithCachedRefreshToken"] = "refreshTokenClientAcquireTokenWithCachedRefreshToken";
     })(exports.PerformanceEvents || (exports.PerformanceEvents = {}));
     /**
      * State of the performance event.
@@ -5878,7 +5946,7 @@
         PerformanceEventStatus[PerformanceEventStatus["Completed"] = 2] = "Completed";
     })(PerformanceEventStatus || (PerformanceEventStatus = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5893,18 +5961,40 @@
             return _super.call(this, configuration, performanceClient) || this;
         }
         RefreshTokenClient.prototype.acquireToken = function (request) {
+            var _a, _b;
             return __awaiter(this, void 0, void 0, function () {
-                var reqTimestamp, response, responseHandler;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var atsMeasurement, reqTimestamp, response, requestId, responseHandler;
+                var _this = this;
+                return __generator(this, function (_c) {
+                    switch (_c.label) {
                         case 0:
+                            atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireToken, request.correlationId);
+                            this.logger.verbose("RefreshTokenClientAcquireToken called", request.correlationId);
                             reqTimestamp = TimeUtils.nowSeconds();
                             return [4 /*yield*/, this.executeTokenRequest(request, this.authority)];
                         case 1:
-                            response = _a.sent();
+                            response = _c.sent();
+                            requestId = (_b = response.headers) === null || _b === void 0 ? void 0 : _b[HeaderNames.X_MS_REQUEST_ID];
                             responseHandler = new ResponseHandler(this.config.authOptions.clientId, this.cacheManager, this.cryptoUtils, this.logger, this.config.serializableCache, this.config.persistencePlugin);
                             responseHandler.validateTokenResponse(response.body);
-                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache)];
+                            return [2 /*return*/, responseHandler.handleServerTokenResponse(response.body, this.authority, reqTimestamp, request, undefined, undefined, true, request.forceCache, requestId).then(function (result) {
+                                    var _a;
+                                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                        success: true,
+                                        refreshTokenSize: ((_a = response.body.refresh_token) === null || _a === void 0 ? void 0 : _a.length) || 0
+                                    });
+                                    return result;
+                                })
+                                    .catch(function (error) {
+                                    _this.logger.verbose("Error in fetching refresh token", request.correlationId);
+                                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                                        errorCode: error.errorCode,
+                                        subErrorCode: error.subError,
+                                        success: false,
+                                        refreshTokenSize: undefined
+                                    });
+                                    throw error;
+                                })];
                     }
                 });
             });
@@ -5954,14 +6044,21 @@
          * @param request
          */
         RefreshTokenClient.prototype.acquireTokenWithCachedRefreshToken = function (request, foci) {
+            var _a;
             return __awaiter(this, void 0, void 0, function () {
-                var refreshToken, refreshTokenRequest;
-                return __generator(this, function (_a) {
+                var atsMeasurement, refreshToken, refreshTokenRequest;
+                return __generator(this, function (_b) {
+                    atsMeasurement = (_a = this.performanceClient) === null || _a === void 0 ? void 0 : _a.startMeasurement(exports.PerformanceEvents.RefreshTokenClientAcquireTokenWithCachedRefreshToken, request.correlationId);
+                    this.logger.verbose("RefreshTokenClientAcquireTokenWithCachedRefreshToken called", request.correlationId);
                     refreshToken = this.cacheManager.readRefreshTokenFromCache(this.config.authOptions.clientId, request.account, foci);
-                    // no refresh Token
                     if (!refreshToken) {
+                        atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.discardMeasurement();
                         throw InteractionRequiredAuthError.createNoTokensFoundError();
                     }
+                    // attach cached RT size to the current measurement
+                    atsMeasurement === null || atsMeasurement === void 0 ? void 0 : atsMeasurement.endMeasurement({
+                        success: true
+                    });
                     refreshTokenRequest = __assign(__assign({}, request), { refreshToken: refreshToken.secret, authenticationScheme: request.authenticationScheme || exports.AuthenticationScheme.BEARER, ccsCredential: {
                             credential: request.account.homeAccountId,
                             type: CcsCredentialType.HOME_ACCOUNT_ID
@@ -6114,7 +6211,7 @@
         return RefreshTokenClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6214,13 +6311,21 @@
          */
         SilentFlowClient.prototype.generateResultFromCacheRecord = function (cacheRecord, request) {
             return __awaiter(this, void 0, void 0, function () {
-                var idTokenObj;
+                var idTokenObj, authTime;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
                             if (cacheRecord.idToken) {
                                 idTokenObj = new AuthToken(cacheRecord.idToken.secret, this.config.cryptoInterface);
                             }
+                            // token max_age check
+                            if (request.maxAge || (request.maxAge === 0)) {
+                                authTime = idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.auth_time;
+                                if (!authTime) {
+                                    throw ClientAuthError.createAuthTimeNotFoundError();
+                                }
+                                AuthToken.checkMaxAge(authTime, request.maxAge);
+                            }
                             return [4 /*yield*/, ResponseHandler.generateAuthenticationResult(this.cryptoUtils, this.authority, cacheRecord, true, request, idTokenObj)];
                         case 1: return [2 /*return*/, _a.sent()];
                     }
@@ -6230,7 +6335,7 @@
         return SilentFlowClient;
     }(BaseClient));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6242,7 +6347,7 @@
             response.hasOwnProperty("jwks_uri"));
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6251,7 +6356,7 @@
     var EndpointMetadata = rawMetdataJSON.endpointMetadata;
     var InstanceDiscoveryMetadata = rawMetdataJSON.instanceDiscoveryMetadata;
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6265,7 +6370,7 @@
         ProtocolMode["OIDC"] = "OIDC";
     })(exports.ProtocolMode || (exports.ProtocolMode = {}));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6342,7 +6447,7 @@
         return AuthorityMetadataEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
@@ -6352,7 +6457,7 @@
             response.hasOwnProperty("metadata"));
     }
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6474,7 +6579,7 @@
         return RegionDiscovery;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6499,8 +6604,13 @@
             // See above for AuthorityType
             get: function () {
                 var pathSegments = this.canonicalAuthorityUrlComponents.PathSegments;
-                if (pathSegments.length && pathSegments[0].toLowerCase() === Constants.ADFS) {
-                    return AuthorityType.Adfs;
+                if (pathSegments.length) {
+                    switch (pathSegments[0].toLowerCase()) {
+                        case Constants.ADFS:
+                            return AuthorityType.Adfs;
+                        case Constants.DSTS:
+                            return AuthorityType.Dsts;
+                    }
                 }
                 return AuthorityType.Default;
             },
@@ -6704,7 +6814,9 @@
              * The default open id configuration endpoint for any canonical authority.
              */
             get: function () {
-                if (this.authorityType === AuthorityType.Adfs || this.protocolMode === exports.ProtocolMode.OIDC) {
+                if (this.authorityType === AuthorityType.Adfs ||
+                    this.authorityType === AuthorityType.Dsts ||
+                    this.protocolMode === exports.ProtocolMode.OIDC) {
                     return this.canonicalAuthority + ".well-known/openid-configuration";
                 }
                 return this.canonicalAuthority + "v2.0/.well-known/openid-configuration";
@@ -6802,8 +6914,9 @@
             });
         };
         /**
-         * Compares the number of url components after the domain to determine if the cached authority metadata can be used for the requested authority
-         * Protects against same domain different authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
+         * Compares the number of url components after the domain to determine if the cached
+         * authority metadata can be used for the requested authority. Protects against same domain different
+         * authority such as login.microsoftonline.com/tenant and login.microsoftonline.com/tfp/tenant/policy
          * @param metadataEntity
          */
         Authority.prototype.isAuthoritySameType = function (metadataEntity) {
@@ -6843,7 +6956,8 @@
                             _a.label = 1;
                         case 1:
                             _a.trys.push([1, 3, , 4]);
-                            return [4 /*yield*/, this.networkInterface.sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
+                            return [4 /*yield*/, this.networkInterface.
