Wed, 18 Jan 2023 00:33:04 GMT

Minor changes

• Adding page visibility change event for silent calls like AcquireTokenSilent #5555 (kshabelko@microsoft.com)

Patches

• Add startPerformanceMeasurement to IPerformanceClient #5583 (joarroyo@microsoft.com)
• Revert typo changes #5582 (joarroyo@microsoft.com)
• Match long domain names #5581 (kshabelko@microsoft.com)
• • Remove lookBehind regex as not compatible with Safari browser. #5551 (kshabelko@microsoft.com)
• add claims to request body in OBO class #5493 (v-ssalem@microsoft.com)

Mon, 09 Jan 2023 22:44:58 GMT

Patches

• Fix cache credential look-up (#5484) (kshabelko@microsoft.com)
• fix logger explicitly set to undefined error #5355 (bmahal@microsoft.com)
• http version telemetry data #5211 (bmahal@microsoft.com)
• fix typos #5531 (bmahal@microsoft.com)

Wed, 07 Dec 2022 16:53:07 GMT

Patches

• Fixed Typo in Authority Logs #5430 (rginsburg@microsoft.com)
• Improvement to Cloud Instance Discovery #5448 (rginsburg@microsoft.com)

Mon, 21 Nov 2022 19:14:45 GMT

Major changes

• Added logging to Authority class (rginsburg@microsoft.com)

Mon, 07 Nov 2022 22:46:55 GMT

Major changes

• Add static fields to telemetry #5224 (thomas.norling@microsoft.com)

Patches

• Add MATS fields to telemetry #5308 (thomas.norling@microsoft.com)

Mon, 10 Oct 2022 22:27:03 GMT

Minor changes

• Include refresh token in ExternalTokenResponse #5233 (louisv@microsoft.com)

Patches

• Fixed broken homeAccountId check in CacheManager #5246 (rginsburg@microsoft.com)

Mon, 03 Oct 2022 22:12:26 GMT

Minor changes

• Add x-ms-request-id to perf telemetry logging #5244 (joarroyo@microsoft.com)
• Added 'no_session' to prompt enum #5131 (rginsburg@microsoft.com)
• Added Support for the OIDC max_age parameter #5125 (rginsburg@microsoft.com)
• Add initial support for legacy authorities in MSAL Common #5212 (hemoral@microsoft.com)

Patches

• Implemented Cache Lookup Policy for acquireTokenSilent #5014 (rginsburg@microsoft.com)
• Include Refresh token size in perf telemetry data #5250 (bmahal@microsoft.com)

Mon, 12 Sep 2022 18:19:32 GMT

Patches

• Exporting constants #5189 (lalimasharda@microsoft.com)

Fri, 02 Sep 2022 18:06:53 GMT

Minor changes

• Exposed raw id token on account info objects #5036 (rginsburg@microsoft.com)
• Export ClientInfo APIs #6886 (lalimasharda@microsoft.com)
• Add query string parsing helpers #5062 (thomas.norling@microsoft.com)

Mon, 01 Aug 2022 22:22:35 GMT

Minor changes

• adding network performance measurement #4834 (ellymakuba@microsoft.com)

Patches

• Add error handling for server errors in device-code (#5033) (sameera.gajjarapu@microsoft.com)
• Send login_hint claim instead of sid if available #4990 (janutter@microsoft.com)

Mon, 18 Jul 2022 23:26:21 GMT

Minor changes

• Add local cache support for JS-WAM bridge #4971 (sameera.gajjarapu@microsoft.com)
• Added new token size field in perf telemetry data #4973 (bmahal@microsoft.com)
• support caching rt flow response in migration scenarios (#4844) (v-derisen@microsoft.com)
• App Token Provider extensibiliy for AzureSDK (bogavril@microsoft.com)

Patches

• Fix bug with activeAccount when two accounts have same local account id #5004 (t-ssummers@microsoft.com)

Tue, 05 Jul 2022 22:37:04 GMT

Minor changes

• feat: adding authority metadata resiliency #4536 (samuelkamau@microsoft.com)
• Add jwks_uri to Authority, OpenIdConfigResponse, and AuthorityMetadataEntity #4905 (joarroyo@microsoft.com)

