Tagged oidc
2 entries carry the tag oidc, newest first. All tags.
- How do I coordinate Microsoft Entra ID sign-in between a single-page app and a separately hosted backend API?
A bearer-token SPA runs MSAL.js itself and attaches its own access token to calls the API's CORS policy allows across origins - simplest to stand up, but every token lives in the browser. A backend-for-frontend (BFF) makes the backend the confidential OIDC client instead: it owns the redirect, keeps tokens server-side, and hands the SPA a same-origin cookie needing no CORS setup. Default to the BFF when the backend can own a session; reach for the bearer-token SPA only when the API also has to serve other, non-browser callers with the same token.
- How do I add Microsoft Entra ID sign-in to a web app or single-page app?
Register the app in the Microsoft Entra admin center under the matching platform type - Single-page application for a SPA, Web for a server-rendered app. Then run authorization code with PKCE through a library instead of by hand: MSAL.js for a SPA, Microsoft.Identity.Web for ASP.NET Core. Call the silent token method first and fall back to an interactive one only when it throws, so a returning user isn't reprompted every page load.