+                                    sendGetRequestAsync(this.defaultOpenIdConfigurationEndpoint, options)];
                         case 2:
                             response = _a.sent();
                             return [2 /*return*/, isOpenIdConfigResponse(response.body) ? response.body : null];
@@ -6904,7 +7018,8 @@
             });
         };
         /**
-         * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache and returns where the information was retrived from
+         * Updates the AuthorityMetadataEntity with new aliases, preferred_network and preferred_cache
+         * and returns where the information was retrieved from
          * @param cachedMetadata
          * @param newMetadata
          */
@@ -7127,7 +7242,7 @@
         Authority.replaceWithRegionalInformation = function (metadata, azureRegion) {
             metadata.authorization_endpoint = Authority.buildRegionalAuthorityString(metadata.authorization_endpoint, azureRegion);
             // TODO: Enquire on whether we should leave the query string or remove it before releasing the feature
-            metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, "allowestsrnonmsi=true");
+            metadata.token_endpoint = Authority.buildRegionalAuthorityString(metadata.token_endpoint, azureRegion, Constants.REGIONAL_AUTH_NON_MSI_QUERY_STRING);
             if (metadata.end_session_endpoint) {
                 metadata.end_session_endpoint = Authority.buildRegionalAuthorityString(metadata.end_session_endpoint, azureRegion);
             }
@@ -7136,7 +7251,7 @@
         return Authority;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7197,7 +7312,7 @@
         return AuthorityFactory;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7228,7 +7343,7 @@
         return ServerTelemetryEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7256,7 +7371,7 @@
         return ThrottlingEntity;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7273,7 +7388,7 @@
         }
     };
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7318,7 +7433,7 @@
         return JoseHeaderError;
     }(AuthError));
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7358,7 +7473,7 @@
         return JoseHeader;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7417,7 +7532,7 @@
         return AuthenticationHeaderParser;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7579,7 +7694,7 @@
         return ServerTelemetryManager;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7788,6 +7903,9 @@
                             if (current.idTokenSize) {
                                 previous.idTokenSize = current.idTokenSize;
                             }
+                            if (current.refreshTokenSize) {
+                                previous.refreshTokenSize = current.refreshTokenSize;
+                            }
                         }
                         return previous;
                     }, topLevelEvent);
@@ -7855,7 +7973,7 @@
         return PerformanceClient;
     }());
 
-    /*! @azure/msal-common v7.4.1 2022-09-12 */
+    /*! @azure/msal-common v7.6.0 2022-10-10 */
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7981,7 +8099,7 @@
         },
         silentPromptValueError: {
             code: "silent_prompt_value_error",
-            desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none'."
+            desc: "The value given for the prompt value is not valid for silent requests - must be set to 'none' or 'no_session'."
         },
         noTokenRequestCacheError: {
             code: "no_token_request_cache_error",
@@ -8393,7 +8511,7 @@
         /**
          * Default popup monitor poll interval in milliseconds
          */
-        POLL_INTERVAL_MS: 50,
+        DEFAULT_POLL_INTERVAL_MS: 30,
         /**
          * Msal-browser SKU
          */
@@ -8532,7 +8650,44 @@
     // DatabaseStorage Constants
     var DB_NAME = "msal.db";
     var DB_VERSION = 1;
-    var DB_TABLE_NAME = DB_NAME + ".keys";
+    var DB_TABLE_NAME = DB_NAME + ".keys";
+    exports.CacheLookupPolicy = void 0;
+    (function (CacheLookupPolicy) {
+        /*
+         * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired
+         * or cannot be found the refresh token will be used to acquire a new one. Finally, if the refresh token
+         * is expired acquireTokenSilent will attempt to acquire new access and refresh tokens.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["Default"] = 0] = "Default";
+        /*
+         * acquireTokenSilent will only look for access tokens in the cache. It will not attempt to renew access or
+         * refresh tokens.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["AccessToken"] = 1] = "AccessToken";
+        /*
+         * acquireTokenSilent will attempt to retrieve an access token from the cache. If the access token is expired or
+         * cannot be found, the refresh token will be used to acquire a new one. If the refresh token is expired, it
+         * will not be renewed and acquireTokenSilent will fail.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["AccessTokenAndRefreshToken"] = 2] = "AccessTokenAndRefreshToken";
+        /*
+         * acquireTokenSilent will not attempt to retrieve access tokens from the cache and will instead attempt to
+         * exchange the cached refresh token for a new access token. If the refresh token is expired, it will not be
+         * renewed and acquireTokenSilent will fail.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["RefreshToken"] = 3] = "RefreshToken";
+        /*
+         * acquireTokenSilent will not look in the cache for the access token. It will go directly to network with the
+         * cached refresh token. If the refresh token is expired an attempt will be made to renew it. This is equivalent to
+         * setting "forceRefresh: true".
+         */
+        CacheLookupPolicy[CacheLookupPolicy["RefreshTokenAndNetwork"] = 4] = "RefreshTokenAndNetwork";
+        /*
+         * acquireTokenSilent will attempt to renew both access and refresh tokens. It will not look in the cache. This will
+         * always fail if 3rd party cookies are blocked by the browser.
+         */
+        CacheLookupPolicy[CacheLookupPolicy["Skip"] = 5] = "Skip";
+    })(exports.CacheLookupPolicy || (exports.CacheLookupPolicy = {}));
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8571,6 +8726,10 @@
         inMemRedirectUnavailable: {
             code: "in_mem_redirect_unavailable",
             desc: "Redirect cannot be supported. In-memory storage was selected and storeAuthStateInCookie=false, which would cause the library to be unable to handle the incoming hash. If you would like to use the redirect API, please use session/localStorage or set storeAuthStateInCookie=true."
+        },
+        entropyNotProvided: {
+            code: "entropy_not_provided",
+            desc: "The available browser crypto interface requires entropy set via system.cryptoOptions.entropy configuration option."
         }
     };
     /**
@@ -8621,6 +8780,12 @@
         BrowserConfigurationAuthError.createInMemoryRedirectUnavailableError = function () {
             return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.code, BrowserConfigurationAuthErrorMessage.inMemRedirectUnavailable.desc);
         };
+        /**
+         * Creates an error thrown when a crypto interface that requires entropy is initialized without entropy
+         */
+        BrowserConfigurationAuthError.createEntropyNotProvided = function () {
+            return new BrowserConfigurationAuthError(BrowserConfigurationAuthErrorMessage.entropyNotProvided.code, BrowserConfigurationAuthErrorMessage.entropyNotProvided.desc);
+        };
         return BrowserConfigurationAuthError;
     }(AuthError));
 
@@ -9683,7 +9848,7 @@
 
     /* eslint-disable header/header */
     var name = "@azure/msal-browser";
-    var version = "2.28.3";
+    var version = "2.30.0";
 
     /*
      * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -11086,7 +11251,8 @@
                                     .then(function (result) {
                                     nativeATMeasurement.endMeasurement({
                                         success: true,
-                                        isNativeBroker: true
+                                        isNativeBroker: true,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })
@@ -12302,7 +12468,7 @@
                  * Polling for popups needs to be tick-based,
                  * since a non-trivial amount of time can be spent on interaction (which should not count against the timeout).
