Comments (7)
Thank you guys, appreciate the help. Security will always be a weak point for me but my app logic is not. So I appreciate all the help and pointers you gave me. I'll have a look at the example to use passport instead for the backend. A Microsoft native library would've had my preference but this will do fine in the meantime. #stayhomestaysafe
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
A Vue.js sample is certainly on our radar, though ETA is not clear. With respect to Node however, I'm afraid you'll have to wait more as the msal-node is currently in development. In the meantime though, you can check out this Node.js sample using passport-azure-ad, a library endorsed by Microsoft.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
Thank you for the feedback but I think you misunderstood me. The frontend handles the authentication in the SAP by using msal
. The backend only needs to verify the access_token received to see if it's authenticated against AD. So I think that msal
in the node backend is not needed. At least, I think this example in its dotnet part does not use msal
there.
Am I mixing things up? Once the user is authenticated on the frontend using msal
we only need the backend to check if it's valid.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
No worries : ) So each component of the app topology would need MSAL, or some other token exchange library. The sample here for instance is using MSAL.NET (or rather, Microsoft.Identity.Web which is based on MSAL.NET) on the back-end. The reason is that when the frontend app sends an access token to the backend, that token needs to be validated by the backend -for that, you would need MSAL again.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
Oh, that wasn't clear to me. I just thought that would've been possible without msal in a very simple way by checking against the resource app in Azure. Is there a workaround currently for just checking if the token is valid or not within node? As the token is generated in the frontend I was hoping such a check would be really easy.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
@sDarkLite1 : the token is not generated in the fontend. It's acquired by the front end from Azure AD.
As @derisen wrote in the https://github.com/Azure-Samples/active-directory-javascript-nodejs-webapi-v2 sample, you'll see how the node.js Web api uses passport azure ad to validate the token.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
@DarkLite1 cheers : ) msal-node is not production ready yet, but check out the samples to get an idea. Closing this for now.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.
Related Issues (20)
- Update/Add branch to demo Authorization code flow w/ PKCE using on-behalf-of HOT 2
- User group in token claims HOT 2
- How to move required scope check in API project out of controller? HOT 8
- Return roles and groups in the authentication token SPA HOT 2
- FHIR API - Invalid token and audience is invalid HOT 3
- The Frame attempting navigation of the top level window is sandboxed, but the flag of 'allow-top-navigation' or 'allow-top-navigation-by-user-activation' is not set. HOT 3
- error: "invalid_instance" HOT 2
- Logout is not working properly HOT 3
- Issue running NPM start on SPA HOT 1
- Protected Resource Map HOT 2
- Two AzureAD App Registrations? HOT 5
- Uncaught (in promise): BrowserAuthError: interaction_in_progress: Interaction is currently in progress. HOT 1
- CORS blocking HOT 1
- Error - Bearer error="invalid_token" HOT 2
- Is storage of tokens in browser localStorage insecure? HOT 2
- PKCE Error with MSAL and Angular App HOT 1
- ms-identity-javascript-angular-spa-aspnetcore-webapi The request body must contain the following parameter: 'client_assertion' or 'client_secret' HOT 3
- don's support the Azure AD in China
- CORS issue HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ms-identity-javascript-angular-spa-aspnetcore-webapi.