@azure/msal-browser 3.11.1 → 3.13.0

package/lib/msal-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-browser v3.11.1 2024-03-27 */
+/*! @azure/msal-browser v3.13.0 2024-04-11 */
 'use strict';
 'use strict';
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -67,11 +67,20 @@ const Constants = {
 };
 const HttpStatus = {
     SUCCESS_RANGE_START: 200,
+    SUCCESS: 200,
     SUCCESS_RANGE_END: 299,
     REDIRECT: 302,
     CLIENT_ERROR_RANGE_START: 400,
+    BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
+    NOT_FOUND: 404,
+    REQUEST_TIMEOUT: 408,
+    TOO_MANY_REQUESTS: 429,
     CLIENT_ERROR_RANGE_END: 499,
     SERVER_ERROR_RANGE_START: 500,
+    INTERNAL_SERVER_ERROR: 500,
+    SERVICE_UNAVAILABLE: 503,
+    GATEWAY_TIMEOUT: 504,
     SERVER_ERROR_RANGE_END: 599,
 };
 const OIDC_DEFAULT_SCOPES = [
@@ -296,8 +305,10 @@ const JsonWebTokenTypes = {
     Jwk: "JWK",
     Pop: "pop",
 };
+// Token renewal offset default in seconds
+const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -314,7 +325,7 @@ var AuthErrorCodes = /*#__PURE__*/Object.freeze({
     unexpectedError: unexpectedError
 });
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -363,7 +374,7 @@ function createAuthError(code, additionalMessage) {
         : AuthErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -461,7 +472,7 @@ var ClientAuthErrorCodes = /*#__PURE__*/Object.freeze({
     userTimeoutReached: userTimeoutReached
 });
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -713,7 +724,7 @@ function createClientAuthError(errorCode, additionalMessage) {
     return new ClientAuthError(errorCode, additionalMessage);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -746,7 +757,7 @@ const DEFAULT_CRYPTO_IMPLEMENTATION = {
     },
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -937,12 +948,12 @@ class Logger {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /* eslint-disable header/header */
 const name$1 = "@azure/msal-common";
-const version$1 = "14.8.1";
+const version$1 = "14.9.0";
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -962,7 +973,7 @@ const AzureCloudInstance = {
     AzureUsGovernment: "https://login.microsoftonline.us",
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1023,7 +1034,7 @@ function checkMaxAge(authTime, maxAge) {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1060,7 +1071,7 @@ function wasClockTurnedBack(cachedAt) {
     return cachedAtSec > nowSeconds();
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1387,7 +1398,7 @@ function isAuthorityMetadataExpired(metadata) {
     return metadata.expiresAt <= nowSeconds();
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1441,7 +1452,7 @@ var ClientConfigurationErrorCodes = /*#__PURE__*/Object.freeze({
     urlParseError: urlParseError
 });
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1579,7 +1590,7 @@ function createClientConfigurationError(errorCode) {
     return new ClientConfigurationError(errorCode);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1676,7 +1687,7 @@ class StringUtils {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1876,7 +1887,7 @@ class ScopeSet {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -1916,7 +1927,7 @@ function buildClientInfoFromHomeAccountId(homeAccountId) {
     };
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1978,7 +1989,7 @@ function updateAccountTenantProfileData(baseAccountInfo, tenantProfile, idTokenC
     return updatedAccountInfo;
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -1993,7 +2004,7 @@ const AuthorityType = {
     Ciam: 3,
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2015,7 +2026,7 @@ function getTenantIdFromIdTokenClaims(idTokenClaims) {
     return null;
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -2028,7 +2039,7 @@ const ProtocolMode = {
     OIDC: "OIDC",
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2275,7 +2286,7 @@ class AccountEntity {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2322,7 +2333,7 @@ function getDeserializedResponse(responseString) {
     return null;
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2486,7 +2497,7 @@ class UrlString {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2626,7 +2637,42 @@ function getCloudDiscoveryMetadataFromNetworkResponse(response, authorityHost) {
     return null;
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const cacheQuotaExceededErrorCode = "cache_quota_exceeded";
+const cacheUnknownErrorCode = "cache_error_unknown";
+
+/*! @azure/msal-common v14.9.0 2024-04-11 */
+
+/*
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const CacheErrorMessages = {
+    [cacheQuotaExceededErrorCode]: "Exceeded cache storage capacity.",
+    [cacheUnknownErrorCode]: "Unexpected error occurred when using cache storage.",
+};
+/**
+ * Error thrown when there is an error with the cache
+ */
+class CacheError extends Error {
+    constructor(errorCode, errorMessage) {
+        const message = errorMessage ||
+            (CacheErrorMessages[errorCode]
+                ? CacheErrorMessages[errorCode]
+                : CacheErrorMessages[cacheUnknownErrorCode]);