                  */
-                var maxTicks = _this.config.system.windowHashTimeout / BrowserConstants.POLL_INTERVAL_MS;
+                var maxTicks = _this.config.system.windowHashTimeout / _this.config.system.pollIntervalMilliseconds;
                 var ticks = 0;
                 _this.logger.verbose("PopupHandler.monitorPopupForHash - polling started");
                 var intervalId = setInterval(function () {
@@ -12355,7 +12521,7 @@
                         clearInterval(intervalId);
                         reject(BrowserAuthError.createMonitorPopupTimeoutError());
                     }
-                }, BrowserConstants.POLL_INTERVAL_MS);
+                }, _this.config.system.pollIntervalMilliseconds);
             });
         };
         /**
@@ -12393,7 +12559,7 @@
                     clearInterval(intervalId);
                     _this.cleanPopup(popupWindow);
                     resolve();
-                }, BrowserConstants.POLL_INTERVAL_MS);
+                }, _this.config.system.pollIntervalMilliseconds);
             });
         };
         /**
@@ -12626,7 +12792,10 @@
         // Default system options for browser
         var DEFAULT_BROWSER_SYSTEM_OPTIONS = __assign$1(__assign$1({}, DEFAULT_SYSTEM_OPTIONS), { loggerOptions: DEFAULT_LOGGER_OPTIONS, networkClient: isBrowserEnvironment ? BrowserUtils.getBrowserNetworkClient() : StubbedNetworkModule, navigationClient: new NavigationClient(), loadFrameTimeout: 0, 
             // If loadFrameTimeout is provided, use that as default.
-            windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS });
+            windowHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_POPUP_TIMEOUT_MS, iframeHashTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.loadFrameTimeout) || DEFAULT_IFRAME_TIMEOUT_MS, navigateFrameWait: isBrowserEnvironment && BrowserUtils.detectIEOrEdge() ? 500 : 0, redirectNavigationTimeout: DEFAULT_REDIRECT_TIMEOUT_MS, asyncPopups: false, allowRedirectInIframe: false, allowNativeBroker: false, nativeBrokerHandshakeTimeout: (userInputSystem === null || userInputSystem === void 0 ? void 0 : userInputSystem.nativeBrokerHandshakeTimeout) || DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS, pollIntervalMilliseconds: BrowserConstants.DEFAULT_POLL_INTERVAL_MS, cryptoOptions: {
+                useMsrCrypto: false,
+                entropy: undefined
+            } });
         var DEFAULT_TELEMETRY_OPTIONS = {
             application: {
                 appName: Constants.EMPTY_STRING,
@@ -12648,9 +12817,10 @@
      */
     var SilentHandler = /** @class */ (function (_super) {
         __extends$1(SilentHandler, _super);
-        function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, navigateFrameWait) {
+        function SilentHandler(authCodeModule, storageImpl, authCodeRequest, logger, systemOptions) {
             var _this = _super.call(this, authCodeModule, storageImpl, authCodeRequest, logger) || this;
-            _this.navigateFrameWait = navigateFrameWait;
+            _this.navigateFrameWait = systemOptions.navigateFrameWait;
+            _this.pollIntervalMilliseconds = systemOptions.pollIntervalMilliseconds;
             return _this;
         }
         /**
@@ -12728,7 +12898,7 @@
                         resolve(contentHash);
                         return;
                     }
-                }, BrowserConstants.POLL_INTERVAL_MS);
+                }, _this.pollIntervalMilliseconds);
             });
         };
         /**
@@ -12807,7 +12977,7 @@
             return _this;
         }
         /**
-         * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none
+         * Acquires a token silently by opening a hidden iframe to the /authorize endpoint with prompt=none or prompt=no_session
          * @param request
          */
         SilentIframeClient.prototype.acquireToken = function (request) {
@@ -12822,14 +12992,14 @@
                             if (StringUtils.isEmpty(request.loginHint) && StringUtils.isEmpty(request.sid) && (!request.account || StringUtils.isEmpty(request.account.username))) {
                                 this.logger.warning("No user hint provided. The authorization server may need more information to complete this request.");
                             }
-                            // Check that prompt is set to none, throw error if it is set to anything else.
-                            if (request.prompt && request.prompt !== PromptValue.NONE) {
+                            // Check that prompt is set to none or no_session, throw error if it is set to anything else.
+                            if (request.prompt && (request.prompt !== PromptValue.NONE) && (request.prompt !== PromptValue.NO_SESSION)) {
                                 acquireTokenMeasurement.endMeasurement({
                                     success: false
                                 });
                                 throw BrowserAuthError.createSilentPromptValueError(request.prompt);
                             }
-                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: PromptValue.NONE }), exports.InteractionType.Silent)];
+                            return [4 /*yield*/, this.initializeAuthorizationRequest(__assign$1(__assign$1({}, request), { prompt: request.prompt || PromptValue.NONE }), exports.InteractionType.Silent)];
                         case 1:
                             silentRequest = _a.sent();
                             this.browserStorage.updateCacheEntries(silentRequest.state, silentRequest.nonce, silentRequest.authority, silentRequest.loginHint || Constants.EMPTY_STRING, silentRequest.account || null);
@@ -12844,7 +13014,8 @@
                             return [4 /*yield*/, this.silentTokenHelper(authClient, silentRequest).then(function (result) {
                                     acquireTokenMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: false
+                                        fromCache: false,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })];
@@ -12892,7 +13063,7 @@
                             return [4 /*yield*/, authClient.getAuthCodeUrl(__assign$1(__assign$1({}, silentRequest), { nativeBroker: NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeMessageHandler, silentRequest.authenticationScheme) }))];
                         case 2:
                             navigateUrl = _a.sent();
-                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system);
                             return [4 /*yield*/, silentHandler.initiateAuthRequest(navigateUrl)];
                         case 3:
                             msalFrame = _a.sent();
@@ -12908,7 +13079,7 @@
                                 }
                                 nativeInteractionClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, this.apiId, this.performanceClient, this.nativeMessageHandler, serverParams.accountId, this.browserStorage, this.correlationId);
                                 userRequestState = ProtocolUtils.parseRequestState(this.browserCrypto, state).userRequestState;
-                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: PromptValue.NONE })).finally(function () {
+                                return [2 /*return*/, nativeInteractionClient.acquireToken(__assign$1(__assign$1({}, silentRequest), { state: userRequestState, prompt: silentRequest.prompt || PromptValue.NONE })).finally(function () {
                                         _this.browserStorage.cleanRequestByState(state);
                                     })];
                             }
@@ -12956,7 +13127,8 @@
                                     .then(function (result) {
                                     acquireTokenMeasurement.endMeasurement({
                                         success: true,
-                                        fromCache: result.fromCache
+                                        fromCache: result.fromCache,
+                                        requestId: result.requestId
                                     });
                                     return result;
                                 })
@@ -13362,6 +13534,13 @@
             }
             return sView;
         };
+        /**
+         * Returns stringified jwk.
+         * @param jwk
+         */
+        BrowserStringUtils.getSortedObjectString = function (obj) {
+            return JSON.stringify(obj, Object.keys(obj).sort());
+        };
         return BrowserStringUtils;
     }());
 
@@ -13604,178 +13783,117 @@
      * Copyright (c) Microsoft Corporation. All rights reserved.
      * Licensed under the MIT License.
      */
-    /**
-     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
-     */
-    // RSA KeyGen Algorithm
-    var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
-    // SHA-256 hashing algorithm
-    var S256_HASH_ALG = "SHA-256";
-    // MOD length for PoP tokens
-    var MODULUS_LENGTH = 2048;
-    // Public Exponent
-    var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
-    /**
-     * This class implements functions used by the browser library to perform cryptography operations such as
-     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
-     */
-    var BrowserCrypto = /** @class */ (function () {
-        function BrowserCrypto(logger) {
-            this.logger = logger;
-            if (!(this.hasCryptoAPI())) {
-                throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto or msCrypto object not available.");
-            }
-            this._keygenAlgorithmOptions = {
-                name: PKCS1_V15_KEYGEN_ALG,
-                hash: S256_HASH_ALG,
-                modulusLength: MODULUS_LENGTH,
-                publicExponent: PUBLIC_EXPONENT
-            };
+    var ModernBrowserCrypto = /** @class */ (function () {
+        function ModernBrowserCrypto() {
         }
-        /**
-         * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
-         * @param dataString
-         */
-        BrowserCrypto.prototype.sha256Digest = function (dataString) {
+        ModernBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window.crypto.getRandomValues(dataBuffer);
+        };
+        ModernBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var data;
                 return __generator$1(this, function (_a) {
-                    data = BrowserStringUtils.stringToUtf8Arr(dataString);
-                    return [2 /*return*/, this.hasIECrypto() ? this.getMSCryptoDigest(S256_HASH_ALG, data) : this.getSubtleCryptoDigest(S256_HASH_ALG, data)];
+                    return [2 /*return*/, window.crypto.subtle.generateKey(algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * Populates buffer with cryptographically random values.