Patches

• Add InteractionRequired error for native account unavailable #4951 (thomas.norling@microsoft.com)

7.0.0

Wed, 23 Sep 2026 15:49:44 GMT

Major changes

• Remove responseMode from acquireTokenInteractive and require form_post for browser-loopback authentication #8852 (joarroyo@microsoft.com)

Minor changes

• Coalesce concurrent non-brokered and native broker silent token requests with matching parameters #8811 (kshabelko@microsoft.com)
• Deprecate responseMode for acquireTokenInteractive ahead of its removal in MSAL Node v7 #8851 (joarroyo@microsoft.com)

Mon, 06 Jun 2022 22:13:00 GMT

Minor changes

• Add PoP support for Encrypted Access Tokens #4730 (hemoral@microsoft.com)
• Add ability to set Client Assertion on a per-request basis #4806 (hemoral@microsoft.com)

Patches

• Fix password encoding on UsernamePassword flow #4807 (hemoral@microsoft.com)
• Add keyId to SHR header and make x5c_ca claim type string array #4729 (hemoral@microsoft.com)

Mon, 02 May 2022 22:23:33 GMT

Minor changes

• fix: Allow direct access to Identity Token Claims #4680 (1292510+svrooij@users.noreply.github.com)
• Add support for acquiring tokens from the native broker #4531 (thomas.norling@microsoft.com)

Patches

• acquireTokenByUsernamePassword will now return an id_token in Azure AD B2C #4694 (christian.kumpe@diva-e.com)

6.2.0

Fri, 28 Aug 2026 21:29:53 GMT

Minor changes

• Bump @azure/msal-browser to v5.20.0 (beachball)

Patches

• Bump @angular-devkit/build-angular to 22.1.x to pull patched http-proxy-middleware 4.2.0 (GHSA-gcq2-9pq2-cxqm) #8781 (lalima.sharda@gmail.com)

6.1.0

Tue, 18 Aug 2026 20:10:56 GMT

Minor changes

• Bump @azure/msal-browser to v5.19.0 (beachball)

6.0.0

Fri, 28 Aug 2026 21:29:53 GMT

Major changes

• [Breaking] Default acquireTokenInteractive responseMode to form_post and remove the deprecated loopbackClient option and ILoopbackClient interface (v6) #8779 (joarroyo@microsoft.com)
• Bump @azure/msal-common to v16.14.0 (beachball)

Minor changes

• Enable support for tenant_region_subscope optional claim #8765 (kshabelko@microsoft.com)
• Align node storage with explicit DPoP token-binding key manager wiring #8735 (hectormmg@microsoft.com)

Patches

• Validate Node consumers without DOM typings during type builds #8784 (hectormmg@microsoft.com)

Tue, 07 Dec 2021 00:17:01 GMT

Minor changes

• Add APIs needed for hybrid spa flow #3978 (janutter@microsoft.com)

Patches

• Fix circular dependencies in AuthenticationHeaderParser and AsyncMemoryStorage #4235 (hemoral@microsoft.com)

Mon, 01 Nov 2021 23:53:21 GMT

Minor changes

• Add support for ephemeral SSH certificate acquisition #4178 (hemoral@microsoft.com)
• Add support for SHR nonce #3999 (hemoral@microsoft.com)

Patches

• Log reason for cache miss #4199 (thomas.norling@microsoft.com)
• Update authority metadata error messages (thomas.norling@microsoft.com)
• Gracefully handle B2C ROPC policies not setting end_session_endpoint property #4173 (janutter@microsoft.com)

Mon, 04 Oct 2021 23:12:35 GMT

Patches

• Export library version #4124 (thomas.norling@microsoft.com)
• Consistently export error types and messages for errors thrown by MSAL #4117 (jagore@microsoft.com)
• Make no_tokens_found error an InteractionRequiredAuthError #4089 (thomas.norling@microsoft.com)

Tue, 07 Sep 2021 23:22:24 GMT

Major changes

• Add pop params to request thumbprint #3973 (hemoral@microsoft.com)
• Remove token binding key from key store when refreshing pop token #3500 (hemoral@microsoft.com)