+        super(`${errorCode}: ${message}`);
+        Object.setPrototypeOf(this, CacheError.prototype);
+        this.name = "CacheError";
+        this.errorCode = errorCode;
+        this.errorMessage = message;
+    }
+}
+
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -2790,27 +2836,51 @@ class CacheManager {
     }
     /**
      * saves a cache record
-     * @param cacheRecord
+     * @param cacheRecord {CacheRecord}
+     * @param storeInCache {?StoreInCache}
+     * @param correlationId {?string} correlation id
      */
-    async saveCacheRecord(cacheRecord, storeInCache) {
+    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
         if (!cacheRecord) {
             throw createClientAuthError(invalidCacheRecord);
         }
-        if (!!cacheRecord.account) {
-            this.setAccount(cacheRecord.account);
-        }
-        if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
-            this.setIdTokenCredential(cacheRecord.idToken);
-        }
-        if (!!cacheRecord.accessToken && storeInCache?.accessToken !== false) {
-            await this.saveAccessToken(cacheRecord.accessToken);
-        }
-        if (!!cacheRecord.refreshToken &&
-            storeInCache?.refreshToken !== false) {
-            this.setRefreshTokenCredential(cacheRecord.refreshToken);
+        try {
+            if (!!cacheRecord.account) {
+                this.setAccount(cacheRecord.account);
+            }
+            if (!!cacheRecord.idToken && storeInCache?.idToken !== false) {
+                this.setIdTokenCredential(cacheRecord.idToken);
+            }
+            if (!!cacheRecord.accessToken &&
+                storeInCache?.accessToken !== false) {
+                await this.saveAccessToken(cacheRecord.accessToken);
+            }
+            if (!!cacheRecord.refreshToken &&
+                storeInCache?.refreshToken !== false) {
+                this.setRefreshTokenCredential(cacheRecord.refreshToken);
+            }
+            if (!!cacheRecord.appMetadata) {
+                this.setAppMetadata(cacheRecord.appMetadata);
+            }
         }
-        if (!!cacheRecord.appMetadata) {
-            this.setAppMetadata(cacheRecord.appMetadata);
+        catch (e) {
+            this.commonLogger?.error(`CacheManager.saveCacheRecord: failed`);
+            if (e instanceof Error) {
+                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e.message}`, correlationId);
+                if (e.name === "QuotaExceededError" ||
+                    e.name === "NS_ERROR_DOM_QUOTA_REACHED" ||
+                    e.message.includes("exceeded the quota")) {
+                    this.commonLogger?.error(`CacheManager.saveCacheRecord: exceeded storage quota`, correlationId);
+                    throw new CacheError(cacheQuotaExceededErrorCode);
+                }
+                else {
+                    throw new CacheError(e.name, e.message);
+                }
+            }
+            else {
+                this.commonLogger?.errorPii(`CacheManager.saveCacheRecord: ${e}`, correlationId);
+                throw new CacheError(cacheUnknownErrorCode);
+            }
         }
     }
     /**
@@ -3857,14 +3927,12 @@ class DefaultStorageClass extends CacheManager {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
-// Token renewal offset default in seconds
-const DEFAULT_TOKEN_RENEWAL_OFFSET_SEC = 300;
 const DEFAULT_SYSTEM_OPTIONS = {
     tokenRenewalOffsetSeconds: DEFAULT_TOKEN_RENEWAL_OFFSET_SEC,
     preventCorsPreflight: false,
@@ -3957,7 +4025,7 @@ function isOidcProtocolMode(config) {
     return (config.authOptions.authority.options.protocolMode === ProtocolMode.OIDC);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -3974,7 +4042,7 @@ class ServerError extends AuthError {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4072,7 +4140,7 @@ class ThrottlingUtils {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4109,7 +4177,7 @@ class NetworkManager {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4119,7 +4187,7 @@ const CcsCredentialType = {
     UPN: "UPN",
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4166,7 +4234,7 @@ const SID = "sid";
 const LOGIN_HINT = "login_hint";
 const DOMAIN_HINT = "domain_hint";
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4250,7 +4318,7 @@ class RequestValidator {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -4634,7 +4702,7 @@ class RequestParameterBuilder {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4646,7 +4714,7 @@ function isOpenIdConfigResponse(response) {
         response.hasOwnProperty("jwks_uri"));
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4656,7 +4724,7 @@ function isCloudInstanceDiscoveryResponse(response) {
         response.hasOwnProperty("metadata"));
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4666,7 +4734,7 @@ function isCloudInstanceDiscoveryErrorResponse(response) {
         response.hasOwnProperty("error_description"));
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -4728,6 +4796,7 @@ const PerformanceEvents = {
      * Used to acquire a new set of tokens from the authorize endpoint in a hidden iframe.
