Joonas Westlin • 5/2/2019

Avoiding wildcard reply URLs with MSAL.js

This technical article discusses a common security pitfall in Azure AD authentication with MSAL.js: using wildcard reply URLs. It explains the associated risks, such as open redirect vulnerabilities, and provides a detailed, secure alternative. The solution involves storing the original target path in browser session storage and redirecting the user to a single, fixed callback endpoint after login.

0 comments

#security #authentication #Azure Ad