是否可以使用 Microsoft 身份验证库从 SPA 进行身份验证但没有重定向 Uri？

Question

I'm creating a Javascript single page application. It requires a user to sign in during the implicit flow in order to use Microsoft Graph API later on. I'm using MSAL.js and trying to adapt snippets from this guide to get auth token from authRedirectCallBack

I realize that in other flows redirect uri (used after authentication) is essential to get the token and proceed with it. However in my flow I have token processed in the Javascript callback function.

Is it possible to avoid providing redirect uri in App registration with Azure AD and/or during the code execution? I'd like not to bring the user to this redirect uri at all.

At the moment my code looks like this:

var msalConfig = {
  auth: {
    clientId: 'my-app-id',
  },
  cache: {
    cacheLocation: "localStorage",
    storeAuthStateInCookie: true,
    forceRefresh: false
  }
};
const loginRequest = {scopes: ['openid', 'profile', 'user.read']};
const msalClient = new Msal.UserAgentApplication(msalConfig);
msalClient.handleRedirectCallback(authRedirectCallBack);
singIn();

async function singIn() {
  try {
    msalClient.loginPopup(loginRequest).then(function (response) {
      if (msalClient.getAccount()) {
        console.log('logged');
      }
    });
  } catch (err) {
    console.log(err);
  }
}

function authRedirectCallBack(err, response) {
  if (err) {
    console.log(err);
  } else {
    if (response.tokenType === "access_token") {
      console.log('token', response);
    }
  }
}

Answer 1

A redirect URI is required, as it is the main security mechanism we use to ensure the response is not returned to an unauthorized party, as the Implicit Flow relies on redirecting iframes/popups/windows back to your application with the response in the hash of the url.

Note, that if you use loginPopup/acquireTokenPopup/acquireTokenSilent, the end user will not really "see" this redirect page, as it is visited only briefly in either a hidden iframe (for acquireTokenSilent) or popup window. As soon as MSAL.js sees that the iframe/popup has been redirected back to your application, the response is parsed and the popup/iframe is closed.

We are working on a new version of the library that will switch to the Auth Code Flow w/ PKCE, which will not use hidden iframes, however, it will still use popups/redirects.

Can you further explain why you don't want your users to visit the redirect page?