-         * @param dataBuffer
-         */
-        BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
-            var cryptoObj = window["msCrypto"] || window.crypto;
-            if (!cryptoObj.getRandomValues) {
-                throw BrowserAuthError.createCryptoNotAvailableError("getRandomValues does not exist.");
-            }
-            cryptoObj.getRandomValues(dataBuffer);
-        };
-        /**
-         * Generates a keypair based on current keygen algorithm config.
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+        ModernBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, (this.hasIECrypto() ?
-                            this.msCryptoGenerateKey(extractable, usages)
-                            : window.crypto.subtle.generateKey(this._keygenAlgorithmOptions, extractable, usages))];
+                    return [2 /*return*/, window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
                 });
             });
         };
-        /**
-         * Export key as Json Web Key (JWK)
-         * @param key
-         * @param format
-         */
-        BrowserCrypto.prototype.exportJwk = function (key) {
+        ModernBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.hasIECrypto() ? this.msCryptoExportJwk(key) : window.crypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
+                    return [2 /*return*/, window.crypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * Imports key as Json Web Key (JWK), can set extractable and usages.
-         * @param key
-         * @param format
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+        ModernBrowserCrypto.prototype.sign = function (algorithm, key, data) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var keyString, keyBuffer;
                 return __generator$1(this, function (_a) {
-                    keyString = BrowserCrypto.getJwkString(key);
-                    keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
-                    return [2 /*return*/, this.hasIECrypto() ?
-                            this.msCryptoImportKey(keyBuffer, extractable, usages)
-                            : window.crypto.subtle.importKey(KEY_FORMAT_JWK, key, this._keygenAlgorithmOptions, extractable, usages)];
+                    return [2 /*return*/, window.crypto.subtle.sign(algorithm, key, data)];
                 });
             });
         };
-        /**
-         * Signs given data with given key
-         * @param key
-         * @param data
-         */
-        BrowserCrypto.prototype.sign = function (key, data) {
+        ModernBrowserCrypto.prototype.digest = function (algorithm, data) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, this.hasIECrypto() ?
-                            this.msCryptoSign(key, data)
-                            : window.crypto.subtle.sign(this._keygenAlgorithmOptions, key, data)];
+                    return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
                 });
             });
         };
-        /**
-         * Check whether IE crypto or other browser cryptography is available.
-         */
-        BrowserCrypto.prototype.hasCryptoAPI = function () {
-            return this.hasIECrypto() || this.hasBrowserCrypto();
+        return ModernBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var MsrBrowserCrypto = /** @class */ (function () {
+        function MsrBrowserCrypto() {
+        }
+        MsrBrowserCrypto.prototype.initPrng = function (entropy) {
+            // Turn into array, as initPrng seems to not always like Uint8Array (even though it should support both)
+            return window.msrCrypto.initPrng(__spread(entropy));
         };
-        /**
-         * Checks whether IE crypto (AKA msCrypto) is available.
-         */
-        BrowserCrypto.prototype.hasIECrypto = function () {
-            return "msCrypto" in window;
+        MsrBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window.msrCrypto.getRandomValues(dataBuffer);
         };
-        /**
-         * Check whether browser crypto is available.
-         */
-        BrowserCrypto.prototype.hasBrowserCrypto = function () {
-            return "crypto" in window;
+        MsrBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.generateKey(algorithm, extractable, keyUsages)];
+                });
+            });
         };
-        /**
-         * Helper function for SHA digest.
-         * @param algorithm
-         * @param data
-         */
-        BrowserCrypto.prototype.getSubtleCryptoDigest = function (algorithm, data) {
+        MsrBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, window.crypto.subtle.digest(algorithm, data)];
+                    return [2 /*return*/, window.msrCrypto.subtle.exportKey(KEY_FORMAT_JWK, key)];
                 });
             });
         };
-        /**
-         * IE Helper function for SHA digest.
-         * @param algorithm
-         * @param data
-         */
-        BrowserCrypto.prototype.getMSCryptoDigest = function (algorithm, data) {
+        MsrBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
-                    return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
-                            digestOperation.addEventListener("complete", function (e) {
-                                resolve(e.target.result);
-                            });
-                            digestOperation.addEventListener("error", function (error) {
-                                reject(error);
-                            });
-                        })];
+                    return [2 /*return*/, window.msrCrypto.subtle.importKey(KEY_FORMAT_JWK, keyData, algorithm, extractable, keyUsages)];
                 });
             });
         };
-        /**
-         * IE Helper function for generating a keypair
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.msCryptoGenerateKey = function (extractable, usages) {
+        MsrBrowserCrypto.prototype.sign = function (algorithm, key, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.sign(algorithm, key, data)];
+                });
+            });
+        };
+        MsrBrowserCrypto.prototype.digest = function (algorithm, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, window.msrCrypto.subtle.digest(algorithm, data)];
+                });
+            });
+        };
+        return MsrBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    var MsBrowserCrypto = /** @class */ (function () {
+        function MsBrowserCrypto() {
+        }
+        MsBrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return window["msCrypto"].getRandomValues(dataBuffer);
+        };
+        MsBrowserCrypto.prototype.generateKey = function (algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msGenerateKey = window["msCrypto"].subtle.generateKey(_this._keygenAlgorithmOptions, extractable, usages);
+                            var msGenerateKey = window["msCrypto"].subtle.generateKey(algorithm, extractable, keyUsages);
                             msGenerateKey.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13786,12 +13904,7 @@
                 });
             });
         };
-        /**
-         * IE Helper function for exportKey
-         * @param key
-         * @param format
-         */
-        BrowserCrypto.prototype.msCryptoExportJwk = function (key) {
+        MsBrowserCrypto.prototype.exportKey = function (key) {
             return __awaiter$1(this, void 0, void 0, function () {
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
@@ -13818,19 +13931,14 @@
                 });
             });
         };
-        /**
-         * IE Helper function for importKey
-         * @param key
-         * @param format
-         * @param extractable
-         * @param usages
-         */
-        BrowserCrypto.prototype.msCryptoImportKey = function (keyBuffer, extractable, usages) {
+        MsBrowserCrypto.prototype.importKey = function (keyData, algorithm, extractable, keyUsages) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
+                var keyString, keyBuffer;
                 return __generator$1(this, function (_a) {
+                    keyString = BrowserStringUtils.getSortedObjectString(keyData);
+                    keyBuffer = BrowserStringUtils.stringToArrayBuffer(keyString);
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, _this._keygenAlgorithmOptions, extractable, usages);
+                            var msImportKey = window["msCrypto"].subtle.importKey(KEY_FORMAT_JWK, keyBuffer, algorithm, extractable, keyUsages);
                             msImportKey.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13841,17 +13949,11 @@
                 });
             });
         };
-        /**
-         * IE Helper function for sign JWT
-         * @param key
-         * @param data
-         */
-        BrowserCrypto.prototype.msCryptoSign = function (key, data) {
+        MsBrowserCrypto.prototype.sign = function (algorithm, key, data) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var _this = this;
                 return __generator$1(this, function (_a) {
                     return [2 /*return*/, new Promise(function (resolve, reject) {
-                            var msSign = window["msCrypto"].subtle.sign(_this._keygenAlgorithmOptions, key, data);
+                            var msSign = window["msCrypto"].subtle.sign(algorithm, key, data);
                             msSign.addEventListener("complete", function (e) {
                                 resolve(e.target.result);
                             });
@@ -13862,12 +13964,175 @@
                 });
             });
         };
+        MsBrowserCrypto.prototype.digest = function (algorithm, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, new Promise(function (resolve, reject) {
+                            var digestOperation = window["msCrypto"].subtle.digest(algorithm, data.buffer);
+                            digestOperation.addEventListener("complete", function (e) {
+                                resolve(e.target.result);
+                            });
+                            digestOperation.addEventListener("error", function (error) {
+                                reject(error);
+                            });
+                        })];
+                });
+            });
+        };
+        return MsBrowserCrypto;
+    }());
+
+    /*
+     * Copyright (c) Microsoft Corporation. All rights reserved.
