CODEWITHSUNDEEP
reactjs.net-coreazure-active-directorysingle-page-applicationopenid-connect
John1990
John1990

Reputation: 1

Does anyone know how to set up OpenIdConnect Auth using Azure Active Directory and React SPA without storing access token in the broswer

I am trying to build an app where users can sign in using their work Microsoft account through open id connect. All of the documentation on Microsoft seems to suggest that for React/SPA apps you should use the MSAL library to authenticate users but this seems to cache the access tokens directly in the brower through session storage. To my knowledge this is bad practise and a backend for frontend approach should be used for this scenario instead where the access token is stored in a HTTP secure cookie.

Does anyone know how to do a backend for frontend type approach using Azure Active Directory? Is there support for this using Microsoft Api's or do I have to just write the code from scratch?

Thanks for any help

Upvotes: 0

Views: 614

Answers (1)

Gary Archer
Gary Archer

Reputation: 29301

You need to use a server side solution to issue application level secure cookies. It is not specific to Azure AD.

The Duende BFF solution is .NET based, and uses the web host, eg https://www.example.com, to issue cookies. See this code example and the docs.

It is also possible to issue cookies via a utility API that runs in a sibling domain of the SPA, eg https://api.example.com. This is a little more complex, but provides options such as deploying the SPA to a content delivery network - see this code example.

Upvotes: 1

Related Questions