This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 24%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPC%3C/text%3E%3C/svg%3E)
I am setting up a custom domain for the B2C endpoint, it managed this masquerading but I am getting a 502 error on the Authorize endpoint. I am using an application gateway to achieve this masking.
Scenario 1:
When I send the value of the <custom-domain> in the host header from the application gateway to call the B2C backend, I get the following response:
https://<custom_domain>/<tenant>/oauth2/v2.0/authorize -> 502 error
Scenario 2:
When I send the value <B2C default domain > in the host header from the application gateway to call the B2C backend, I get the following response:
https://<custom_domain>/<tenant>/oauth2/v2.0/authorize -> ok
https://<custom_domain>/<tenant>/B2C_1A_policy/client/perftrace -> 400 error
https://<custom_domain>/<tenant>/B2C_1A_policy/SelfAsserted -> 400
This is the same case as described in the following ticket: https://learn.microsoft.com/en-us/answers/questions/1865853/azure-ad-b2c-cant-set-cookie-with-cross-domain
Showing the next message on the authorize endpoint : "This attemp to set a cookie via set-cookie header was blocked because its Domain atrribute was invalid with regard to the the current host url"
From the browser console, I have noticed that a url is referenced to obtain the static ones that refer to the default domain. I don't know if this is causing the first scenario to obtain a 502 code on the authorize endpoint.
I am using the Identity Experience Framework, I would like to rule out if I have to add this custom domain in the xml.
Thanks in advance.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Thank you for posting this in Microsoft Q&A.
I'm reviewing your query will get back to you soon shortly.
Thanks,
Navya.
Hi, Navya
We look forward to your support, thank you very much!
The 502 error you're seeing when using the custom domain in the host header typically indicates a misconfiguration in the routing or proxying of the request.
To resolve this issue, please check the following:
The 400 Bad Request error that you're receiving with the custom domain and certain paths (e.g., /B2C_1A_policy/client/perftrace and /B2C_1A_policy/SelfAsserted) is related to the cookies being blocked by the browser, as you've mentioned. The issue with setting cookies cross-domain often occurs because the cookie's Domain attribute must match the top-level domain of the request URL. When you're using a custom domain, this mismatch causes browsers to block the cookie from being set.
To resolve the issues you're facing, you should configure Azure Front Door Standard or Premium SKU (or modify the Azure Application Gateway settings if you're using it). This will preserve the original host header (e.g., accounts.contoso.com), ensuring that cookies are set and sent correctly, thus resolving the 502 and 400 errors you're encountering.
For your reference: https://learn.microsoft.com/en-us/azure/active-directory-b2c/custom-domain?pivots=b2c-custom-policy
Thanks,
Navya.
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Gforce now account linked to my Microsoft Xbox account so I can download Gforce now game ready drivers on my Xbox one x
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more