@azure/msal-browser 4.26.1 → 4.27.0

package/src/broker/nativeBroker/PlatformAuthProvider.ts

@@ -9,6 +9,8 @@ import {
     Logger,
     AuthenticationScheme,
     StubPerformanceClient,
+    createClientConfigurationError,
+    ClientConfigurationErrorCodes,
 } from "@azure/msal-common/browser";
 import { name, version } from "../../packageMetadata.js";
 import {
@@ -19,8 +21,6 @@ import { PlatformAuthExtensionHandler } from "./PlatformAuthExtensionHandler.js"
 import { IPlatformAuthHandler } from "./IPlatformAuthHandler.js";
 import { PlatformAuthDOMHandler } from "./PlatformAuthDOMHandler.js";
 import { createNewGuid } from "../../crypto/BrowserCrypto.js";
-import { BrowserCacheLocation } from "../../utils/BrowserConstants.js";
-import { PLATFORM_AUTH_DOM_SUPPORT } from "../../cache/CacheKeys.js";
 
 /**
  * Checks if the platform broker is available in the current environment.
@@ -31,7 +31,8 @@ import { PLATFORM_AUTH_DOM_SUPPORT } from "../../cache/CacheKeys.js";
 export async function isPlatformBrokerAvailable(
     loggerOptions?: LoggerOptions,
     perfClient?: IPerformanceClient,
-    correlationId?: string
+    correlationId?: string,
+    domConfig?: boolean
 ): Promise<boolean> {
     const logger = new Logger(loggerOptions || {}, name, version);
 
@@ -47,7 +48,9 @@ export async function isPlatformBrokerAvailable(
     return !!(await getPlatformAuthProvider(
         logger,
         performanceClient,
-        correlationId || createNewGuid()
+        correlationId || createNewGuid(),
+        undefined,
+        domConfig
     ));
 }
 
@@ -55,16 +58,16 @@ export async function getPlatformAuthProvider(
     logger: Logger,
     performanceClient: IPerformanceClient,
     correlationId: string,
-    nativeBrokerHandshakeTimeout?: number
+    nativeBrokerHandshakeTimeout?: number,
+    enablePlatformBrokerDOMSupport?: boolean
 ): Promise<IPlatformAuthHandler | undefined> {
     logger.trace("getPlatformAuthProvider called", correlationId);
 
-    const enablePlatformBrokerDOMSupport = isDomEnabledForPlatformAuth();
-
     logger.trace(
         "Has client allowed platform auth via DOM API: " +
             enablePlatformBrokerDOMSupport
     );
+
     let platformAuthProvider: IPlatformAuthHandler | undefined;
     try {
         if (enablePlatformBrokerDOMSupport) {
@@ -97,22 +100,6 @@ export async function getPlatformAuthProvider(
     return platformAuthProvider;
 }
 
-/**
- * Returns true if the DOM API support for platform auth is enabled in session storage
- * @returns boolean
- * @deprecated
- */
-export function isDomEnabledForPlatformAuth(): boolean {
-    let sessionStorage: Storage | undefined;
-    try {
-        sessionStorage = window[BrowserCacheLocation.SessionStorage];
-        // Mute errors if it's a non-browser environment or cookies are blocked.
-        return sessionStorage?.getItem(PLATFORM_AUTH_DOM_SUPPORT) === "true";
-    } catch (e) {
-        return false;
-    }
-}
-
 /**
  * Returns boolean indicating whether or not the request should attempt to use native broker
  * @param logger
@@ -127,6 +114,17 @@ export function isPlatformAuthAllowed(
     authenticationScheme?: AuthenticationScheme
 ): boolean {
     logger.trace("isPlatformAuthAllowed called");
+
+    // throw an error if allowPlatformBroker is not enabled and allowPlatformBrokerWithDOM is enabled
+    if (
+        !config.system.allowPlatformBroker &&
+        config.system.allowPlatformBrokerWithDOM
+    ) {
+        throw createClientConfigurationError(
+            ClientConfigurationErrorCodes.invalidPlatformBrokerConfiguration
+        );
+    }
+
     if (!config.system.allowPlatformBroker) {
         logger.trace(
             "isPlatformAuthAllowed: allowPlatformBroker is not enabled, returning false"

