0

I have a frontend angular application that I am running from localhost:4200 Call to token endpoint works fine in postman but fails in angular code with all required credentials, returning Status code 400 Error "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application". Any help will be appreciated.

import { Injectable } from '@angular/core';
import { HttpClient, HttpHeaders } from '@angular/common/http';

@Injectable({
  providedIn: 'root'
})
export class AuthService {
  private accessToken: string;

  constructor(private http: HttpClient) {}

  getAccessToken(): string {
    return this.accessToken;
  }

  setAccessToken(token: string): void {
    this.accessToken = token;
  }

  authenticate(): void {
    // Replace 'YOUR_AUTH_SERVER_URL' with the actual URL of your authorization server
    const authServerUrl = 'YOUR_AUTH_SERVER_URL';
    const clientId = 'YOUR_CLIENT_ID';
    const redirectUri = window.location.origin;
    const responseType = 'code';
    const scope = 'openid profile'; // Replace with the required scopes

    const body = new URLSearchParams();
    body.set('client_id', clientId);
    body.set('redirect_uri', redirectUri);
    body.set('response_type', responseType);
    body.set('scope', scope);

    const httpOptions = {
      headers: new HttpHeaders({
        'Content-Type': 'application/x-www-form-urlencoded'
      })
    };

    this.http.post<any>(authServerUrl, body.toString(), httpOptions).subscribe(
      (response) => {
        // Assuming the response contains the authorization code in the 'code' property
        const authorizationCode = response && response.code;
        if (authorizationCode) {
          this.exchangeCodeForToken(authorizationCode);
        } else {
          console.error('Invalid response format:', response);
          // Handle error or unexpected response format as per your application's requirements
        }
      },
      (error) => {
        console.error('Authentication error:', error);
        // Handle error as per your application's requirements
      }
    );
  }


  private exchangeCodeForToken(code: string): void {
    // Replace 'YOUR_TOKEN_SERVER_URL' with the actual URL of your token server
    const tokenServerUrl = 'YOUR_TOKEN_SERVER_URL';
    const clientId = 'YOUR_CLIENT_ID';
    const clientSecret = 'YOUR_CLIENT_SECRET'; // Only needed if your server requires it
    const grantType = 'authorization_code';

    const body = new URLSearchParams();
    body.set('client_id', clientId);
    body.set('code', code);
    body.set('grant_type', grantType);
    // Add client secret if needed
    if (clientSecret) {
      body.set('client_secret', clientSecret);
    }

    const httpOptions = {
      headers: new HttpHeaders({
        'Content-Type': 'application/x-www-form-urlencoded'
      })
    };

    this.http.post<any>(tokenServerUrl, body.toString(), httpOptions).subscribe(
      (response) => {
        // Assuming the response contains the access token in the 'access_token' property
        const accessToken = response && response.access_token;
        if (accessToken) {
          this.setAccessToken(accessToken);
          // Optionally, you can redirect or perform other actions upon successful authentication.
        } else {
          console.error('Invalid response format:', response);
          // Handle error or unexpected response format as per your application's requirements
        }
      },
      (error) => {
        console.error('Token exchange error:', error);
        // Handle error as per your application's requirements
      }
    );
  }
}
Jcide
  • 141
  • 1
  • 5
  • Looks like [this answer](https://stackoverflow.com/questions/68267585/token-generation-from-azure-ad-fails-with-error-aadsts9002326) provides a resolution. – Gary Archer Jul 26 '23 at 17:48

0 Answers0