+     * Licensed under the MIT License.
+     */
+    /**
+     * See here for more info on RsaHashedKeyGenParams: https://developer.mozilla.org/en-US/docs/Web/API/RsaHashedKeyGenParams
+     */
+    // RSA KeyGen Algorithm
+    var PKCS1_V15_KEYGEN_ALG = "RSASSA-PKCS1-v1_5";
+    // SHA-256 hashing algorithm
+    var S256_HASH_ALG = "SHA-256";
+    // MOD length for PoP tokens
+    var MODULUS_LENGTH = 2048;
+    // Public Exponent
+    var PUBLIC_EXPONENT = new Uint8Array([0x01, 0x00, 0x01]);
+    /**
+     * This class implements functions used by the browser library to perform cryptography operations such as
+     * hashing and encoding. It also has helper functions to validate the availability of specific APIs.
+     */
+    var BrowserCrypto = /** @class */ (function () {
+        function BrowserCrypto(logger, cryptoOptions) {
+            var _a, _b;
+            this.logger = logger;
+            this.cryptoOptions = cryptoOptions;
+            if (this.hasBrowserCrypto()) {
+                // Use standard modern web crypto if available
+                this.logger.verbose("BrowserCrypto: modern crypto interface available");
+                this.subtleCrypto = new ModernBrowserCrypto();
+            }
+            else if (this.hasIECrypto()) {
+                // For IE11, use msCrypto interface
+                this.logger.verbose("BrowserCrypto: MS crypto interface available");
+                this.subtleCrypto = new MsBrowserCrypto();
+            }
+            else if (this.hasMsrCrypto() && ((_a = this.cryptoOptions) === null || _a === void 0 ? void 0 : _a.useMsrCrypto)) {
+                // For other browsers, use MSR Crypto if found
+                this.logger.verbose("BrowserCrypto: MSR crypto interface available");
+                this.subtleCrypto = new MsrBrowserCrypto();
+            }
+            else {
+                if (this.hasMsrCrypto()) {
+                    this.logger.info("BrowserCrypto: MSR Crypto interface available but system.cryptoOptions.useMsrCrypto not enabled");
+                }
+                this.logger.error("BrowserCrypto: No crypto interfaces available.");
+                throw BrowserAuthError.createCryptoNotAvailableError("Browser crypto, msCrypto, or msrCrypto interfaces not available.");
+            }
+            // Mainly needed for MSR Crypto: https://github.com/microsoft/MSR-JavaScript-Crypto#random-number-generator-prng
+            if (this.subtleCrypto.initPrng) {
+                this.logger.verbose("BrowserCrypto: Interface requires entropy");
+                if (!((_b = this.cryptoOptions) === null || _b === void 0 ? void 0 : _b.entropy)) {
+                    this.logger.error("BrowserCrypto: Interface requires entropy but none provided.");
+                    throw BrowserConfigurationAuthError.createEntropyNotProvided();
+                }
+                this.logger.verbose("BrowserCrypto: Entropy provided");
+                this.subtleCrypto.initPrng(this.cryptoOptions.entropy);
+            }
+            this.keygenAlgorithmOptions = {
+                name: PKCS1_V15_KEYGEN_ALG,
+                hash: S256_HASH_ALG,
+                modulusLength: MODULUS_LENGTH,
+                publicExponent: PUBLIC_EXPONENT
+            };
+        }
         /**
-         * Returns stringified jwk.
-         * @param jwk
+         * Check whether IE crypto or other browser cryptography is available.
+         */
+        BrowserCrypto.prototype.hasIECrypto = function () {
+            return "msCrypto" in window;
+        };
+        /**
+         * Check whether browser crypto is available.
+         */
+        BrowserCrypto.prototype.hasBrowserCrypto = function () {
+            return "crypto" in window;
+        };
+        /**
+         * Check whether MSR crypto polyfill is available
+         */
+        BrowserCrypto.prototype.hasMsrCrypto = function () {
+            return "msrCrypto" in window;
+        };
+        /**
+         * Returns a sha-256 hash of the given dataString as an ArrayBuffer.
+         * @param dataString
+         */
+        BrowserCrypto.prototype.sha256Digest = function (dataString) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var data;
+                return __generator$1(this, function (_a) {
+                    data = BrowserStringUtils.stringToUtf8Arr(dataString);
+                    // MSR Crypto wants object with name property, instead of string
+                    return [2 /*return*/, this.subtleCrypto.digest({ name: S256_HASH_ALG }, data)];
+                });
+            });
+        };
+        /**
+         * Populates buffer with cryptographically random values.
+         * @param dataBuffer
+         */
+        BrowserCrypto.prototype.getRandomValues = function (dataBuffer) {
+            return this.subtleCrypto.getRandomValues(dataBuffer);
+        };
+        /**
+         * Generates a keypair based on current keygen algorithm config.
+         * @param extractable
+         * @param usages
+         */
+        BrowserCrypto.prototype.generateKeyPair = function (extractable, usages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.generateKey(this.keygenAlgorithmOptions, extractable, usages)];
+                });
+            });
+        };
+        /**
+         * Export key as Json Web Key (JWK)
+         * @param key
+         * @param format
+         */
+        BrowserCrypto.prototype.exportJwk = function (key) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.exportKey(key)];
+                });
+            });
+        };
+        /**
+         * Imports key as Json Web Key (JWK), can set extractable and usages.
+         * @param key
+         * @param format
+         * @param extractable
+         * @param usages
+         */
+        BrowserCrypto.prototype.importJwk = function (key, extractable, usages) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.importKey(key, this.keygenAlgorithmOptions, extractable, usages)];
+                });
+            });
+        };
+        /**
+         * Signs given data with given key
+         * @param key
+         * @param data
          */
-        BrowserCrypto.getJwkString = function (jwk) {
-            return JSON.stringify(jwk, Object.keys(jwk).sort());
+        BrowserCrypto.prototype.sign = function (key, data) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                return __generator$1(this, function (_a) {
+                    return [2 /*return*/, this.subtleCrypto.sign(this.keygenAlgorithmOptions, key, data)];
+                });
+            });
         };
         return BrowserCrypto;
     }());
@@ -14387,10 +14652,10 @@
      * implementing Proof Key for Code Exchange specs for the OAuth Authorization Code Flow using PKCE (rfc here: https://tools.ietf.org/html/rfc7636).
      */
     var CryptoOps = /** @class */ (function () {
-        function CryptoOps(logger, performanceClient) {
+        function CryptoOps(logger, performanceClient, cryptoConfig) {
             this.logger = logger;
             // Browser crypto needs to be validated first before any other classes can be set.
