Share via

Best practice for Azure Auth for web app and API

chadwell 0 Reputation points
2024-06-19T11:02:13.54+00:00

I'm standing up a new React app which will be hosted in the same repo as a Fastify server. So I can use the server for logging (SSO) in the user and obtaining the token (work or school account). The React app will call the Web apis on the server side.

For logging in the user, I assume I use MSAL-node for authorization code flow in Azure and can I retrieve both an id token and an access token?

The id token will be used to display the users name etc, and the access token will allow the React app to call the backend for API calls?

I have another need. Whilst the user will be able to interact with the UI, I also want them to be able to access the API and experiment with it from say postman or a cli. Is there some mechanism I can implement where they can generate a token (access?) from the UI and copy it and be able to use it in an API call?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,112 questions
Microsoft Entra
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. CarlZhao-MSFT 39,021 Reputation points
    2024-06-20T10:18:54.7266667+00:00

    Hi @chadwell

    For logging in the user, I assume I use MSAL-node for authorization code flow in Azure and can I retrieve both an id token and an access token?

    Yes, of course. After you authenticate the logged in user using the authorization code flow, you will be able to get an id token and an access token.

    The id token will be used to display the users name etc, and the access token will allow the React app to call the backend for API calls?

    Yes, the id token contains some basic information of the logged in user. For example, name, email, etc.

    The access token will be able to call the Web API. Like the id token, the access token also contains basic information of the logged in user, and it is more comprehensive.

    I have another need. Whilst the user will be able to interact with the UI, I also want them to be able to access the API and experiment with it from say postman or a cli. Is there some mechanism I can implement where they can generate a token (access?) from the UI and copy it and be able to use it in an API call?

    Yes, of course. You can implement the authorization code flow through the library, or you can implement the authorization code flow through postman/cli + UI and test the call to your Web API in postman.

    Hope this helps.

    If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

    0 comments