Minor changes

• Adds state param to logout url #3909 (bmahal@microsoft.com)
• Add SignedHttpRequest class #3058 (janutter@microsoft.com)

Patches

• Add correlationId property to AuthError #3930 (thomas.norling@microsoft.com)
• Fix logger constructor #3899 (hemoral@microsoft.com)
• Add correlationId to AuthenticationResult type #3947 (thomas.norling@microsoft.com)
• Fix accesstoken_with_authscheme implementation #3910 (hemoral@microsoft.com)
• Add external token server response type #3895 (joarroyo@microsoft.com)
• Fixes unescaped backslash and inefficient regex patterns #3993 (thomas.norling@microsoft.com)

Mon, 02 Aug 2021 23:19:21 GMT

Patches

• Fix double encoding state #3903 (bmahal@microsoft.com)

Thu, 22 Jul 2021 22:50:22 GMT

Minor changes

• Adding ROPC for confidential client apps (#3838) (sameera.gajjarapu@microsoft.com)
• feat: add regional authority telemetry #3662 (samuelkamau@microsoft.com)
• Add support for prompt=create #3773 (joarroyo@microsoft.com)

Patches

• Add constant for active account cache key #3755 (thomas.norling@microsoft.com)
• Fix double query string for logout endpoint #3814 (thomas.norling@microsoft.com)

Mon, 28 Jun 2021 23:39:48 GMT

Minor changes

• Add CCS parameters to headers or form_data #3636 (prkanher@microsoft.com)
• Add correlationId to log messages #3601 (joarroyo@microsoft.com)

Patches

• Export ServerAuthorizationTokenResponse type #3657 (thomas.norling@microsoft.com)
• Discard tokens cached after current time #3786 (thomas.norling@microsoft.com)
• Remove input params from Empty Scopes error constructors #3654 (thomas.norling@microsoft.com)
• feat: modify the access token filter #3375 (samuelkamau@microsoft.com)
• fix: fix device code polling bug (samuelkamau@microsoft.com)

Wed, 12 May 2021 18:35:03 GMT

Minor changes

• add support for regional authorities (samuelkamau@microsoft.com)

Patches

• Fix double query string when authority endpoints contain query strings #3620 (thomas.norling@microsoft.com)
• change msal-browser/msal-common to preserveModules to enable treeshaking #3300 (oo.thomas96@gmail.com)
• Revert expiresOn type to make it nullable #3557 (hemoral@microsoft.com)
• Add logLevel Trace to Logger #3589 (joarroyo@microsoft.com)
• Throw untrustedAuthority error if discovery endpoint returns error in response body #3572 (thomas.norling@microsoft.com)
• Add claims comparison to accountInfoIsEqual function #3527 (thomas.norling@microsoft.com)
• Add check for empty object string in claims request parameter #3579 (prkanher@microsoft.com)

Thu, 22 Apr 2021 23:26:08 GMT

Patches

• Fix typing for expiresOn field (#2994) (prkanher@microsoft.com)
• Move /token headers to POST body to avoid OPTIONS request (#3094) (thomas.norling@microsoft.com)
• Change "ts" type from string to number in SignedHttpRequest #3474 (prkanher@microsoft.com)
• Add .browserslistrc #3471 (thomas.norling@microsoft.com)

Wed, 14 Apr 2021 18:39:53 GMT

Minor changes

• Adding the refresh_in feature for msal.js #3005 (prkanher@microsoft.com)
• Add support for AccessToken_With_AuthScheme credential type #3426 (hectormgdev@gmail.com)

Patches

• Make SHR parameters optional #3320 (hemoral@microsoft.com)

Wed, 31 Mar 2021 22:25:57 GMT

Patches

• Update StringUtils.matchPattern to account for queries in string #3307 (joarroyo@microsoft.com)
• Adds tokenQueryParameters request param #3309 (thomas.norling@microsoft.com)
• Ignore account hints when prompt=select_account #3315 (thomas.norling@microsoft.com)

Wed, 24 Mar 2021 22:55:46 GMT

Minor changes

• Add client claims support for SHRs (#3089) (hemoral@microsoft.com)

Patches

• Properly handle expiration timestamps when returned as strings (janutter@microsoft.com)
• Add null as possible type for account on EndSessionRequest #3044 (thomas.norling@microsoft.com)