      */
     SilentIframeClientAcquireToken: "silentIframeClientAcquireToken",
+    AwaitConcurrentIframe: "awaitConcurrentIframe",
     /**
      * acquireToken API in SilentRereshClient (msal-browser).
      * Used to acquire a new set of tokens from the token endpoint using a refresh token.
@@ -5140,7 +5209,7 @@ const IntFields = new Set([
     "multiMatchedRT",
 ]);
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -5236,7 +5305,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
     };
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5345,7 +5414,7 @@ RegionDiscovery.IMDS_OPTIONS = {
     },
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5357,7 +5426,7 @@ RegionDiscovery.IMDS_OPTIONS = {
  * @internal
  */
 class Authority {
-    constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient) {
+    constructor(authority, networkInterface, cacheManager, authorityOptions, logger, correlationId, performanceClient, managedIdentity) {
         this.canonicalAuthority = authority;
         this._canonicalAuthority.validateAsUri();
         this.networkInterface = networkInterface;
@@ -5371,6 +5440,7 @@ class Authority {
         this.logger = logger;
         this.performanceClient = performanceClient;
         this.correlationId = correlationId;
+        this.managedIdentity = managedIdentity || false;
         this.regionDiscovery = new RegionDiscovery(networkInterface, this.logger, this.performanceClient, this.correlationId);
     }
     /**
@@ -5576,7 +5646,7 @@ class Authority {
         return `${this.canonicalAuthority}v2.0/.well-known/openid-configuration`;
     }
     /**
-     * Boolean that returns whethr or not tenant discovery has been completed.
+     * Boolean that returns whether or not tenant discovery has been completed.
      */
     discoveryComplete() {
         return !!this.metadata;
@@ -6028,7 +6098,10 @@ class Authority {
      * helper function to generate environment from authority object
      */
     getPreferredCache() {
-        if (this.discoveryComplete()) {
+        if (this.managedIdentity) {
+            return Constants.DEFAULT_AUTHORITY_HOST;
+        }
+        else if (this.discoveryComplete()) {
             return this.metadata.preferred_cache;
         }
         else {
@@ -6180,7 +6253,7 @@ function buildStaticAuthorityOptions(authOptions) {
     };
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6211,7 +6284,7 @@ async function createDiscoveredInstance(authorityUri, networkClient, cacheManage
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6314,7 +6387,7 @@ class BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6340,7 +6413,7 @@ var InteractionRequiredAuthErrorCodes = /*#__PURE__*/Object.freeze({
     refreshTokenExpired: refreshTokenExpired
 });
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6427,7 +6500,7 @@ function createInteractionRequiredAuthError(errorCode) {
     return new InteractionRequiredAuthError(errorCode, InteractionRequiredAuthErrorMessages[errorCode]);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6443,7 +6516,7 @@ class CacheRecord {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6515,7 +6588,7 @@ class ProtocolUtils {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6600,7 +6673,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -6627,7 +6700,7 @@ class PopTokenGenerator {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -6782,7 +6855,7 @@ class ResponseHandler {
                     return await ResponseHandler.generateAuthenticationResult(this.cryptoObj, authority, cacheRecord, false, request, idTokenClaims, requestStateObj, undefined, serverRequestId);
                 }
             }
-            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache);
+            await this.cacheStorage.saveCacheRecord(cacheRecord, request.storeInCache, request.correlationId);
         }
         finally {
             if (this.persistencePlugin &&
@@ -6980,7 +7053,7 @@ function buildAccountToCache(cacheStorage, authority, homeAccountId, idTokenClai
     return baseAccount;
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7265,7 +7338,11 @@ class AuthorizationCodeClient extends BaseClient {
             }
             else if (request.account) {
                 const accountSid = this.extractAccountSid(request.account);
-                const accountLoginHintClaim = this.extractLoginHint(request.account);
+                let accountLoginHintClaim = this.extractLoginHint(request.account);
+                if (accountLoginHintClaim && request.domainHint) {
+                    this.logger.warning(`AuthorizationCodeClient.createAuthCodeUrlQueryString: "domainHint" param is set, skipping opaque "login_hint" claim. Please consider not passing domainHint`);
+                    accountLoginHintClaim = null;
+                }
