Tagged cors
One entry carries the tag cors, newest first. All tags.
- How do I coordinate Microsoft Entra ID sign-in between a single-page app and a separately hosted backend API?
A bearer-token SPA runs MSAL.js itself and attaches its own access token to calls the API's CORS policy allows across origins - simplest to stand up, but every token lives in the browser. A backend-for-frontend (BFF) makes the backend the confidential OIDC client instead: it owns the redirect, keeps tokens server-side, and hands the SPA a same-origin cookie needing no CORS setup. Default to the BFF when the backend can own a session; reach for the bearer-token SPA only when the API also has to serve other, non-browser callers with the same token.