package/src/config/Configuration.ts

@@ -209,6 +209,10 @@ export type BrowserSystemOptions = SystemOptions & {
      * Flag to enable native broker support (e.g. acquiring tokens from WAM on Windows, MacBroker on Mac)
      */
     allowPlatformBroker?: boolean;
+    /**
+     * Flag to enable native broker support through DOM APIs in Edge
+     */
+    allowPlatformBrokerWithDOM?: boolean;
     /**
      * Sets the timeout for waiting for the native broker handshake to resolve
      */
@@ -357,6 +361,7 @@ export function buildConfiguration(
         asyncPopups: false,
         allowRedirectInIframe: false,
         allowPlatformBroker: false,
+        allowPlatformBrokerWithDOM: false,
         nativeBrokerHandshakeTimeout:
             userInputSystem?.nativeBrokerHandshakeTimeout ||
             DEFAULT_NATIVE_BROKER_HANDSHAKE_TIMEOUT_MS,

package/src/controllers/StandardController.ts

@@ -356,7 +356,8 @@ export class StandardController implements IController {
                     this.logger,
                     this.performanceClient,
                     initCorrelationId,
-                    this.config.system.nativeBrokerHandshakeTimeout
+                    this.config.system.nativeBrokerHandshakeTimeout,
+                    this.config.system.allowPlatformBrokerWithDOM
                 );
             } catch (e) {
                 this.logger.verbose(e as string);

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationChallengeMethodResult.ts

@@ -44,7 +44,6 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that verification is required.
      * @returns true if verification is required, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isVerificationRequired(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodVerificationRequiredState;
@@ -58,7 +57,6 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that registration is completed (fast-pass scenario).
      * @returns true if registration is completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodRegistrationCompletedState;
@@ -72,7 +70,6 @@ export class AuthMethodRegistrationChallengeMethodResult extends AuthFlowResultB
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is AuthMethodRegistrationChallengeMethodResult & {
         state: AuthMethodRegistrationFailedState;

package/src/custom_auth/core/auth_flow/jit/result/AuthMethodRegistrationSubmitChallengeResult.ts

@@ -41,7 +41,6 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
     /**
      * Checks if the result indicates that registration is completed.
      * @returns true if registration is completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted(): this is AuthMethodRegistrationSubmitChallengeResult & {
         state: AuthMethodRegistrationCompletedState;
@@ -55,7 +54,6 @@ export class AuthMethodRegistrationSubmitChallengeResult extends AuthFlowResultB
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is AuthMethodRegistrationSubmitChallengeResult & {
         state: AuthMethodRegistrationFailedState;