                 // If login_hint claim is present, use it over sid/username
                 if (accountLoginHintClaim) {
                     this.logger.verbose("createAuthCodeUrlQueryString: login_hint claim present on account");
@@ -7385,7 +7462,7 @@ class AuthorizationCodeClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7592,7 +7669,7 @@ class RefreshTokenClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7728,7 +7805,7 @@ class SilentFlowClient extends BaseClient {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7743,7 +7820,7 @@ const StubbedNetworkModule = {
     },
 };
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
@@ -7751,7 +7828,7 @@ const StubbedNetworkModule = {
 const missingKidError = "missing_kid_error";
 const missingAlgError = "missing_alg_error";
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7776,7 +7853,7 @@ function createJoseHeaderError(code) {
     return new JoseHeaderError(code, JoseHeaderErrorMessages[code]);
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7816,7 +7893,7 @@ class JoseHeader {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -7874,7 +7951,7 @@ class AuthenticationHeaderParser {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8078,7 +8155,7 @@ class ServerTelemetryManager {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8157,7 +8234,7 @@ class StubPerformanceClient {
     }
 }
 
-/*! @azure/msal-common v14.8.1 2024-03-27 */
+/*! @azure/msal-common v14.9.0 2024-04-11 */
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -8257,6 +8334,10 @@ function addError(error, logger, event, stackMaxSize = 5) {
         event.subErrorCode = error.subError;
         return;
     }
+    else if (error instanceof CacheError) {
+        event.errorCode = error.errorCode;
+        return;
+    }
     else if (event.errorStack?.length) {
         logger.trace("PerformanceClient.addErrorStack: Stack already exist", event.correlationId);
         return;
@@ -10013,7 +10094,7 @@ function buildConfiguration({ auth: userInputAuth, cache: userInputCache, system
 
 /* eslint-disable header/header */
 const name = "@azure/msal-browser";
-const version = "3.11.1";
+const version = "3.13.0";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -10148,11 +10229,7 @@ class BridgeProxy {
         if (window.nestedAppAuthBridge === undefined) {
             throw new Error("window.nestedAppAuthBridge is undefined");
         }
-        if (window.crypto === undefined) {
-            throw new Error("window.crypto is undefined");
-        }
         try {
-            BridgeProxy.crypto = window.crypto;
             window.nestedAppAuthBridge.addEventListener("message", (response) => {
                 const responsePayload = typeof response === "string" ? response : response.data;
                 const responseEnvelope = JSON.parse(responsePayload);
@@ -10171,7 +10248,7 @@ class BridgeProxy {
                 const message = {
                     messageType: "NestedAppAuthRequest",
                     method: "GetInitContext",
-                    requestId: BridgeProxy.getRandomId(),
+                    requestId: createNewGuid(),
                 };
                 const request = {
                     requestId: message.requestId,
@@ -10189,9 +10266,6 @@ class BridgeProxy {
             throw error;
         }
     }
-    static getRandomId() {
-        return BridgeProxy.crypto.randomUUID();
-    }
     /**
      * getTokenInteractive - Attempts to get a token interactively from the bridge
      * @param request A token request
@@ -10233,7 +10307,7 @@ class BridgeProxy {
         const message = {
             messageType: "NestedAppAuthRequest",
             method: method,
-            requestId: BridgeProxy.getRandomId(),
+            requestId: createNewGuid(),
             ...requestParams,
         };
         const promise = new Promise((resolve, reject) => {
@@ -11068,7 +11142,7 @@ function extractBrowserRequestState(browserCrypto, state) {
  * parameters such as state and nonce, generally.
  */
 class BrowserCacheManager extends CacheManager {
-    constructor(clientId, cacheConfig, cryptoImpl, logger, staticAuthorityOptions) {
+    constructor(clientId, cacheConfig, cryptoImpl, logger, staticAuthorityOptions, performanceClient) {
         super(clientId, cryptoImpl, logger, staticAuthorityOptions);
         // Cookie life calculation (hours * minutes * seconds * ms)
         this.COOKIE_LIFE_MULTIPLIER = 24 * 60 * 60 * 1000;
@@ -11082,6 +11156,7 @@ class BrowserCacheManager extends CacheManager {
             this.migrateCacheEntries();
             this.createKeyMaps();
         }
+        this.performanceClient = performanceClient;
     }
     /**
      * Returns a window storage class implementing the IWindowStorage interface that corresponds to the configured cacheLocation.
