title: ClientAuthError: Token calls are blocked in hidden iframes
body: <p>I'm building a javascript SPA using MSAL.js as a client for Azure Active Directory.</p>
  
  <p>When requesting an access token for my API as such</p>
  
  <pre><code>var requestObj = {
    scopes: ["api://MyApi/Access"]
  };
  msalUserAgent.acquireTokenSilent(requestObj ) 
  </code></pre>
  
  <p>Msal internally creates itself an iframe to handle the request and then gives the following error about operating inside an iframe being unsupported:</p>
  
  <pre><code>ClientAuthError: Token calls are blocked in hidden iframes
      at ClientAuthError.AuthError [as constructor] (webpack-internal:///./node_modules/msal/lib-es6/error/AuthError.js:26:28)
      at new ClientAuthError (webpack-internal:///./node_modules/msal/lib-es6/error/ClientAuthError.js:111:28)
      at Function.ClientAuthError.createBlockTokenRequestsInHiddenIframeError (webpack-internal:///./node_modules/msal/lib-es6/error/ClientAuthError.js:192:16)
      at Function.WindowUtils.blockReloadInHiddenIframes (webpack-internal:///./node_modules/msal/lib-es6/utils/WindowUtils.js:206:90)
      at eval (webpack-internal:///./node_modules/msal/lib-es6/UserAgentApplication.js:474:77)
      at new Promise (&lt;anonymous&gt;)
      at UserAgentApplication.acquireTokenSilent (webpack-internal:///./node_modules/msal/lib-es6/UserAgentApplication.js:472:16)
      at Object.ensureUserLoggedIn (webpack-internal:///./src/services/ActiveDirectoryService.js:93:19)
      at eval (webpack-internal:///./src/main.js:36:89)
      at Module../src/main.js (http://localhost:8080/js/app.js:1178:1)
  </code></pre>
  
  <p>My Webpage still seems to work as expected but I really not comfortable carrying unresolved errors so I'm trying to get to the cause of the issue.</p>
  
  <p>In trying to resolve this <a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/1194" rel="noreferrer">I have found this issue on github</a>  which looks a lot like my issue.  It confirms that acquireTokenSilent does create an iFrame which redirects back to the main spa application (which then tries to log in and request a token ... so basically an endless recursion). which is why it is blocked.</p>
  
  <p>One of the suggestions is to specify a redirectUri as a page which doesn't have MSAL which I tried, unsuccessfully like this</p>
  
  <pre><code> request = {
        scopes:  ["api://MyApi/Access"],
        redirectUri: "http://localhost:8080/token-landing.html"
      };
      // }
      return msalUserAgent.acquireTokenSilent(request);
  </code></pre>
  
  <p>This hasn't solved the issue and its hard to see if the redirect is even used.  Other suggestions are to check for a '#' in the url everywhere I try and acquire a token which isn't great as '#' is quite common in SPA websites.</p>