package/src/custom_auth/core/auth_flow/jit/state/AuthMethodRegistrationState.ts

@@ -123,8 +123,8 @@ abstract class AuthMethodRegistrationState<
                 );
             }
         } catch (error) {
-            this.stateParameters.logger.error(
-                "Failed to challenge authentication method for auth method registration.",
+            this.stateParameters.logger.errorPii(
+                `Failed to challenge authentication method for auth method registration. Error: ${error}.`,
                 this.stateParameters.correlationId
             );
             return AuthMethodRegistrationChallengeMethodResult.createWithError(
@@ -146,7 +146,6 @@ export class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationS
     /**
      * Gets the available authentication methods for registration.
      * @returns Array of available authentication methods.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getAuthMethods(): AuthenticationMethod[] {
         return this.stateParameters.authMethods;
@@ -156,7 +155,6 @@ export class AuthMethodRegistrationRequiredState extends AuthMethodRegistrationS
      * Challenges an authentication method for registration.
      * @param authMethodDetails The authentication method details to challenge.
      * @returns Promise that resolves to AuthMethodRegistrationChallengeMethodResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async challengeAuthMethod(
         authMethodDetails: AuthMethodDetails
@@ -177,7 +175,6 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
     /**
      * Gets the length of the expected verification code.
      * @returns The code length.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getCodeLength(): number {
         return this.stateParameters.codeLength;
@@ -186,7 +183,6 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
     /**
      * Gets the channel through which the challenge was sent.
      * @returns The challenge channel (e.g., "email").
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getChannel(): string {
         return this.stateParameters.challengeChannel;
@@ -195,7 +191,6 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
     /**
      * Gets the target label indicating where the challenge was sent.
      * @returns The challenge target label (e.g., masked email address).
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getSentTo(): string {
         return this.stateParameters.challengeTargetLabel;
@@ -205,7 +200,6 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
      * Submits the verification challenge to complete the authentication method registration.
      * @param code The verification code entered by the user.
      * @returns Promise that resolves to AuthMethodRegistrationSubmitChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async submitChallenge(
         code: string
@@ -250,8 +244,8 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
                 accountInfo
             );
         } catch (error) {
-            this.stateParameters.logger.error(
-                "Failed to submit auth method challenge.",
+            this.stateParameters.logger.errorPii(
+                `Failed to submit auth method challenge. Error: ${error}.`,
                 this.stateParameters.correlationId
             );
             return AuthMethodRegistrationSubmitChallengeResult.createWithError(
@@ -264,7 +258,6 @@ export class AuthMethodVerificationRequiredState extends AuthMethodRegistrationS
      * Challenges a different authentication method for registration.
      * @param authMethodDetails The authentication method details to challenge.
      * @returns Promise that resolves to AuthMethodRegistrationChallengeMethodResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async challengeAuthMethod(
         authMethodDetails: AuthMethodDetails

package/src/custom_auth/core/auth_flow/mfa/result/MfaRequestChallengeResult.ts

@@ -36,7 +36,6 @@ export class MfaRequestChallengeResult extends AuthFlowResultBase<
     /**
      * Checks if the result indicates that verification is required.
      * @returns true if verification is required, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isVerificationRequired(): this is MfaRequestChallengeResult & {
         state: MfaVerificationRequiredState;
@@ -47,7 +46,6 @@ export class MfaRequestChallengeResult extends AuthFlowResultBase<
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is MfaRequestChallengeResult & {
         state: MfaFailedState;

package/src/custom_auth/core/auth_flow/mfa/result/MfaSubmitChallengeResult.ts

@@ -37,7 +37,6 @@ export class MfaSubmitChallengeResult extends AuthFlowResultBase<
     /**
      * Checks if the MFA flow is completed successfully.
      * @returns true if completed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isCompleted(): this is MfaSubmitChallengeResult & {
         state: MfaCompletedState;
@@ -48,7 +47,6 @@ export class MfaSubmitChallengeResult extends AuthFlowResultBase<
     /**
      * Checks if the result is in a failed state.
      * @returns true if the result is failed, false otherwise.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isFailed(): this is MfaSubmitChallengeResult & {
         state: MfaFailedState;