@@ -12302,6 +12377,33 @@ class BrowserCacheManager extends CacheManager {
         const cacheRecord = new CacheRecord(undefined, idTokenEntity, accessTokenEntity);
         return this.saveCacheRecord(cacheRecord);
     }
+    /**
+     * saves a cache record
+     * @param cacheRecord {CacheRecord}
+     * @param storeInCache {?StoreInCache}
+     * @param correlationId {?string} correlation id
+     */
+    async saveCacheRecord(cacheRecord, storeInCache, correlationId) {
+        try {
+            await super.saveCacheRecord(cacheRecord, storeInCache, correlationId);
+        }
+        catch (e) {
+            if (e instanceof CacheError &&
+                this.performanceClient &&
+                correlationId) {
+                try {
+                    const tokenKeys = this.getTokenKeys();
+                    this.performanceClient.addFields({
+                        cacheRtCount: tokenKeys.refreshToken.length,
+                        cacheIdCount: tokenKeys.idToken.length,
+                        cacheAtCount: tokenKeys.accessToken.length,
+                    }, correlationId);
+                }
+                catch (e) { }
+            }
+            throw e;
+        }
+    }
 }
 const DEFAULT_BROWSER_CACHE_MANAGER = (clientId, logger) => {
     const cacheOptions = {
@@ -14960,6 +15062,7 @@ function loadFrameSync(urlNavigate) {
  */
 function createHiddenIframe() {
     const authFrame = document.createElement("iframe");
+    authFrame.className = "msalSilentIframe";
     authFrame.style.visibility = "hidden";
     authFrame.style.position = "absolute";
     authFrame.style.width = authFrame.style.height = "0";
@@ -15471,7 +15574,7 @@ class StandardController {
         this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment
-            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth))
+            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, buildStaticAuthorityOptions(this.config.auth), this.performanceClient)
             : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
         // initialize in memory storage for native flows
         const nativeCacheOptions = {
@@ -15482,7 +15585,7 @@ class StandardController {
             cacheMigrationEnabled: false,
             claimsBasedCachingEnabled: false,
         };
-        this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger);
+        this.nativeInternalStorage = new BrowserCacheManager(this.config.auth.clientId, nativeCacheOptions, this.browserCrypto, this.logger, undefined, this.performanceClient);
         // Initialize the token cache
         this.tokenCache = new TokenCache(this.config, this.browserStorage, this.logger, this.browserCrypto);
         this.activeSilentTokenRequests = new Map();
@@ -15545,7 +15648,6 @@ class StandardController {
         this.logger.verbose("handleRedirectPromise called");
         // Block token acquisition before initialize has been called
         blockAPICallsBeforeInitialize(this.initialized);
-        const loggedInAccounts = this.getAllAccounts();
         if (this.isBrowserEnvironment) {
             /**
              * Store the promise on the PublicClientApplication instance if this is the first invocation of handleRedirectPromise,
@@ -15555,64 +15657,9 @@ class StandardController {
             const redirectResponseKey = hash || "";
             let response = this.redirectResponse.get(redirectResponseKey);
             if (typeof response === "undefined") {
-                const request = this.browserStorage.getCachedNativeRequest();
-                const useNative = request &&
-                    NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
-                    this.nativeExtensionProvider &&
-                    !hash;
-                const correlationId = useNative
-                    ? request?.correlationId
-                    : this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
-                const rootMeasurement = this.performanceClient.startMeasurement("acquireTokenRedirect", correlationId);
-                this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
-                this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise");
-                let redirectResponse;
-                if (useNative && this.nativeExtensionProvider) {
-                    this.logger.trace("handleRedirectPromise - acquiring token from native platform");
-                    const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
-                    redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), PerformanceEvents.HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
-                }
-                else {
-                    this.logger.trace("handleRedirectPromise - acquiring token from web flow");
-                    const redirectClient = this.createRedirectClient(correlationId);
-                    redirectResponse = invokeAsync(redirectClient.handleRedirectPromise.bind(redirectClient), PerformanceEvents.HandleRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(hash, this.performanceClient, rootMeasurement.event.correlationId);
-                }
-                response = redirectResponse
-                    .then((result) => {
-                    if (result) {
-                        // Emit login event if number of accounts change
-                        const isLoggingIn = loggedInAccounts.length <
-                            this.getAllAccounts().length;
-                        if (isLoggingIn) {
-                            this.eventHandler.emitEvent(EventType.LOGIN_SUCCESS, exports.InteractionType.Redirect, result);
-                            this.logger.verbose("handleRedirectResponse returned result, login success");
-                        }
-                        else {
-                            this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Redirect, result);
