Are Azure Application Client ID's safe to store in the frontend?

user_2304170 0
Viewed 555

On the Microsoft website they have multiple examples on how to use msal to authenticate users to the Azure AD within an SPA. In all these examples the Application (client) ID is stored in plain text in the code or in a simple .json file.

My question, given that everything stored in the front end is considered to be public, is it bad practice to simply store the app configuration like Azure (client) ID in a json file? Or would this be better stored in a .env file?

These are the details the app would need to function:

AZURE_APP_CLIENT_ID=""
AZURE_APP_AUTHORITY=""
AZURE_APP_REDIRECT_URI=""
AZURE_APP_POST_LOGOUT_REDIRECT_URI=""

API_URI=""
API_AZURE_EXPOSED_SCOPE=""
single-page-application vue.js azure security javascript
1 Answers

Well, the OAuth RFC defines it as not a secret: https://www.rfc-editor.org/rfc/rfc6749#section-2.2

The client identifier is not a secret; it is exposed to the resource owner and MUST NOT be used alone for client authentication.

The client id will be visible in the URL anyway when the user signs in. Storing it in front-end is totally fine.

All of these things are visible in the URL when the user logs in:

  • Azure AD tenant id
  • App client id
  • Scopes the application is requesting (which can include client ids/app ID URIs of APIs in your AAD)
  • App redirect URI
user_16589060
Related