Using /.auth/ behind Azure Front Door

Question

I have AFD in front of my Azure Static Web App on https://nkdagility.com and I want to use the OOB /.auth/login/github to login. However it returns to the Static Web domain instead of the AFD domain... and /{AFDDoamin}/.auth/me is empty.

Is there any documentation or good practices around how to configure a Azure Static Web App behind AFD.

I already have a /.auth/login/github?post_login_redirect_uri=https://nkdagility.com/ but it still ends up at https://yellow-pond.nkdagility.com.

Answer 1

@Martin Hinshelwood nkdAgility.com

Thank you for reaching out. I think the issue might be due to host name preservation as described in the article here
https://learn.microsoft.com/en-us/azure/architecture/best-practices/host-name-preservation

We recommend that you preserve the original HTTP host name when you use a reverse proxy in front of a web application. Having a different host name at the reverse proxy than the one that's provided to the back-end application server can lead to cookies or redirect URLs that don't work properly.

A common and more specific case of the previous scenario occurs when absolute redirect URLs are generated as described here.

The documentation does not specifically talk about static web apps as backend but The recommendation to preserve the host name typically still applies for any components in your application that depend on it, unless you specifically make your application aware of reverse proxies and respect the forwarded or X-Forwarded-Host headers, for example.
Update 12/12:

Thank you for your patience here, I just heard back from the team and the approach above for host name preservation is recommended by them in this scenario.

Hope this helps! Please let me know if you have any additional questions. Thanks