login.microsoftonline.com CORS because of missing Access-Control-Allow-Origin header

Question

We use MS Entra for SSO and we have a problem when our application/tools tries to initiate SAML exchange with login.microsoftonline.com We see CORS errors. I assume it's because origin domain is different than https://login.microsoftonline.com/...

Is there any way how to whitelist that origin domain by forcing login.microsoftonline.com send out Access-Control-Allow-Origin header with our origin domain as response to SAML request.

Entity ID, Reply URL & Sign-on URL is set in Single sign-on/Basic SAML Configuration in MS Entra.

Is there anything else missing or any reason why login.microsoftonline.com doesn't reply with Access-Control-Allow-Origin header in SAML response?

Answer 1

Hi @Martin , unfortunately you cannot whitelist your origin domain by forcing login.microsoftonline.com to send out the Access-Control-Allow-Origin header with your origin domain as a response to the SAML request. This is because the Access-Control-Allow-Origin header is controlled by the server, and it is up to the server to decide which domains are allowed to access its resources.

Have you seen this thread? It may help you with some solutions.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James