-            this.browserCrypto = new BrowserCrypto(this.logger);
+            this.browserCrypto = new BrowserCrypto(this.logger, cryptoConfig);
             this.b64Encode = new Base64Encode();
             this.b64Decode = new Base64Decode();
             this.guidGenerator = new GuidGenerator(this.browserCrypto);
@@ -14452,7 +14717,7 @@
                                 kty: publicKeyJwk.kty,
                                 n: publicKeyJwk.n
                             };
-                            publicJwkString = BrowserCrypto.getJwkString(pubKeyThumprintObj);
+                            publicJwkString = BrowserStringUtils.getSortedObjectString(pubKeyThumprintObj);
                             return [4 /*yield*/, this.hashString(publicJwkString)];
                         case 3:
                             publicJwkHash = _b.sent();
@@ -14537,7 +14802,7 @@
                             return [4 /*yield*/, this.browserCrypto.exportJwk(cachedKeyPair.publicKey)];
                         case 2:
                             publicKeyJwk = _b.sent();
-                            publicKeyJwkString = BrowserCrypto.getJwkString(publicKeyJwk);
+                            publicKeyJwkString = BrowserStringUtils.getSortedObjectString(publicKeyJwk);
                             encodedKeyIdThumbprint = this.b64Encode.urlEncode(JSON.stringify({ kid: kid }));
                             shrHeader = JoseHeader.getShrHeaderString({ kid: encodedKeyIdThumbprint, alg: publicKeyJwk.alg });
                             encodedShrHeader = this.b64Encode.urlEncode(shrHeader);
@@ -14607,15 +14872,19 @@
          * @param request
          * @param response
          * @param options
+         * @returns `AuthenticationResult` for the response that was loaded.
          */
         TokenCache.prototype.loadExternalTokens = function (request, response, options) {
             this.logger.info("TokenCache - loadExternalTokens called");
             if (!response.id_token) {
                 throw BrowserAuthError.createUnableToLoadTokenError("Please ensure server response includes id token.");
             }
+            var idToken = new AuthToken(response.id_token, this.cryptoObj);
+            var cacheRecord;
+            var authority;
             if (request.account) {
-                this.loadIdToken(response.id_token, request.account.homeAccountId, request.account.environment, request.account.tenantId, options);
-                this.loadAccessToken(request, response, request.account.homeAccountId, request.account.environment, request.account.tenantId, options);
+                var cacheRecordAccount = this.loadAccount(idToken, request.account.environment, undefined, undefined, request.account.homeAccountId);
+                cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment, request.account.tenantId, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, request.account.environment));
             }
             else if (request.authority) {
                 var authorityUrl = Authority.generateAuthority(request.authority, request.azureCloudOptions);
@@ -14626,17 +14895,17 @@
                     authorityMetadata: this.config.auth.authorityMetadata,
                     skipAuthorityMetadataCache: this.config.auth.skipAuthorityMetadataCache,
                 };
-                var authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
+                authority = new Authority(authorityUrl, this.config.system.networkClient, this.storage, authorityOptions);
                 // "clientInfo" from options takes precedence over "clientInfo" in response
                 if (options.clientInfo) {
                     this.logger.trace("TokenCache - homeAccountId from options");
-                    this.loadIdToken(response.id_token, options.clientInfo, authority.hostnameAndPort, authority.tenant, options);
-                    this.loadAccessToken(request, response, options.clientInfo, authority.hostnameAndPort, authority.tenant, options);
+                    var cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, options.clientInfo, authority.authorityType);
+                    cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
                 }
                 else if (response.client_info) {
                     this.logger.trace("TokenCache - homeAccountId from response");
-                    this.loadIdToken(response.id_token, response.client_info, authority.hostnameAndPort, authority.tenant, options);
-                    this.loadAccessToken(request, response, response.client_info, authority.hostnameAndPort, authority.tenant, options);
+                    var cacheRecordAccount = this.loadAccount(idToken, authority.hostnameAndPort, response.client_info, authority.authorityType);
+                    cacheRecord = new CacheRecord(cacheRecordAccount, this.loadIdToken(idToken, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant), this.loadAccessToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort, authority.tenant, options), this.loadRefreshToken(request, response, cacheRecordAccount.homeAccountId, authority.hostnameAndPort));
                 }
                 else {
                     throw BrowserAuthError.createUnableToLoadTokenError("Please provide clientInfo in the response or options.");
@@ -14645,6 +14914,39 @@
             else {
                 throw BrowserAuthError.createUnableToLoadTokenError("Please provide a request with an account or a request with authority.");
             }
+            return this.generateAuthenticationResult(request, idToken, cacheRecord, authority);
+        };
+        /**
+         * Helper function to load account to msal-browser cache
+         * @param idToken
+         * @param environment
+         * @param clientInfo
+         * @param authorityType
+         * @param requestHomeAccountId
+         * @returns `AccountEntity`
+         */
+        TokenCache.prototype.loadAccount = function (idToken, environment, clientInfo, authorityType, requestHomeAccountId) {
+            var homeAccountId;
+            if (requestHomeAccountId) {
+                homeAccountId = requestHomeAccountId;
+            }
+            else if (authorityType !== undefined && clientInfo) {
+                homeAccountId = AccountEntity.generateHomeAccountId(clientInfo, authorityType, this.logger, this.cryptoObj, idToken);
+            }
+            if (!homeAccountId) {
+                throw BrowserAuthError.createUnableToLoadTokenError("Unexpected missing homeAccountId");
+            }
+            var accountEntity = clientInfo ?
+                AccountEntity.createAccount(clientInfo, homeAccountId, idToken, undefined, undefined, undefined, environment) :
+                AccountEntity.createGenericAccount(homeAccountId, idToken, undefined, undefined, undefined, environment);
+            if (this.isBrowserEnvironment) {
+                this.logger.verbose("TokenCache - loading account");
+                this.storage.setAccount(accountEntity);
+                return accountEntity;
+            }
+            else {
+                throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
+            }
         };
         /**
          * Helper function to load id tokens to msal-browser cache
@@ -14652,18 +14954,14 @@
          * @param homeAccountId
          * @param environment
          * @param tenantId
-         * @param options
+         * @returns `IdTokenEntity`
          */
-        TokenCache.prototype.loadIdToken = function (idToken, homeAccountId, environment, tenantId, options) {
-            var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken, this.config.auth.clientId, tenantId);
-            var idAuthToken = new AuthToken(idToken, this.cryptoObj);
-            var accountEntity = options.clientInfo ?
-                AccountEntity.createAccount(options.clientInfo, homeAccountId, idAuthToken, undefined, undefined, undefined, environment) :
-                AccountEntity.createGenericAccount(homeAccountId, idAuthToken, undefined, undefined, undefined, environment);
+        TokenCache.prototype.loadIdToken = function (idToken, homeAccountId, environment, tenantId) {
+            var idTokenEntity = IdTokenEntity.createIdTokenEntity(homeAccountId, environment, idToken.rawToken, this.config.auth.clientId, tenantId);
             if (this.isBrowserEnvironment) {
                 this.logger.verbose("TokenCache - loading id token");
-                this.storage.setAccount(accountEntity);
                 this.storage.setIdTokenCredential(idTokenEntity);
+                return idTokenEntity;
             }
             else {
                 throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
@@ -14673,16 +14971,15 @@
          * Helper function to load access tokens to msal-browser cache
          * @param request
          * @param response
-         * @param options
          * @param homeAccountId
          * @param environment
          * @param tenantId
-         * @returns
+         * @returns `AccessTokenEntity`
          */
         TokenCache.prototype.loadAccessToken = function (request, response, homeAccountId, environment, tenantId, options) {
             if (!response.access_token) {
                 this.logger.verbose("TokenCache - No access token provided for caching");
-                return;
+                return null;
             }
             if (!response.expires_in) {
                 throw BrowserAuthError.createUnableToLoadTokenError("Please ensure server response includes expires_in value.");
@@ -14697,11 +14994,80 @@
             if (this.isBrowserEnvironment) {
                 this.logger.verbose("TokenCache - loading access token");
                 this.storage.setAccessTokenCredential(accessTokenEntity);
+                return accessTokenEntity;
             }
             else {
                 throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
             }
         };
+        /**
+         * Helper function to load refresh tokens to msal-browser cache
+         * @param request
+         * @param response
+         * @param homeAccountId
+         * @param environment
+         * @returns `RefreshTokenEntity`
+         */
+        TokenCache.prototype.loadRefreshToken = function (request, response, homeAccountId, environment) {
+            if (!response.refresh_token) {
+                this.logger.verbose("TokenCache - No refresh token provided for caching");
+                return null;
+            }
+            var refreshTokenEntity = RefreshTokenEntity.createRefreshTokenEntity(homeAccountId, environment, response.refresh_token, this.config.auth.clientId);
+            if (this.isBrowserEnvironment) {
+                this.logger.verbose("TokenCache - loading refresh token");
+                this.storage.setRefreshTokenCredential(refreshTokenEntity);
+                return refreshTokenEntity;
+            }
+            else {
+                throw BrowserAuthError.createUnableToLoadTokenError("loadExternalTokens is designed to work in browser environments only.");
+            }
+        };
+        /**
+         * Helper function to generate an `AuthenticationResult` for the result.
