Code flow PKCE with OIDC and Azure AD get cors error on /token endpoint

Question

I saw that the new recommendations (since mid 2019) is to use code flow with PKCE instead of the implicit flow for SPAs. I have an angular spa that uses OIDC client and works fine until it calls the /token endpoint that return a cors error

Access to XMLHttpRequest at 'https://login.microsoftonline.com/xxx/oauth2/token' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested

Is there a way to overcome this error or is there a way to configure Allowed Origins (CORS) in Azure AD or am I doing something wrong?

user_10504999 · Answer

There is no way to configure Allowed Origins in Azure AD.

So there are two solutions for you:

1.Use MSAL.js with Azure AD B2C.

2.Call the /token endpoint in your server, then you can makes the request to your server.

Reference:

No 'Access-Control-Allow-Origin' header with Microsoft Online Auth

Code flow PKCE with OIDC and Azure AD get cors error on /token endpoint

1 Answers