How can I secure SPA and Azure Function with single Azure AD app registration

Viewed 222

Background

I'm currently using Azure Functions v3.0 and MSAL Angular v2.0

I set up my Azure function AD registration using the express setup.

Callbacks were added automatically for function app, I've added a new one for the angular SPA. Only id token flow enabled.

The SPA logs in successfully, and acquires a JWT Bearer token

Directly accessing the function app also results in a correct login, and returns a session cookie

Question

The difficulty arises in trying to get the function app to accept the bearer token from the SPA app, should this be possible, or do I need to somehow exchange the bearer token for a session token

0 Answers
Related