-                            this.logger.verbose("handleRedirectResponse returned result, acquire token success");
-                        }
-                        rootMeasurement.end({ success: true });
-                    }
-                    this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
-                    rootMeasurement.end({ success: false });
-                    return result;
-                })
-                    .catch((e) => {
-                    const eventError = e;
-                    // Emit login event if there is an account
-                    if (loggedInAccounts.length > 0) {
-                        this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, eventError);
-                    }
-                    else {
-                        this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Redirect, null, eventError);
-                    }
-                    this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
-                    rootMeasurement.end({
-                        success: false,
-                    }, eventError);
-                    throw e;
-                });
+                response = this.handleRedirectPromiseInternal(hash);
                 this.redirectResponse.set(redirectResponseKey, response);
+                this.logger.verbose("handleRedirectPromise has been called for the first time, storing the promise");
             }
             else {
                 this.logger.verbose("handleRedirectPromise has been called previously, returning the result from the first call");
@@ -15622,6 +15669,69 @@ class StandardController {
         this.logger.verbose("handleRedirectPromise returns null, not browser environment");
         return null;
     }
+    /**
+     * The internal details of handleRedirectPromise. This is separated out to a helper to allow handleRedirectPromise to memoize requests
+     * @param hash
+     * @returns
+     */
+    async handleRedirectPromiseInternal(hash) {
+        const loggedInAccounts = this.getAllAccounts();
+        const request = this.browserStorage.getCachedNativeRequest();
+        const useNative = request &&
+            NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider) &&
+            this.nativeExtensionProvider &&
+            !hash;
+        const correlationId = useNative
+            ? request?.correlationId
+            : this.browserStorage.getTemporaryCache(TemporaryCacheKeys.CORRELATION_ID, true) || "";
+        const rootMeasurement = this.performanceClient.startMeasurement("acquireTokenRedirect", correlationId);
+        this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_START, exports.InteractionType.Redirect);
+        let redirectResponse;
+        if (useNative && this.nativeExtensionProvider) {
+            this.logger.trace("handleRedirectPromise - acquiring token from native platform");
+            const nativeClient = new NativeInteractionClient(this.config, this.browserStorage, this.browserCrypto, this.logger, this.eventHandler, this.navigationClient, ApiId.handleRedirectPromise, this.performanceClient, this.nativeExtensionProvider, request.accountId, this.nativeInternalStorage, request.correlationId);
+            redirectResponse = invokeAsync(nativeClient.handleRedirectPromise.bind(nativeClient), PerformanceEvents.HandleNativeRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(this.performanceClient, rootMeasurement.event.correlationId);
+        }
+        else {
+            this.logger.trace("handleRedirectPromise - acquiring token from web flow");
+            const redirectClient = this.createRedirectClient(correlationId);
+            redirectResponse = invokeAsync(redirectClient.handleRedirectPromise.bind(redirectClient), PerformanceEvents.HandleRedirectPromiseMeasurement, this.logger, this.performanceClient, rootMeasurement.event.correlationId)(hash, this.performanceClient, rootMeasurement.event.correlationId);
+        }
+        return redirectResponse
+            .then((result) => {
+            if (result) {
+                // Emit login event if number of accounts change
+                const isLoggingIn = loggedInAccounts.length < this.getAllAccounts().length;
+                if (isLoggingIn) {
+                    this.eventHandler.emitEvent(EventType.LOGIN_SUCCESS, exports.InteractionType.Redirect, result);
+                    this.logger.verbose("handleRedirectResponse returned result, login success");
+                }
+                else {
+                    this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Redirect, result);
+                    this.logger.verbose("handleRedirectResponse returned result, acquire token success");
+                }
+                rootMeasurement.end({ success: true });
+            }
+            this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
+            rootMeasurement.end({ success: false });
+            return result;
+        })
+            .catch((e) => {
+            const eventError = e;
+            // Emit login event if there is an account
+            if (loggedInAccounts.length > 0) {
+                this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_FAILURE, exports.InteractionType.Redirect, null, eventError);
+            }
+            else {
+                this.eventHandler.emitEvent(EventType.LOGIN_FAILURE, exports.InteractionType.Redirect, null, eventError);
+            }
+            this.eventHandler.emitEvent(EventType.HANDLE_REDIRECT_END, exports.InteractionType.Redirect);
+            rootMeasurement.end({
+                success: false,
+            }, eventError);
+            throw e;
+        });
+    }
     /**
      * Use when you want to obtain an access_token for your API by redirecting the user's browser window to the authorization endpoint. This function redirects
      * the page, so any code that follows this function will not execute.
