search

GillesZunino / insomnia-plugin-azure-ad-authentication

Insomnia plugin to acquire Azure AD access tokens
MIT License
11 stars 3 forks source link

Support `https` redirect URL #13

Open Jandev opened 1 month ago

Jandev commented 1 month ago

In Entra ID using non-https for the Redirect URI is prohibited (well, on the tenants I'm in at least). It would be great if it's possible to add support for https Redirect URIs.

There's probably a reason why this isn't supported (yet).

People can probably circumvent this by using a service like ngrok to unblock, but that's not a very secure practice.

GillesZunino commented 1 month ago

MSAL Node requires the return url to be accessible from Insomnia at the time of authentication. Enabling HTTPS would mean an SSL certificate would need to be created and trusted by the browser, on all platforms. This can be complicated and presenting a "certificate not trusted" is a poor user experience.

I believe http redirects can be added via manifest and I am not aware of a way to change it. I could be wrong though. I realize that we are potentially in the same tenant ;-)

Jandev commented 1 month ago

I believe http redirects can be added via manifest

I did not know this would circumvent the validation, will try!

Enabling HTTPS would mean an SSL certificate would need to be created and trusted by the browser, on all platforms. This can be complicated and presenting a "certificate not trusted" is a poor user experience.

This is indeed the reason I expected. Perhaps using a self-signed certificate can be used and (partly) disable the certificate validation, but that's sub-optimal, indeed.

For now I'll try modifying the manifest itself and think about it if I/we really want that.