package/src/custom_auth/core/auth_flow/mfa/state/MfaState.ts

@@ -31,7 +31,6 @@ abstract class MfaState<
      * Requests an MFA challenge for a specific authentication method.
      * @param authMethodId The authentication method ID to use for the challenge.
      * @returns Promise that resolves to MfaRequestChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async requestChallenge(
         authMethodId: string
@@ -101,7 +100,6 @@ export class MfaAwaitingState extends MfaState<MfaAwaitingStateParameters> {
     /**
      * Gets the available authentication methods for MFA.
      * @returns Array of available authentication methods.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getAuthMethods(): AuthenticationMethod[] {
         return this.stateParameters.authMethods;
@@ -121,7 +119,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the length of the code that the user needs to provide.
      * @returns The expected code length.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getCodeLength(): number {
         return this.stateParameters.codeLength;
@@ -130,7 +127,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the channel through which the challenge was sent.
      * @returns The challenge channel (e.g., "email").
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getChannel(): string {
         return this.stateParameters.challengeChannel;
@@ -139,7 +135,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
     /**
      * Gets the target label indicating where the challenge was sent.
      * @returns The challenge target label (e.g., masked email address).
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     getSentTo(): string {
         return this.stateParameters.challengeTargetLabel;
@@ -149,7 +144,6 @@ export class MfaVerificationRequiredState extends MfaState<MfaVerificationRequir
      * Submits the MFA challenge (e.g., OTP code) to complete the authentication.
      * @param challenge The challenge code (e.g., OTP code) entered by the user.
      * @returns Promise that resolves to MfaSubmitChallengeResult.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     async submitChallenge(
         challenge: string

package/src/custom_auth/sign_in/auth_flow/result/SignInResult.ts

@@ -83,7 +83,6 @@ export class SignInResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -96,7 +95,6 @@ export class SignInResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInResult & { state: MfaAwaitingState } {
         return this.state.stateType === MFA_AWAITING_STATE_TYPE;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitCodeResult.ts

@@ -57,7 +57,6 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInSubmitCodeResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -70,7 +69,6 @@ export class SignInSubmitCodeResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInSubmitCodeResult & {
         state: MfaAwaitingState;

package/src/custom_auth/sign_in/auth_flow/result/SignInSubmitPasswordResult.ts

@@ -54,7 +54,6 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires authentication method registration.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isAuthMethodRegistrationRequired(): this is SignInSubmitPasswordResult & {
         state: AuthMethodRegistrationRequiredState;
@@ -67,7 +66,6 @@ export class SignInSubmitPasswordResult extends AuthFlowResultBase<
 
     /**
      * Checks if the result requires MFA.
-     * @warning This API is experimental. It may be changed in the future without notice. Do not use in production applications.
      */
     isMfaRequired(): this is SignInSubmitPasswordResult & {
         state: MfaAwaitingState;

package/src/interaction_client/PopupClient.ts

@@ -243,7 +243,7 @@ export class PopupClient extends StandardInteractionClient {
         validRequest.platformBroker = isPlatformBroker;
 
         if (this.config.auth.protocolMode === ProtocolMode.EAR) {
-            return this.executeEarFlow(validRequest, popupParams);
+            return this.executeEarFlow(validRequest, popupParams, pkceCodes);
         } else {
             return this.executeCodeFlow(validRequest, popupParams, pkceCodes);
         }
@@ -389,7 +389,8 @@ export class PopupClient extends StandardInteractionClient {
      */
     async executeEarFlow(
         request: CommonAuthorizationUrlRequest,
-        popupParams: PopupParams
+        popupParams: PopupParams,
+        pkceCodes?: PkceCodes
     ): Promise<AuthenticationResult> {
         const correlationId = request.correlationId;
         // Get the frame handle for the silent request
@@ -413,9 +414,20 @@ export class PopupClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkce =
+            pkceCodes ||
+            (await invokeAsync(
+                generatePkceCodes,
+                PerformanceEvents.GeneratePkceCodes,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(this.performanceClient, this.logger, correlationId));
+
         const popupRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkce.challenge,
         };
         const popupWindow =
             popupParams.popup || this.openPopup("about:blank", popupParams);
@@ -451,25 +463,65 @@ export class PopupClient extends StandardInteractionClient {
             this.logger
         );
 
