CODEWITHSUNDEEP
oauth-2.0openid-connectazure-ad-b2c
EchoRo
EchoRo

Reputation: 119

Code flow PKCE with OIDC and Azure AD get cors error on /token endpoint

I saw that the new recommendations (since mid 2019) is to use code flow with PKCE instead of the implicit flow for SPAs. I have an angular spa that uses OIDC client and works fine until it calls the /token endpoint that return a cors error 

Access to XMLHttpRequest at 'https://login.microsoftonline.com/xxx/oauth2/token' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested

Is there a way to overcome this error or is there a way to configure Allowed Origins (CORS) in Azure AD or am I doing something wrong?

Upvotes: 3

Views: 1681

Answers (1)

Tony Ju
Tony Ju

Reputation: 15609

There is no way to configure Allowed Origins in Azure AD.

So there are two solutions for you:

1.Use MSAL.js with Azure AD B2C.

2.Call the /token endpoint in your server, then you can makes the request to your server.

Reference:

No 'Access-Control-Allow-Origin' header with Microsoft Online Auth

Upvotes: 2

Related Questions