@azure/msal-browser 3.10.0 → 3.11.0

package/src/controllers/UnknownOperatingContextController.ts

@@ -29,7 +29,7 @@ import { RedirectRequest } from "../request/RedirectRequest";
 import { SilentRequest } from "../request/SilentRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { AuthenticationResult } from "../response/AuthenticationResult";
-import { ApiId, WrapperSKU, InteractionType } from "../utils/BrowserConstants";
+import { ApiId, WrapperSKU } from "../utils/BrowserConstants";
 import { IController } from "./IController";
 import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext";
 import { CryptoOps } from "../crypto/CryptoOps";
@@ -149,13 +149,13 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenRedirect(request: RedirectRequest): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return Promise.resolve();
     }
     acquireTokenSilent(
@@ -163,7 +163,7 @@ export class UnknownOperatingContextController implements IController {
         silentRequest: SilentRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenByCode(
@@ -171,7 +171,7 @@ export class UnknownOperatingContextController implements IController {
         request: AuthorizationCodeRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenNative(
@@ -195,7 +195,7 @@ export class UnknownOperatingContextController implements IController {
         accountId?: string | undefined
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenByRefreshToken(
@@ -205,7 +205,7 @@ export class UnknownOperatingContextController implements IController {
         silentRequest: SilentRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     addEventCallback(callback: EventCallbackFunction): string | null {
@@ -217,22 +217,22 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     addPerformanceCallback(callback: PerformanceCallbackFunction): string {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return "";
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     removePerformanceCallback(callbackId: string): boolean {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     enableAccountStorageEvents(): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     disableAccountStorageEvents(): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 
     handleRedirectPromise(
@@ -247,19 +247,19 @@ export class UnknownOperatingContextController implements IController {
         request?: PopupRequest | undefined
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     loginRedirect(request?: RedirectRequest | undefined): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     logout(logoutRequest?: EndSessionRequest | undefined): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     logoutRedirect(
@@ -267,7 +267,7 @@ export class UnknownOperatingContextController implements IController {
         logoutRequest?: EndSessionRequest | undefined
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     logoutPopup(
@@ -275,7 +275,7 @@ export class UnknownOperatingContextController implements IController {
         logoutRequest?: EndSessionPopupRequest | undefined
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     ssoSilent(
@@ -292,12 +292,12 @@ export class UnknownOperatingContextController implements IController {
         >
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     getTokenCache(): ITokenCache {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as ITokenCache;
     }
     getLogger(): Logger {
@@ -306,16 +306,16 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setLogger(logger: Logger): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setActiveAccount(account: AccountInfo | null): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getActiveAccount(): AccountInfo | null {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return null;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -325,45 +325,36 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setNavigationClient(navigationClient: INavigationClient): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getConfiguration(): BrowserConfiguration {
         return this.config;
     }
     isBrowserEnv(): boolean {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     getBrowserCrypto(): ICrypto {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as ICrypto;
     }
     getPerformanceClient(): IPerformanceClient {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as IPerformanceClient;
     }
     getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Map<string, Promise<AuthenticationResult | null>>;
     }
-    preflightBrowserEnvironmentCheck(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        interactionType: InteractionType,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        isAppEmbedded?: boolean | undefined
-    ): void {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -378,6 +369,6 @@ export class UnknownOperatingContextController implements IController {
             | PopupRequest
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 }

package/src/crypto/BrowserCrypto.ts

@@ -13,6 +13,7 @@ import {
     PerformanceEvents,
 } from "@azure/msal-common";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants";
+import { urlEncodeArr } from "../encode/Base64Encode";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -202,3 +203,13 @@ export async function sign(
         data
     ) as Promise<ArrayBuffer>;
 }
+
+/**
+ * Returns the SHA-256 hash of an input string
+ * @param plainText
+ */
+export async function hashString(plainText: string): Promise<string> {
+    const hashBuffer: ArrayBuffer = await sha256Digest(plainText);
+    const hashBytes = new Uint8Array(hashBuffer);
+    return urlEncodeArr(hashBytes);
+}

