Azure AD B2C does not respect redirect_uri

Question

Azure AD B2C does not always respect the redirect_uri specified in the authentication request using the authorization code flow.

1. Create app reg in B2C
2. Add https://random1.com/signin-oidc as redirect uri
3. Verify it works from your app
4. Add https://random2.com/signin-oidc as redirect uri
5. Verify it works from your app on a new domain
6. User gets sent to https://random1.com/signin-oidc and not https://random2.com/signin-oidc even if the initial redirect to B2C contains ...&redirect_uri=https://random2.com/signin-oidc

Often occurs when you have a dev environment where you want to reuse the same app reg for localhost development but also have a URL when its deployed to the dev environment.

Am I doing something wrong or is this a bug?

Answer 1

I can provide a browser trace if strictly needed, but this happens consistently when you have two redirect urls registered. Development on localhost works fine if I only have https://localhost/signin-oidc registered, but when I add a new one one of them breaks.

Answer 2

@Dzenan

Kindly validate the Redirect URL configured in the application code. In the Azure portal, the redirect URIs that you register on the Authentication page for your application need to match these URLs.

If this does not help then we need to have browser trace while trying to reproduce the issue or a fiddler trace would help.

Please do let me know if you have any further queries.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes/No), and share your feedback if the suggestion works as per your business need. This will help us and others in the community as well.

Answer 3

I was able to reproduce this simply by getting access tokens from the /authorize endpoint while using custom policies so.....

POST:
https://tenantName.b2clogin.com/tenantName.onmicrosoft.com/OUR-POLICY-NAME/oauth2/v2.0/authorize

I would pass in a callback URL and it would not return the same one or say it doesn't exist in app registration even if I clearly see that it does (and waited a period of time after adding).

I was able to resolve by creating a new App Registration with only a single Redirect URI. Also seemed to help to create a new nonce id.

Very concerning behavior for Mobile App Users since these app registration id's are loaded as build configurations and would require app updates to resolve.