OAuth-openId: Can't call the /openid/userinfo. Cors policy problem

VincentMontreal 6

Hello

I have a single page application that is register into the azure portal. I use a react library to make the code flow. I manage to get an access token with my code but after that I try to call (with my accessToken) this endpoint :
https://login.microsoftonline.com/{:TenantID}/openid/userinfo but I have this error:
Access to XMLHttpRequest at 'https://login.microsoftonline.com/{:TenandId}/openid/userinfo' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Do you know how I can access to this endpoint from http://localhost:3000 (for now and later from my production url) ?
Thanks for your help,

Regards,
Vincent

Saurabh Sharma 23,826 Reputation points Microsoft Employee

2020-06-09T22:00:06.62+00:00

@VincentMontreal Have you tried adding allowed headers to 'Authorization' and 'Content-Type' in your code. Can you please provide the code snippet you are using.
VincentMontreal 6 Reputation points

2020-06-10T19:33:00.85+00:00

Hello @SaurabhSoni-3099 , The Authorization (with the accessToken) is set into the headers request. I can't show you a snippet of the code because this is a React library but I can show you a screenshot of the call. Is that a way to verify into Azure that my app allowed Cors policy ?

Regards,

Vincent
Saurabh Sharma 23,826 Reputation points Microsoft Employee

2020-06-10T22:45:51.517+00:00

@VincentMontreal-7976 Are you using a v1 endpoint or a v2 endpoint to get the token. If you are using a v2 endpoint (https://login.microsoftonline.com/{ tenant }/oauth2/v2.0/authorize) then you need to call https://graph.microsoft.com/oidc/userinfo endpoint with Microsoft Graph scope to get the user info.
Please navigate to https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration to get the openid metadata. I also suggest you to try to get the token and call the user info endpoint from Postman to validate your expected result.
Saurabh Sharma 23,826 Reputation points Microsoft Employee

2020-06-18T22:29:21.26+00:00

@VincentMontreal Is your issue resolved now ?

1 answer

AmanpreetSingh-MSFT 56,746 Reputation points

2020-06-11T09:05:48.627+00:00

Hello @VincentMontreal-7976

Add the crossorigin attribute to your < script > tags:

< script crossorigin src="..." >< /script >

Also ensure the response is with the Access-Control-Allow-Origin: *

Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

OAuth-openId: Can't call the /openid/userinfo. Cors policy problem

1 answer

Your answer