Why when using redirect_uri as schema://app, my application does not show MFA but bypasses login successfully by default?

Question

Why when using redirect_uri as schema://app, my application does not show MFA but bypasses login successfully by default?

https://login.microsoftonline.com/xxx/oauth2/v2.0/authorize?prompt=login&clientId=xxxxx&scope=offline_access%20openid%20profile&response_type=code%20id_token&response_mode=fragment&state=qs6576BsLv6KRup692lE1TXq45fJkyRDFV5JTlNe9qo&nonce=Z44Jq2PwaXT_he7H89DKj_UZESFVnMFDpeA6ka9gmYw&code_challenge_method=plain&code_challenge=N_dILBj27K0oqaYtfvFPBs_UpmZp2RAdFY-vw5ysXpw&client_id=xxxxx&redirect_uri=example%3A%2F%2Fapp

Answer 1

Hi @Hoàng Phúc , when you use a custom URI scheme as the redirect URI, the authentication flow is handled by the operating system instead of the browser. This means that the MFA prompt may not be displayed, depending on the configuration of your device and the authentication method that you are using.

To ensure that the MFA prompt is displayed, you can try using a different redirect URI that is handled by the browser. For example, you can use https://localhost as the redirect URI during development, and then switch to a different URI when you deploy your application.

Alternatively, you can try using a different authentication method that is more compatible with custom URI schemes. For example, you can use the OAuth 2.0 implicit flow instead of the authorization code flow, which may work better with custom URI schemes.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James