-        return invokeAsync(
-            Authorize.handleResponseEAR,
-            PerformanceEvents.HandleResponseEar,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            popupRequest,
-            serverParams,
-            ApiId.acquireTokenPopup,
-            this.config,
-            discoveredAuthority,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        if (!serverParams.ear_jwe && serverParams.code) {
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )({
+                serverTelemetryManager: this.initializeServerTelemetryManager(
+                    ApiId.acquireTokenPopup
+                ),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+
+            return invokeAsync(
+                Authorize.handleResponseCode,
+                PerformanceEvents.HandleResponseCode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                popupRequest,
+                serverParams,
+                pkce.verifier,
+                ApiId.acquireTokenPopup,
+                this.config,
+                authClient,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        } else {
+            return invokeAsync(
+                Authorize.handleResponseEAR,
+                PerformanceEvents.HandleResponseEar,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                popupRequest,
+                serverParams,
+                ApiId.acquireTokenPopup,
+                this.config,
+                discoveredAuthority,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        }
     }
 
     async executeCodeFlowWithPost(

package/src/interaction_client/RedirectClient.ts

@@ -272,11 +272,24 @@ export class RedirectClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
+
         const redirectRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
-        this.browserStorage.cacheAuthorizeRequest(redirectRequest);
+
+        this.browserStorage.cacheAuthorizeRequest(
+            redirectRequest,
+            pkceCodes.verifier
+        );
 
         const form = await Authorize.getEARForm(
             document,

package/src/interaction_client/SilentIframeClient.ts

@@ -235,9 +235,17 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.performanceClient,
             correlationId
         )();
+        const pkceCodes = await invokeAsync(
+            generatePkceCodes,
+            PerformanceEvents.GeneratePkceCodes,
+            this.logger,
+            this.performanceClient,
+            correlationId
+        )(this.performanceClient, this.logger, correlationId);
         const silentRequest = {
             ...request,
             earJwk: earJwk,
+            codeChallenge: pkceCodes.challenge,
         };
         const msalFrame = await invokeAsync(
             initiateEarRequest,
@@ -279,25 +287,66 @@ export class SilentIframeClient extends StandardInteractionClient {
             correlationId
         )(responseString, responseType, this.logger);
 
-        return invokeAsync(
-            Authorize.handleResponseEAR,
-            PerformanceEvents.HandleResponseEar,
-            this.logger,
-            this.performanceClient,
-            correlationId
-        )(
-            silentRequest,
-            serverParams,
-            this.apiId,
-            this.config,
-            discoveredAuthority,
-            this.browserStorage,
-            this.nativeStorage,
-            this.eventHandler,
-            this.logger,
-            this.performanceClient,
-            this.platformAuthProvider
-        );
+        if (!serverParams.ear_jwe && serverParams.code) {
+            // If server doesn't support EAR, they may fallback to auth code flow instead
+            const authClient = await invokeAsync(
+                this.createAuthCodeClient.bind(this),
+                PerformanceEvents.StandardInteractionClientCreateAuthCodeClient,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )({
+                serverTelemetryManager: this.initializeServerTelemetryManager(
+                    this.apiId
+                ),
+                requestAuthority: request.authority,
+                requestAzureCloudOptions: request.azureCloudOptions,
+                requestExtraQueryParameters: request.extraQueryParameters,
+                account: request.account,
+                authority: discoveredAuthority,
+            });
+
+            return invokeAsync(
+                Authorize.handleResponseCode,
+                PerformanceEvents.HandleResponseCode,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                pkceCodes.verifier,
+                this.apiId,
+                this.config,
+                authClient,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        } else {
+            return invokeAsync(
+                Authorize.handleResponseEAR,
+                PerformanceEvents.HandleResponseEar,
+                this.logger,
+                this.performanceClient,
+                correlationId
+            )(
+                silentRequest,
+                serverParams,
+                this.apiId,
+                this.config,
+                discoveredAuthority,
+                this.browserStorage,
+                this.nativeStorage,
+                this.eventHandler,
+                this.logger,
+                this.performanceClient,
+                this.platformAuthProvider
+            );
+        }
     }
 
     /**