@@ -16580,49 +16690,69 @@ class StandardController {
             this.performanceClient.incrementFields({ visibilityChangeCount: 0 }, request.correlationId);
         }
         document.addEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
-        let result;
-        if (NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, request.authenticationScheme) &&
-            account.nativeAccountId) {
-            this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
-            const silentRequest = {
-                ...request,
-                account,
-            };
-            result = this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
-                // If native token acquisition fails for availability reasons fallback to web flow
-                if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
-                    this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
-                    this.nativeExtensionProvider = undefined; // Prevent future requests from continuing to attempt
-                    // Cache will not contain tokens, given that previous WAM requests succeeded. Skip cache and RT renewal and go straight to iframe renewal
-                    const silentIframeClient = this.createSilentIframeClient(request.correlationId);
-                    return silentIframeClient.acquireToken(request);
-                }
-                throw e;
-            });
-        }
-        else {
-            this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
-            const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
-            const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
-            result = invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
-                if (request.cacheLookupPolicy ===
-                    CacheLookupPolicy.AccessToken) {
-                    throw cacheError;
+        const silentRequest = await invokeAsync(initializeSilentRequest, PerformanceEvents.InitializeSilentRequest, this.logger, this.performanceClient, request.correlationId)(request, account, this.config, this.performanceClient, this.logger);
+        const cacheLookupPolicy = request.cacheLookupPolicy || CacheLookupPolicy.Default;
+        const result = this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy).catch(async (refreshTokenError) => {
+            const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy);
+            if (shouldTryToResolveSilently) {
+                if (!this.activeIframeRequest) {
+                    let _resolve, _reject;
+                    // Always set the active request tracker immediately after checking it to prevent races
+                    this.activeIframeRequest = [
+                        new Promise((resolve, reject) => {
+                            _resolve = resolve;
+                            _reject = reject;
+                        }),
+                        silentRequest.correlationId,
+                    ];
+                    this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.", silentRequest.correlationId);
+                    return invokeAsync(this.acquireTokenBySilentIframe.bind(this), PerformanceEvents.AcquireTokenBySilentIframe, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest)
+                        .then((iframeResult) => {
+                        _resolve();
+                        return iframeResult;
+                    })
+                        .catch((e) => {
+                        _reject(e);
+                        throw e;
+                    })
+                        .finally(() => {
+                        this.activeIframeRequest = undefined;
+                    });
                 }
-                this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest);
-                return invokeAsync(this.acquireTokenByRefreshToken.bind(this), PerformanceEvents.AcquireTokenByRefreshToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((refreshTokenError) => {
-                    const shouldTryToResolveSilently = checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, silentRequest, cacheLookupPolicy);
-                    if (shouldTryToResolveSilently) {
-                        this.logger.verbose("Refresh token expired/invalid or CacheLookupPolicy is set to Skip, attempting acquire token by iframe.", silentRequest.correlationId);
-                        return invokeAsync(this.acquireTokenBySilentIframe.bind(this), PerformanceEvents.AcquireTokenBySilentIframe, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
-                    }
-                    else {
-                        // Error cannot be silently resolved or iframe renewal is not allowed, interaction required
+                else if (cacheLookupPolicy !== CacheLookupPolicy.Skip) {
+                    const [activePromise, activeCorrelationId] = this.activeIframeRequest;
+                    this.logger.verbose(`Iframe request is already in progress, awaiting resolution for request with correlationId: ${activeCorrelationId}`, silentRequest.correlationId);
+                    const awaitConcurrentIframeMeasure = this.performanceClient.startMeasurement(PerformanceEvents.AwaitConcurrentIframe, silentRequest.correlationId);
+                    awaitConcurrentIframeMeasure.add({
+                        awaitIframeCorrelationId: activeCorrelationId,
+                    });
+                    // Await for errors first so we can distinguish errors thrown by activePromise versus errors thrown by .then below
+                    await activePromise.catch(() => {
+                        awaitConcurrentIframeMeasure.end({
+                            success: false,
+                        });
+                        this.logger.info(`Iframe request with correlationId: ${activeCorrelationId} failed. Interaction is required.`);
+                        // If previous iframe request failed, it's unlikely to succeed this time. Throw original error.