+         * @param request
+         * @param idTokenObj
+         * @param cacheRecord
+         * @param authority
+         * @returns `AuthenticationResult`
+         */
+        TokenCache.prototype.generateAuthenticationResult = function (request, idTokenObj, cacheRecord, authority) {
+            var _a, _b, _c;
+            var accessToken = Constants.EMPTY_STRING;
+            var responseScopes = [];
+            var expiresOn = null;
+            var extExpiresOn;
+            if (cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.accessToken) {
+                accessToken = cacheRecord.accessToken.secret;
+                responseScopes = ScopeSet.fromString(cacheRecord.accessToken.target).asArray();
+                expiresOn = new Date(Number(cacheRecord.accessToken.expiresOn) * 1000);
+                extExpiresOn = new Date(Number(cacheRecord.accessToken.extendedExpiresOn) * 1000);
+            }
+            var uid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.oid) || (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.sub) || Constants.EMPTY_STRING;
+            var tid = (idTokenObj === null || idTokenObj === void 0 ? void 0 : idTokenObj.claims.tid) || Constants.EMPTY_STRING;
+            return {
+                authority: authority ? authority.canonicalAuthority : Constants.EMPTY_STRING,
+                uniqueId: uid,
+                tenantId: tid,
+                scopes: responseScopes,
+                account: (cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) ? cacheRecord.account.getAccountInfo() : null,
+                idToken: idTokenObj ? idTokenObj.rawToken : Constants.EMPTY_STRING,
+                idTokenClaims: idTokenObj ? idTokenObj.claims : {},
+                accessToken: accessToken,
+                fromCache: true,
+                expiresOn: expiresOn,
+                correlationId: request.correlationId || Constants.EMPTY_STRING,
+                requestId: Constants.EMPTY_STRING,
+                extExpiresOn: extExpiresOn,
+                familyId: Constants.EMPTY_STRING,
+                tokenType: ((_a = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.accessToken) === null || _a === void 0 ? void 0 : _a.tokenType) || Constants.EMPTY_STRING,
+                state: Constants.EMPTY_STRING,
+                cloudGraphHostName: ((_b = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) === null || _b === void 0 ? void 0 : _b.cloudGraphHostName) || Constants.EMPTY_STRING,
+                msGraphHost: ((_c = cacheRecord === null || cacheRecord === void 0 ? void 0 : cacheRecord.account) === null || _c === void 0 ? void 0 : _c.msGraphHost) || Constants.EMPTY_STRING,
+                code: undefined,
+                fromNativeBroker: false
+            };
+        };
         return TokenCache;
     }());
 
@@ -14759,7 +15125,7 @@
                             clientConfig = _a.sent();
                             authClient = new HybridSpaAuthorizationCodeClient(clientConfig);
                             this.logger.verbose("Auth code client created");
-                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system.navigateFrameWait);
+                            silentHandler = new SilentHandler(authClient, this.browserStorage, authCodeRequest, this.logger, this.config.system);
                             // Handle auth code parameters from request
                             return [2 /*return*/, silentHandler.handleCodeResponseFromServer({
                                     code: request.code,
@@ -14858,9 +15224,9 @@
      */
     var BrowserPerformanceClient = /** @class */ (function (_super) {
         __extends$1(BrowserPerformanceClient, _super);
-        function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) {
+        function BrowserPerformanceClient(clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry, cryptoOptions) {
             var _this = _super.call(this, clientId, authority, logger, libraryName, libraryVersion, applicationTelemetry) || this;
-            _this.browserCrypto = new BrowserCrypto(_this.logger);
+            _this.browserCrypto = new BrowserCrypto(_this.logger, cryptoOptions);
             _this.guidGenerator = new GuidGenerator(_this.browserCrypto);
             return _this;
         }
@@ -14942,10 +15308,10 @@
             this.hybridAuthCodeResponses = new Map();
             // Initialize performance client
             this.performanceClient = this.isBrowserEnvironment ?
-                new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application) :
+                new BrowserPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application, this.config.system.cryptoOptions) :
                 new StubPerformanceClient(this.config.auth.clientId, this.config.auth.authority, this.logger, name, version, this.config.telemetry.application);
             // Initialize the crypto class.
-            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient) : DEFAULT_CRYPTO_IMPLEMENTATION;
+            this.browserCrypto = this.isBrowserEnvironment ? new CryptoOps(this.logger, this.performanceClient, this.config.system.cryptoOptions) : DEFAULT_CRYPTO_IMPLEMENTATION;
             this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
             // Initialize the browser storage class.
             this.browserStorage = this.isBrowserEnvironment ?
@@ -15167,6 +15533,7 @@
                         isNativeBroker: true,
                         accessTokenSize: response.accessToken.length,
                         idTokenSize: response.idToken.length,
+                        requestId: response.requestId
                     });
                     atPopupMeasurement.flushMeasurement();
                     return response;
@@ -15204,6 +15571,7 @@
                     success: true,
                     accessTokenSize: result.accessToken.length,
                     idTokenSize: result.idToken.length,
+                    requestId: result.requestId
                 });
                 atPopupMeasurement.flushMeasurement();
                 return result;
@@ -15247,7 +15615,9 @@
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     correlationId = this.getRequestCorrelationId(request);
-                    validRequest = __assign$1(__assign$1({}, request), { prompt: PromptValue.NONE, correlationId: correlationId });
+                    validRequest = __assign$1(__assign$1({}, request), { 
+                        // will be PromptValue.NONE or PromptValue.NO_SESSION
+                        prompt: request.prompt, correlationId: correlationId });
                     this.preflightBrowserEnvironmentCheck(exports.InteractionType.Silent);
                     ssoSilentMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.SsoSilent, correlationId);
                     this.logger.verbose("ssoSilent called", correlationId);
@@ -15273,7 +15643,8 @@
                                 success: true,
                                 isNativeBroker: response.fromNativeBroker,
                                 accessTokenSize: response.accessToken.length,
-                                idTokenSize: response.idToken.length
+                                idTokenSize: response.idToken.length,
+                                requestId: response.requestId
                             });
                             ssoSilentMeasurement.flushMeasurement();
                             return response;
@@ -15324,7 +15695,8 @@
                                         success: true,
                                         accessTokenSize: result.accessToken.length,
                                         idTokenSize: result.idToken.length,
-                                        isNativeBroker: result.fromNativeBroker
+                                        isNativeBroker: result.fromNativeBroker,
+                                        requestId: result.requestId
                                     });
                                     atbcMeasurement.flushMeasurement();
                                     return result;
@@ -15404,67 +15776,62 @@
             });
         };
         /**
-         * Use this function to obtain a token before every call to the API / resource provider
-         *
-         * MSAL return's a cached token when available
-         * Or it send's a request to the STS to obtain a new token using a refresh token.
-         *
-         * @param {@link SilentRequest}
-         *
-         * To renew idToken, please pass clientId as the only scope in the Authentication Parameters
-         * @returns A promise that is fulfilled when this function has completed, or rejected if an error was raised.
