MSAL-Angular auth_code flow + PKCE support?

Bernd Schickerbauer 116 Reputation points
2020-05-22T17:36:38.887+00:00

I learned at MS Build 2020 that MSAL-Angular is GA. I was wondering if it supports authorization_code flow & PKCE like MSAL 2.0 for JS does already?
I've implemented a baseline login component, but seems that it is still using implicit flow?
Is there a plan to support auth_code as well?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,474 questions
0 comments
Accepted answer
  1. Saurabh Sharma 23,676 Reputation points Microsoft Employee
    2020-06-05T21:23:42.2+00:00

    As MSAL Angular library does not support auth code flow and still uses the implicit flow, I suggest you to please post this as a feedback at UserVoice. This will allow the community to upvote and for the product team to include into their plans.

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jai Verma 461 Reputation points
    2020-05-22T18:21:09.763+00:00

    As per the thread - https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/944 , it appears that it has been taken as work item. I never followed up after that. You can reactivate and check the status on the above thread.

    0 comments
  2. Saurabh Sharma 23,676 Reputation points Microsoft Employee
    2020-05-22T22:33:34.023+00:00

    @Bernd Schickerbauer OAuth 2.0 Authorization Code Flow with PKCE for MSAL.JS is in preview and you can find the beta version of the library over here .

  3. Bernd Schickerbauer 116 Reputation points
    2020-05-24T16:45:13.883+00:00

    I am asking as I've been trying to implement an auth_code flow with other oidc libraries (not msal, adal) in an angular (v9) project. The login always fails as requests to /token endpoint are blocked by CORS policies.
    I do get an auth_code, but the request to /token/ endpoint is then blocked.

    Access to XMLHttpRequest at 'https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

    Whereas https://login.microsoftonline.com/<tenant>/discovery/v2.0/keys does support CORS.