Mon, 15 Mar 2021 23:45:17 GMT

Patches

• Use sid from account when available #3147 (prkanher@microsoft.com)
• Add network error for failed requests (#3146) (thomas.norling@microsoft.com)

Wed, 03 Mar 2021 21:47:05 GMT

Patches

• Fix OIDC Scopes Caching Issue (#3065) (prkanher@microsoft.com)

Thu, 18 Feb 2021 00:34:32 GMT

Patches

• Clarify Device Code Timeout units (#3031) (hemoral@microsoft.com)

Tue, 09 Feb 2021 01:48:22 GMT

Major changes

• Add API Extractor for msal-node (sameera.gajjarapu@microsoft.com)

Patches

• Fix version.json import errors (#2993) (thomas.norling@microsoft.com)
• Setting postLogoutRedirectUri as null will disable post logout redirect (janutter@microsoft.com)
• Ignore OIDC scopes during cache lookup or replacement (#2969) (prkanher@microsoft.com)

Tue, 02 Feb 2021 01:56:47 GMT

Minor changes

• Add wrapper SKU and version to current telemetry header (#2845) (thomas.norling@microsoft.com)

Patches

• Fix token timestamp calculation (prkanher@microsoft.com)
• Fix B2C policy switching (#2949) (thomas.norling@microsoft.com)
• Get package version from version.json (#2915) (thomas.norling@microsoft.com)

Thu, 21 Jan 2021 21:48:01 GMT

Major changes

• Authority metadata caching (#2758) (thomas.norling@microsoft.com)

Tue, 12 Jan 2021 00:51:26 GMT

Minor changes

• Add interface stubs (#2792) (thomas.norling@microsoft.com)

Patches

• Adding account info equality check function (#2728) (prkanher@microsoft.com)
• Adding device code timeout to the device code request(#2656) (samuel.kamau@microsoft.com)

Mon, 07 Dec 2020 22:19:03 GMT

Major changes

• Enable StrictNullChecks (#2602) (thomas.norling@microsoft.com)
• Rename request types and change required fields (#2512) (thomas.norling@microsoft.com)

Minor changes

• Add clone to Logger (#2670) (joarroyo@microsoft.com)
• Enable the instance_aware flow (#1804) (prkanher@microsoft.com)
• Support id_token_hint on logout request (#2587) (thomas.norling@microsoft.com)

Patches

• Fix login loop with empty query string (#2707) (thomas.norling@microsoft.com)
• Expose idTokenClaims on AccountInfo (#2554) (janutter@microsoft.com)
• Add matchPattern string util for wildcard matching for urls (#2678) (janutter@microsoft.com)
• fix: added missing async (AzureAD/microsoft-authentication-library-for-js#2652) (patrick@ruhkopf.me)
• Log messages contain package name and version (#2589) (thomas.norling@microsoft.com)

Wed, 11 Nov 2020 23:33:20 GMT

Patches

• Add getAbsolutePath helper function to UrlString class (#2560) (thomas.norling@microsoft.com)

Tue, 10 Nov 2020 01:48:44 GMT

Patches

• Enhance lookup for IdTokens/AppMetadata (#2530) (sameera.gajjarapu@microsoft.com)
• Add LocalAccountId for ADFS usecases (#2573) (sameera.gajjarapu@microsoft.com)

Sat, 07 Nov 2020 01:50:14 GMT

Minor changes

• Implement Password Grant Flow (#2204) (sameera.gajjarapu@microsoft.com)
• Fixing a bug and adding localAccountId in AccountInfo interface (#2516) (sameera.gajjarapu@microsoft.com)

Patches

• Mandate localAccount in AccountInfo (sameera.gajjarapu@microsoft.com)
• Filtered lookup of IdTokens, AppMetadata; Error handling in Node Storage (#2530) (sameera.gajjarapu@microsoft.com)

Mon, 26 Oct 2020 21:00:29 GMT

Patches

• Fix ServerTelemetry maxErrorToSend bug (#2491) (thomas.norling@microsoft.com)
• Add missing default headers to device code (sameera.gajjarapu@microsoft.com)
• msal-browser and msal-node cache Interfaces to msal-common updated (#2415) (sameera.gajjarapu@microsoft.com)