+         * Attempt to acquire an access token from the cache
+         * @param silentCacheClient SilentCacheClient
+         * @param commonRequest CommonSilentFlowRequest
+         * @param silentRequest SilentRequest
+         * @returns A promise that, when resolved, returns the access token
          */
-        ClientApplication.prototype.acquireTokenByRefreshToken = function (request) {
+        ClientApplication.prototype.acquireTokenFromCache = function (silentCacheClient, commonRequest, silentRequest) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var atbrtMeasurement, silentRefreshClient;
-                var _this = this;
                 return __generator$1(this, function (_a) {
-                    // block the reload if it occurred inside a hidden iframe
-                    BrowserUtils.blockReloadInHiddenIframes();
-                    atbrtMeasurement = this.performanceClient.startMeasurement(exports.PerformanceEvents.AcquireTokenByRefreshToken, request.correlationId);
-                    this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, request);
-                    silentRefreshClient = this.createSilentRefreshClient(request.correlationId);
-                    return [2 /*return*/, silentRefreshClient.acquireToken(request)
-                            .then(function (result) {
-                            atbrtMeasurement.endMeasurement({
-                                success: true,
-                                fromCache: result.fromCache,
-                                accessTokenSize: result.accessToken.length,
-                                idTokenSize: result.idToken.length,
-                            });
-                            return result;
-                        })
-                            .catch(function (e) {
-                            var isServerError = e instanceof ServerError;
-                            var isInteractionRequiredError = e instanceof InteractionRequiredAuthError;
-                            var isInvalidGrantError = (e.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
-                            if (isServerError && isInvalidGrantError && !isInteractionRequiredError) {
-                                _this.logger.verbose("Refresh token expired or invalid, attempting acquire token by iframe", request.correlationId);
-                                var silentIframeClient = _this.createSilentIframeClient(request.correlationId);
-                                return silentIframeClient.acquireToken(request)
-                                    .then(function (result) {
-                                    atbrtMeasurement.endMeasurement({
-                                        success: true,
-                                        fromCache: result.fromCache,
-                                        accessTokenSize: result.accessToken.length,
-                                        idTokenSize: result.idToken.length,
-                                    });
-                                    return result;
-                                })
-                                    .catch(function (error) {
-                                    atbrtMeasurement.endMeasurement({
-                                        errorCode: error.errorCode,
-                                        subErrorCode: error.subError,
-                                        success: false
-                                    });
-                                    throw error;
-                                });
-                            }
-                            atbrtMeasurement.endMeasurement({
-                                success: false
-                            });
-                            throw e;
-                        })];
+                    switch (silentRequest.cacheLookupPolicy) {
+                        case exports.CacheLookupPolicy.Default:
+                        case exports.CacheLookupPolicy.AccessToken:
+                        case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                            return [2 /*return*/, silentCacheClient.acquireToken(commonRequest)];
+                        default:
+                            throw ClientAuthError.createRefreshRequiredError();
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Attempt to acquire an access token via a refresh token
+         * @param commonRequest CommonSilentFlowRequest
+         * @param silentRequest SilentRequest
+         * @returns A promise that, when resolved, returns the access token
+         */
+        ClientApplication.prototype.acquireTokenByRefreshToken = function (commonRequest, silentRequest) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentRefreshClient;
+                return __generator$1(this, function (_a) {
+                    switch (silentRequest.cacheLookupPolicy) {
+                        case exports.CacheLookupPolicy.Default:
+                        case exports.CacheLookupPolicy.AccessTokenAndRefreshToken:
+                        case exports.CacheLookupPolicy.RefreshToken:
+                        case exports.CacheLookupPolicy.RefreshTokenAndNetwork:
+                            silentRefreshClient = this.createSilentRefreshClient(commonRequest.correlationId);
+                            return [2 /*return*/, silentRefreshClient.acquireToken(commonRequest)];
+                        default:
+                            throw ClientAuthError.createRefreshRequiredError();
+                    }
+                    return [2 /*return*/];
+                });
+            });
+        };
+        /**
+         * Attempt to acquire an access token via an iframe
+         * @param request CommonSilentFlowRequest
+         * @returns A promise that, when resolved, returns the access token
+         */
+        ClientApplication.prototype.acquireTokenBySilentIframe = function (request) {
+            return __awaiter$1(this, void 0, void 0, function () {
+                var silentIframeClient;
+                return __generator$1(this, function (_a) {
+                    silentIframeClient = this.createSilentIframeClient(request.correlationId);
+                    return [2 /*return*/, silentIframeClient.acquireToken(request)];
                 });
             });
         };
@@ -15958,7 +16325,9 @@
                                 fromCache: result.fromCache,
                                 accessTokenSize: result.accessToken.length,
                                 idTokenSize: result.idToken.length,
-                                isNativeBroker: result.fromNativeBroker
+                                isNativeBroker: result.fromNativeBroker,
+                                cacheLookupPolicy: request.cacheLookupPolicy,
+                                requestId: result.requestId
                             });
                             atsMeasurement.flushMeasurement();
                             return result;
@@ -15996,7 +16365,7 @@
          */
         PublicClientApplication.prototype.acquireTokenSilentAsync = function (request, account) {
             return __awaiter$1(this, void 0, void 0, function () {
-                var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1;
+                var astsAsyncMeasurement, result, silentRequest, silentCacheClient, silentRequest_1, requestWithCLP_1;
                 var _this = this;
                 return __generator$1(this, function (_a) {
                     switch (_a.label) {
@@ -16026,11 +16395,32 @@
                             return [4 /*yield*/, silentCacheClient.initializeSilentRequest(request, account)];
                         case 2:
                             silentRequest_1 = _a.sent();
-                            result = silentCacheClient.acquireToken(silentRequest_1).catch(function () { return __awaiter$1(_this, void 0, void 0, function () {
-                                return __generator$1(this, function (_a) {
-                                    return [2 /*return*/, this.acquireTokenByRefreshToken(silentRequest_1)];
+                            requestWithCLP_1 = __assign$1(__assign$1({}, request), { 
+                                // set the request's CacheLookupPolicy to Default if it was not optionally passed in
+                                cacheLookupPolicy: request.cacheLookupPolicy || exports.CacheLookupPolicy.Default });
+                            result = this.acquireTokenFromCache(silentCacheClient, silentRequest_1, requestWithCLP_1).catch(function (cacheError) {
+                                if (requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessToken) {
+                                    throw cacheError;
+                                }
+                                // block the reload if it occurred inside a hidden iframe
+                                BrowserUtils.blockReloadInHiddenIframes();
+                                _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest_1);
+                                return _this.acquireTokenByRefreshToken(silentRequest_1, requestWithCLP_1).catch(function (refreshTokenError) {
+                                    var isServerError = refreshTokenError instanceof ServerError;
+                                    var isInteractionRequiredError = refreshTokenError instanceof InteractionRequiredAuthError;
+                                    var isInvalidGrantError = (refreshTokenError.errorCode === BrowserConstants.INVALID_GRANT_ERROR);
+                                    if ((!isServerError ||
+                                        !isInvalidGrantError ||
+                                        isInteractionRequiredError ||
+                                        requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.AccessTokenAndRefreshToken ||
+                                        requestWithCLP_1.cacheLookupPolicy === exports.CacheLookupPolicy.RefreshToken)
+                                        && (requestWithCLP_1.cacheLookupPolicy !== exports.CacheLookupPolicy.Skip)) {
+                                        throw refreshTokenError;
+                                    }
+                                    _this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.", request.correlationId);
+                                    return _this.acquireTokenBySilentIframe(silentRequest_1);
                                 });
-                            }); });
+                            });
                             _a.label = 3;
                         case 3: return [2 /*return*/, result.then(function (response) {
                                 _this.eventHandler.emitEvent(exports.EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
@@ -16039,7 +16429,8 @@
                                     fromCache: response.fromCache,
                                     accessTokenSize: response.accessToken.length,
                                     idTokenSize: response.idToken.length,
-                                    isNativeBroker: response.fromNativeBroker
+                                    isNativeBroker: response.fromNativeBroker,
+                                    requestId: response.requestId
                                 });
                                 return response;
                             }).catch(function (tokenRenewalError) {