package/src/crypto/CryptoOps.ts

@@ -20,7 +20,7 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { CryptoKeyStore } from "../cache/CryptoKeyStore";
+import { AsyncMemoryStorage } from "../cache/AsyncMemoryStorage";
 
 export type CachedKeyPair = {
     publicKey: CryptoKey;
@@ -44,13 +44,13 @@ export class CryptoOps implements ICrypto {
 
     private static POP_KEY_USAGES: Array<KeyUsage> = ["sign", "verify"];
     private static EXTRACTABLE: boolean = true;
-    private cache: CryptoKeyStore;
+    private cache: AsyncMemoryStorage<CachedKeyPair>;
 
     constructor(logger: Logger, performanceClient?: IPerformanceClient) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
         BrowserCrypto.validateCryptoAvailable(logger);
-        this.cache = new CryptoKeyStore(this.logger);
+        this.cache = new AsyncMemoryStorage<CachedKeyPair>(this.logger);
         this.performanceClient = performanceClient;
     }
 
@@ -121,7 +121,7 @@ export class CryptoOps implements ICrypto {
             await BrowserCrypto.importJwk(privateKeyJwk, false, ["sign"]);
 
         // Store Keypair data in keystore
-        await this.cache.asymmetricKeys.setItem(publicJwkHash, {
+        await this.cache.setItem(publicJwkHash, {
             privateKey: unextractablePrivateKey,
             publicKey: keyPair.publicKey,
             requestMethod: request.resourceRequestMethod,
@@ -142,8 +142,8 @@ export class CryptoOps implements ICrypto {
      * @param kid
      */
     async removeTokenBindingKey(kid: string): Promise<boolean> {
-        await this.cache.asymmetricKeys.removeItem(kid);
-        const keyFound = await this.cache.asymmetricKeys.containsKey(kid);
+        await this.cache.removeItem(kid);
+        const keyFound = await this.cache.containsKey(kid);
         return !keyFound;
     }
 
@@ -151,7 +151,29 @@ export class CryptoOps implements ICrypto {
      * Removes all cryptographic keys from IndexedDB storage
      */
     async clearKeystore(): Promise<boolean> {
-        return this.cache.clear();
+        // Delete in-memory keystores
+        this.cache.clearInMemory();
+
+        /**
+         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
+         * every persistent keystore
+         */
+        try {
+            await this.cache.clearPersistent();
+            return true;
+        } catch (e) {
+            if (e instanceof Error) {
+                this.logger.error(
+                    `Clearing keystore failed with error: ${e.message}`
+                );
+            } else {
+                this.logger.error(
+                    "Clearing keystore failed with unknown error"
+                );
+            }
+
+            return false;
+        }
     }
 
     /**
@@ -169,7 +191,7 @@ export class CryptoOps implements ICrypto {
             PerformanceEvents.CryptoOptsSignJwt,
             correlationId
         );
-        const cachedKeyPair = await this.cache.asymmetricKeys.getItem(kid);
+        const cachedKeyPair = await this.cache.getItem(kid);
 
         if (!cachedKeyPair) {
             throw createBrowserAuthError(
@@ -227,11 +249,7 @@ export class CryptoOps implements ICrypto {
      * @param plainText
      */
     async hashString(plainText: string): Promise<string> {
-        const hashBuffer: ArrayBuffer = await BrowserCrypto.sha256Digest(
-            plainText
-        );
-        const hashBytes = new Uint8Array(hashBuffer);
-        return urlEncodeArr(hashBytes);
+        return BrowserCrypto.hashString(plainText);
     }
 }
 

package/src/index.ts

@@ -147,6 +147,8 @@ export {
     // Telemetry
     InProgressPerformanceEvent,
     TenantProfile,
+    IPerformanceClient,
+    StubPerformanceClient,
 } from "@azure/msal-common";
 
 export { version } from "./packageMetadata";

package/src/interaction_client/BaseInteractionClient.ts

@@ -9,8 +9,6 @@ import {
     Logger,
     AccountInfo,
     AccountEntity,
-    BaseAuthRequest,
-    AuthenticationScheme,
     UrlString,
     ServerTelemetryManager,
     ServerTelemetryRequest,
@@ -21,7 +19,6 @@ import {
     AuthorityFactory,
     IPerformanceClient,
     PerformanceEvents,
-    StringUtils,
     AzureCloudOptions,
     invokeAsync,
 } from "@azure/msal-common";
@@ -133,69 +130,6 @@ export abstract class BaseInteractionClient {
         }
     }
 
