3

I saw that the new recommendations (since mid 2019) is to use code flow with PKCE instead of the implicit flow for SPAs. I have an angular spa that uses OIDC client and works fine until it calls the /token endpoint that return a cors error 

Access to XMLHttpRequest at 'https://login.microsoftonline.com/xxx/oauth2/token' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested

Is there a way to overcome this error or is there a way to configure Allowed Origins (CORS) in Azure AD or am I doing something wrong?

EchoRo
  • 119
  • 1
  • 11

1 Answers1

2

There is no way to configure Allowed Origins in Azure AD.

So there are two solutions for you:

1.Use MSAL.js with Azure AD B2C.

2.Call the /token endpoint in your server, then you can makes the request to your server.

Reference:

No 'Access-Control-Allow-Origin' header with Microsoft Online Auth

Tony Ju
  • 14,891
  • 3
  • 17
  • 31
  • this no longer holds true. According to MS doc you can simply set your app as SPA and the CORS issue will be gone. https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#redirect-uri-setup-required-for-single-page-apps – WolfRevo Jun 23 '21 at 15:36