Tue, 20 Oct 2020 23:47:28 GMT

Patches

• Adds support for any OIDC-compliant authority (#2389). (jamckenn@microsoft.com)

Thu, 15 Oct 2020 00:49:18 GMT

Patches

• Removing unused errors in msal-common and fixing possible build errors in @azure/msal-common@1.6.0 (#2432) (sameera.gajjarapu@microsoft.com)

Wed, 14 Oct 2020 23:45:07 GMT

Minor changes

• Add support for persistence cache plugin (#2348) (sameera.gajjarapu@microsoft.com)

Patches

• Add Telemetry header size limit (#2223) (thomas.norling@microsoft.com)

Fri, 02 Oct 2020 17:42:35 GMT

Minor changes

• Implementation of Access Token Proof-of-Possession Flow (#2151, #2153, #2154, #2209, #2289) (prkanher@microsoft.com)

Wed, 23 Sep 2020 21:13:48 GMT

Minor changes

• FOCI - Family of Client IDs feature (#2201) (sameera.gajjarapu@microsoft.com)

Patches

• Remove null in function return types to be compatible with ICacheManager.ts (#2335) (sameera.gajjarapu@microsoft.com)
• Scopes stored case sensitive, compared case insensitive (#2302) (sameera.gajjarapu@microsoft.com)

Thu, 17 Sep 2020 23:16:22 GMT

Minor changes

• Add support for On-behalf-of flow (#2157) (sagonzal@microsoft.com)
• ValidCacheType adds ServerTelemetryEntity (sameera.gajjarapu@microsoft.com)
• Added client-side throttling to enhance server stability (#1907) (jamckenn@microsoft.com)

Patches

• Add name field to AccountInfo (#2288) (jamckenn@microsoft.com)
• Realm should fallback to an empty string for non AAD scenarios (sameera.gajjarapu@microsoft.com)
• Add default scopes in all requests and ignore in cache lookups (#2267) (thomas.norling@microsoft.com)
• Move refreshToken API to RefreshTokenClient (#2264) (thomas.norling@microsoft.com)
• Track Suberrors in Telemetry (#1921) (thomas.norling@microsoft.com)
• Separate cache lookup from token refresh (#2189) (thomas.norling@microsoft.com)

Tue, 25 Aug 2020 00:40:45 GMT

Minor changes

• Client Capabilities Support (#2169) (thomas.norling@microsoft.com)
• Add support for acquiring tokens with client credentials grant (sagonzal@microsoft.com)

Patches

• ignore offline_access in scopes lookup (sameera.gajjarapu@microsoft.com)
• Adds checks for cache entities (sameera.gajjarapu@microsoft.com)
• Add claims request to /token calls (#2138) (thomas.norling@microsoft.com)
• Fix Telemetry cacheHit Bug (#2170) (thomas.norling@microsoft.com)
• Get username from emails claim in B2C scenarios (#2114) (thomas.norling@microsoft.com)
• Update POST header to type Record (#2128) (thomas.norling@microsoft.com)

Thu, 13 Aug 2020 02:20:48 GMT

Patches

• knownAuthorities enhancements (#2106) (thomas.l.norling@gmail.com)
• Update typing of IdTokenClaims (#2105) (hemoral@microsoft.com)
• Fix hash parsing issue from #2118 and back button cache clearing (#2129) (prkanher@microsoft.com)

1.1.0

This project publishes no release notes. Between v1.0.0 and v1.1.0 there were 199 commits, 135 of them substantive:

• first blush
• merge from api integration
• adding tests
• working on tests, saving place
• telemetry event tests
• fix bugs and write tests
• merge
• Update Readmes to match dev branch
• Delete the /dist files from git
• Adding API comments
• Adding API comments
• Configure doc generate to exclude private and protected methods
• Update package.json
• Update package.json
• Update Readme preview message and links
• Fix isse with navigateToLoginUrl issue
• fix cases where request is undefined sending "state" to ServerRequestParameters
• More meaningful comments
• add a comment
• add a missed sid check when adding login_hint

…and 115 more.