-    /**
-     * Initializer function for all request APIs
-     * @param request
-     */
-    protected async initializeBaseRequest(
-        request: Partial<BaseAuthRequest>
-    ): Promise<BaseAuthRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.InitializeBaseRequest,
-            this.correlationId
-        );
-        const authority = request.authority || this.config.auth.authority;
-
-        const scopes = [...((request && request.scopes) || [])];
-
-        const validatedRequest: BaseAuthRequest = {
-            ...request,
-            correlationId: this.correlationId,
-            authority,
-            scopes,
-        };
-
-        // Set authenticationScheme to BEARER if not explicitly set in the request
-        if (!validatedRequest.authenticationScheme) {
-            validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
-            this.logger.verbose(
-                'Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request'
-            );
-        } else {
-            if (
-                validatedRequest.authenticationScheme ===
-                AuthenticationScheme.SSH
-            ) {
-                if (!request.sshJwk) {
-                    throw createClientConfigurationError(
-                        ClientConfigurationErrorCodes.missingSshJwk
-                    );
-                }
-                if (!request.sshKid) {
-                    throw createClientConfigurationError(
-                        ClientConfigurationErrorCodes.missingSshKid
-                    );
-                }
-            }
-            this.logger.verbose(
-                `Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`
-            );
-        }
-
-        // Set requested claims hash if claims-based caching is enabled and claims were requested
-        if (
-            this.config.cache.claimsBasedCachingEnabled &&
-            request.claims &&
-            // Checks for empty stringified object "{}" which doesn't qualify as requested claims
-            !StringUtils.isEmptyObj(request.claims)
-        ) {
-            validatedRequest.requestedClaimsHash =
-                await this.browserCrypto.hashString(request.claims);
-        }
-
-        return validatedRequest;
-    }
-
     /**
      *
      * Use to get the redirect uri configured in MSAL or null.

package/src/interaction_client/SilentCacheClient.ts

@@ -7,13 +7,9 @@ import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
     CommonSilentFlowRequest,
     SilentFlowClient,
-    ServerTelemetryManager,
-    AccountInfo,
-    AzureCloudOptions,
     PerformanceEvents,
     invokeAsync,
 } from "@azure/msal-common";
-import { SilentRequest } from "../request/SilentRequest";
 import { ApiId } from "../utils/BrowserConstants";
 import {
     BrowserAuthError,
@@ -39,12 +35,22 @@ export class SilentCacheClient extends StandardInteractionClient {
             ApiId.acquireTokenSilent_silentFlow
         );
 
-        const silentAuthClient = await this.createSilentFlowClient(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
+            PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
             serverTelemetryManager,
             silentRequest.authority,
             silentRequest.azureCloudOptions,
             silentRequest.account
         );
+        const silentAuthClient = new SilentFlowClient(
+            clientConfig,
+            this.performanceClient
+        );
         this.logger.verbose("Silent auth client created");
 
         try {
@@ -86,50 +92,4 @@ export class SilentCacheClient extends StandardInteractionClient {
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
         return this.clearCacheOnLogout(validLogoutRequest?.account);
     }
-
-    /**
-     * Creates an Silent Flow Client with the given authority, or the default authority.
-     * @param serverTelemetryManager
-     * @param authorityUrl
-     */
-    protected async createSilentFlowClient(
-        serverTelemetryManager: ServerTelemetryManager,
-        authorityUrl?: string,
-        azureCloudOptions?: AzureCloudOptions,
-        account?: AccountInfo
-    ): Promise<SilentFlowClient> {
-        // Create auth module.
-        const clientConfig = await invokeAsync(
-            this.getClientConfiguration.bind(this),
-            PerformanceEvents.StandardInteractionClientGetClientConfiguration,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(serverTelemetryManager, authorityUrl, azureCloudOptions, account);
-        return new SilentFlowClient(clientConfig, this.performanceClient);
-    }
-
-    async initializeSilentRequest(
-        request: SilentRequest,
-        account: AccountInfo
-    ): Promise<CommonSilentFlowRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.InitializeSilentRequest,
-            this.correlationId
-        );
-
-        const baseRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
-            PerformanceEvents.InitializeBaseRequest,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(request);
-        return {
-            ...request,
-            ...baseRequest,
-            account: account,
-            forceRefresh: request.forceRefresh || false,
-        };
-    }
 }

