Azure AD B2C页面UI自定义的CORS配置

Question

I'm using a custom page UI template for my Azure AD B2C sign in/sign up and I want to know what domain I need to use in CORS configuration in my Azure Blob Storage account.

Login page seems to come from https://login.microsoftonline.com . Is that the correct origin?

When I use the StorageClient command line tool Microsoft created for uploading my custom UI files to my Azure Blob Storage, I've noticed that it sets it to * for Allowed Origins which the documentation indicates as well. Here's the documentation: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-ui-customization-custom-dynamic#step-3-configure-cors-in-azure-app-service

I don't think this is really secure and I want to limit it to only those domains that are absolutely necessary.

I want to do this for two reasons, both of which are pretty important:

1. I want to keep security as tight as possible and allowing any origin doesn't seem secure.
2. More importantly, CORS is set at service level on Azure Blob Storage and not container level. I have other containers under the same storage account that contain user files. Those files should only be accessible from my app which creates a SAS to allow access to them. If I set the Allowed Origins for CORS to any, it will make my app less secure even though the protected files will still require a SAS. As I said before, I want to keep security as tight as possible.

So, the question is: what URL should I enter under Allowed Origins in my CORS configuration for Azure AD B2C? I don't just want to make the assumption that it's https://login.microsoftonline.com because Microsoft usually does a few redirects in their services and I want to make sure all the necessary origins are included.

Answer 1

如果使用b2clogin.com，则应将CORS来源设置为https://login.microsoftonline.com或https://{tenant}.b2clogin.com .b2clogin.com 。