id_token left in the browser's url fragment when testing locally

[husseinkorly]

This is only happens when I'm testing my Angular app locally. After the user logs in and get redirected back to the app, I can see the id_token appears in the url !! I know is not safe to leave the token in the browser url's fragment. I'm using Fiddler to remap the request to my localhost. I'm not sure if this happening because of Fiddler, DevServer, or I'm doing something wrong when using adal !!! I'm not calling anything after authService.login()

[nikhilsarvaiye]

i have also observed the same issue

[nehaagrawal]

@husseinkorly can you please confirm when this happens what is the value of navigateToLoginRequestUrl? default value of navigateToLoginRequestUrl is true.

[SaifAsad]

Experiencing the same issue,

using adal.min.js CDN 1.0.17 with react app (bootstraped with create react app), this only happens on production, the id token is left in the url without being handled by handleWindowCallback

below is a snippet of the code that I have in an AuthStore class constructor (this class controls all auth related operations) `
window.adalInstance = new AuthenticationContext(config); window.adalInstance.isCallback(window.location.hash); window.adalInstance.handleWindowCallback();

`

[jmckennon]

@SaifAsad @husseinkorly if you're still seeing this issue, can you elaborate by providing some more code, like showing the config being passed into AuthenticationContext, and also give some information about how you've configured the Azure portal? adal js is still supported only for security fixes, which this may apply.

Otherwise, we recommend moving to the msal js library here for advanced support, features, and bugfixes.

[jasonnutter]

Closing due to inactivity.