package/src/interaction_client/SilentRefreshClient.ts

@@ -20,6 +20,7 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import { initializeBaseRequest } from "../request/RequestHelpers";
 
 export class SilentRefreshClient extends StandardInteractionClient {
     /**
@@ -35,12 +36,12 @@ export class SilentRefreshClient extends StandardInteractionClient {
         );
 
         const baseRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
+            initializeBaseRequest,
             PerformanceEvents.InitializeBaseRequest,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request);
+        )(request, this.config, this.performanceClient, this.logger);
         const silentRequest: CommonSilentFlowRequest = {
             ...request,
             ...baseRequest,

package/src/interaction_client/StandardInteractionClient.ts

@@ -32,6 +32,7 @@ import { PopupRequest } from "../request/PopupRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { generatePkceCodes } from "../crypto/PkceGenerator";
 import { createNewGuid } from "../crypto/BrowserCrypto";
+import { initializeBaseRequest } from "../request/RequestHelpers";
 
 /**
  * Defines the class structure and helper functions used by the "standard", non-brokered auth flows (popup, redirect, silent (RT), silent (iframe))
@@ -315,12 +316,17 @@ export abstract class StandardInteractionClient extends BaseInteractionClient {
         );
 
         const baseRequest: BaseAuthRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
+            initializeBaseRequest,
             PerformanceEvents.InitializeBaseRequest,
             this.logger,
             this.performanceClient,
             this.correlationId
-        )(request);
+        )(
+            { ...request, correlationId: this.correlationId },
+            this.config,
+            this.performanceClient,
+            this.logger
+        );
 
         const validatedRequest: AuthorizationUrlRequest = {
             ...baseRequest,

package/src/naa/mapping/NestedAppAuthAdapter.ts

@@ -23,12 +23,15 @@ import {
     RequestParameterBuilder,
     StringUtils,
     createClientAuthError,
+    OIDC_DEFAULT_SCOPES,
 } from "@azure/msal-common";
 import { isBridgeError } from "../BridgeError";
 import { BridgeStatusCode } from "../BridgeStatusCode";
 import { AuthenticationResult } from "../../response/AuthenticationResult";
 import {} from "../../error/BrowserAuthErrorCodes";
 import { AuthResult } from "../AuthResult";
+import { SsoSilentRequest } from "../../request/SsoSilentRequest";
+import { SilentRequest } from "../../request/SilentRequest";
 
 export class NestedAppAuthAdapter {
     protected crypto: ICrypto;
@@ -49,7 +52,11 @@ export class NestedAppAuthAdapter {
     }
 
     public toNaaTokenRequest(
-        request: PopupRequest | RedirectRequest
+        request:
+            | PopupRequest
+            | RedirectRequest
+            | SilentRequest
+            | SsoSilentRequest
     ): TokenRequest {
         let extraParams: Map<string, string>;
         if (request.extraQueryParameters === undefined) {
@@ -65,11 +72,12 @@ export class NestedAppAuthAdapter {
             request.claims,
             this.clientCapabilities
         );
+        const scopes = request.scopes || OIDC_DEFAULT_SCOPES;
         const tokenRequest: TokenRequest = {
             platformBrokerId: request.account?.homeAccountId,
             clientId: this.clientId,
             authority: request.authority,
-            scope: request.scopes.join(" "),
+            scope: scopes.join(" "),
             correlationId:
                 request.correlationId !== undefined
                     ? request.correlationId

package/src/packageMetadata.ts

@@ -1,3 +1,3 @@
 /* eslint-disable header/header */
 export const name = "@azure/msal-browser";
-export const version = "3.10.0";
+export const version = "3.11.0";