I have an SPA, where the user will login using Microsoft Entra using authorization code flow. Client is public, so I registered my app as SPA client, following Microsoft oath code flow documentation. Let’s assume I have no API in this project, because I want to use public flow and the API should not be needed since we are using PKCE instead of client secret.
To obtain the token:
- I’m generating PKCE (challenge and verifier) and then requesting authorization code from
https://login.microsoftonline.com/[my tenant id]/oauth2/v2.0/authorize
sending
- client_id=[my client id]
- response_type=code
- redirect_uri=[same as registered in entra]
- response_mode=query
- scope=.default
- code_challenge=[generated challenge]
- code_challenge_method=S256
So far so good. Im receiving auth code at the given URL. Now I would like to exchange
- I’m trying to excange obtained auth code for the token, senting POST request at token endpoint:
https://login.microsoftonline.com/[my tenant id]/oauth2/v2.0/token
sending
- client_id=[my client id]
- code=[obtained code]
- redirect_uri=[same as registered in entra]
- grant_type=authorization_code
- code_verifier=[generated verifier matching challenge]
Now the issue I’m facing is that login endpoint suprisingly returns CORS error, stating cross-origin requests are
Now, If I send the code along with verifier tofrom POSTMAN, setting manually “origin” header to my domain – microsoft endpoint is returning token.
Without origin header, as expected “Tokens issued for the ‘Single-Page Application’ client-type may only be redeemed via cross-origin requests.” error is returned.
So MS is telling me – you cant use cross origin request but you have to use cross origin request?
I was trying to check out some samples from microsoft github or even MSAL library, but npm wont even install the modules since they’re all either deprecated or working with some old node versions (14-15 or so).
I was integrating many OAuth2 SSO’s including google, using implicit grands and code flows, buth never have I faced the issue like here. Why is it working from postman with origin set to my domain but not from the domain itself in browser? I’ve checked in chrome tools and all the headers sent to the token endpoint are set correctly (origin, referer etc.)
Have anyone faced simmilar issue? I dont want to change the flow or register confidentail web api client to be intermediate party in the whole proces as it should not be needed.
Some advice how to deal with those CORS errors, or maybe there is anything else to know about going with oauth using Microsoft login?