search

Azure-Samples / ms-identity-javascript-v2

VanillaJS sample using MSAL.js v2.x and OAuth 2.0 Authorization Code Flow with PKCE on Microsoft identity platform
MIT License
105 stars 84 forks source link

Configuration script registers a web app; needs to register a SPA #30

Closed BobGerman closed 3 years ago

BobGerman commented 3 years ago

Please follow the issue template below. Failure to do so will result in a delay in answering your question.

Library

Important: Please fill in your exact version number above, e.g. msal@2.1.3.

Framework

Description

The sample application ms-identity-javascript-2 works if the app is registered manually but the provided Configuration.ps1 script will cause the app to fail with a CORS error. This is because the script registers a web app and not a Single Page Application.

Error Message

When running the app with the incorrectly configured app registration, this error appears in the browser console:

Access to fetch at 'https://login.microsoftonline.com/common/oauth2/v2.0/token' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Security

Regression

Version:

MSAL Configuration

// Provide configuration values here.
// For Azure B2C issues, please include your policies.

Reproduction steps

Use the sample following the instructions in the AppCreationScripts folder, and running the supplied Configure.ps1 script before executing the application. In this case, the application logs the user in but fails to provide an access token. No information is displayed on the web page and the error above appears in the browser console.

Expected behavior

The application should succeed and display information from the Microsoft graph

Browsers/Environment

derisen commented 3 years ago

@BobGerman This is a known issue. Unfortunately the current version of Azuer AD ps module is not capable of specifying app type.

For the moment we display a message: "Navigate to the Manifest page, find the 'replyUrlsWithType' section and change the type of redirect URI to 'Spa'"

derisen commented 3 years ago

We added this to backlog and working on an alternative system. Closing for now as no further action to take.