                         throw refreshTokenError;
-                    }
-                });
-            });
-        }
+                    });
+                    return activePromise.then(() => {
+                        awaitConcurrentIframeMeasure.end({ success: true });
+                        this.logger.verbose(`Parallel iframe request with correlationId: ${activeCorrelationId} succeeded. Retrying cache and/or RT redemption`, silentRequest.correlationId);
+                        // Retry cache lookup and/or RT exchange after iframe completes
+                        return this.acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy);
+                    });
+                }
+                else {
+                    // Cache policy set to skip and another iframe request is already in progress
+                    this.logger.warning("Another iframe request is currently in progress and CacheLookupPolicy is set to Skip. This may result in degraded performance and/or reliability for both calls. Please consider changing the CacheLookupPolicy to take advantage of request queuing and token cache.", silentRequest.correlationId);
+                    return invokeAsync(this.acquireTokenBySilentIframe.bind(this), PerformanceEvents.AcquireTokenBySilentIframe, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest);
+                }
+            }
+            else {
+                // Error cannot be silently resolved or iframe renewal is not allowed, interaction required
+                throw refreshTokenError;
+            }
+        });
         return result
             .then((response) => {
             this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_SUCCESS, exports.InteractionType.Silent, response);
@@ -16643,6 +16773,38 @@ class StandardController {
             document.removeEventListener("visibilitychange", () => this.trackPageVisibility(request.correlationId));
         });
     }
+    /**
+     * AcquireTokenSilent without the iframe fallback. This is used to enable the correct fallbacks in cases where there's a potential for multiple silent requests to be made in parallel and prevent those requests from making concurrent iframe requests.
+     * @param silentRequest
+     * @param cacheLookupPolicy
+     * @returns
+     */
+    async acquireTokenSilentNoIframe(silentRequest, cacheLookupPolicy) {
+        if (NativeMessageHandler.isNativeAvailable(this.config, this.logger, this.nativeExtensionProvider, silentRequest.authenticationScheme) &&
+            silentRequest.account.nativeAccountId) {
+            this.logger.verbose("acquireTokenSilent - attempting to acquire token from native platform");
+            return this.acquireTokenNative(silentRequest, ApiId.acquireTokenSilent_silentFlow).catch(async (e) => {
+                // If native token acquisition fails for availability reasons fallback to web flow
+                if (e instanceof NativeAuthError && isFatalNativeAuthError(e)) {
+                    this.logger.verbose("acquireTokenSilent - native platform unavailable, falling back to web flow");
+                    this.nativeExtensionProvider = undefined; // Prevent future requests from continuing to attempt
+                    // Cache will not contain tokens, given that previous WAM requests succeeded. Skip cache and RT renewal and go straight to iframe renewal
+                    throw createClientAuthError(tokenRefreshRequired);
+                }
+                throw e;
+            });
+        }
+        else {
+            this.logger.verbose("acquireTokenSilent - attempting to acquire token from web flow");
+            return invokeAsync(this.acquireTokenFromCache.bind(this), PerformanceEvents.AcquireTokenFromCache, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy).catch((cacheError) => {
+                if (cacheLookupPolicy === CacheLookupPolicy.AccessToken) {
+                    throw cacheError;
+                }
+                this.eventHandler.emitEvent(EventType.ACQUIRE_TOKEN_NETWORK_START, exports.InteractionType.Silent, silentRequest);
+                return invokeAsync(this.acquireTokenByRefreshToken.bind(this), PerformanceEvents.AcquireTokenByRefreshToken, this.logger, this.performanceClient, silentRequest.correlationId)(silentRequest, cacheLookupPolicy);
+            });
+        }
+    }
 }
 /**
  * Determines whether an error thrown by the refresh token endpoint can be resolved without interaction
@@ -16651,7 +16813,7 @@ class StandardController {
  * @param cacheLookupPolicy
  * @returns
  */
-function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, silentRequest, cacheLookupPolicy) {
+function checkIfRefreshTokenErrorCanBeResolvedSilently(refreshTokenError, cacheLookupPolicy) {
     const noInteractionRequired = !(refreshTokenError instanceof InteractionRequiredAuthError &&
         // For refresh token errors, bad_token does not always require interaction (silently resolvable)
         refreshTokenError.subError !==
@@ -17045,7 +17207,7 @@ class UnknownOperatingContextController {
             : DEFAULT_CRYPTO_IMPLEMENTATION;
         // Initialize the browser storage class.
         this.browserStorage = this.isBrowserEnvironment
-            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger)
+            ? new BrowserCacheManager(this.config.auth.clientId, this.config.cache, this.browserCrypto, this.logger, undefined, this.performanceClient)
             : DEFAULT_BROWSER_CACHE_MANAGER(this.config.auth.clientId, this.logger);
         this.eventHandler = new EventHandler(this.logger, this.browserCrypto);
     }
@@ -18544,12 +18706,7 @@ class NestedAppAuthController {
     }
     loginPopup(request // eslint-disable-line @typescript-eslint/no-unused-vars
     ) {
-        if (request !== undefined) {
-            return this.acquireTokenInteractive(request);
-        }
-        else {
-            throw NestedAppAuthError.createUnsupportedError();
-        }
+        return this.acquireTokenInteractive(request || DEFAULT_REQUEST);
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     loginRedirect(request) {