Azure AD application callback calls being made with GET instead of POST

Question

Azure AD application callback calls being made with GET instead of POST

Carlos Araujo 0

My azure application is configured with "oauth2RequirePostResponse": true, but the calls to the callback url are still being made with GET method instead of POST method.

I'm trying to understand the problem and asking some help about this question.

Thank you!

Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-12-27T19:20:51.0166667+00:00
Hi @Carlos Araujo

Thank you for posting this in Microsoft Q&A.

I understand you are facing an issue where the calls to the callback URL are being made with the GET method instead of the POST method, even though your Azure application is configured with "oauth2RequirePostResponse": true.

To enable POST requests, you need to set the "oauth2RequirePostResponse" property to true in your Azure AD application's manifest file. This can be done using the following C# code:

[Newtonsoft.Json.JsonProperty(PropertyName="oauth2RequirePostResponse")] public bool? Oauth2RequirePostResponse { get; set; }

To troubleshoot this issue, you can try the following steps:

Verify that the "oauth2RequirePostResponse" setting is set to true in your Microsoft Entr ID/Azure application's manifest file.

Check the logs of your application to see if there are any errors or warnings related to the callback URL.

Verify that the callback URL is correct and matches the URL specified in your Azure application's manifest file.

Thanks,

Navya.
Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-12-30T18:20:43.37+00:00

Hi @Carlos Araujo

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Navya 19,795 Reputation points Microsoft External Staff Moderator

2025-01-02T20:20:47.43+00:00

Hi @Carlos Araujo

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Paul Strinati 0 Reputation points

2025-01-08T15:50:46.53+00:00

Hi - I have exactly the same issue with a containerised python app deployed as an Azure web app. Using Oauth2 with EntraID as the identity provider, successfully acquiring the token before submitting the (POST) request over https.

The app expects a POST request, and we have HTTPS enforced and end-to-end TLS encryption within the web app.

Postman console shows the final redirect is being passed as a GET request, resulting in a 405 Method Not Allowed response. Is this configurable at the Azure Portal level?
Bizarrely, the forced HTTPS was working fine without Oauth2 enabled, it is only since configuring Oauth2 with client id / secret that this problem has appeared.

UPDATE
This is an issue with the way browsers (or in my case, Postman) handle redirects. This article provides more detail, and changing the setting as suggested in my postman request resolved the issue without any changes to code or Azure config:
https://support.postman.com/hc/en-us/articles/211913929-My-request-is-redirected-to-a-GET-request

Your answer

Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-12-27T19:20:51.0166667+00:00

Hi @Carlos Araujo

Thank you for posting this in Microsoft Q&A.

I understand you are facing an issue where the calls to the callback URL are being made with the GET method instead of the POST method, even though your Azure application is configured with "oauth2RequirePostResponse": true.

To enable POST requests, you need to set the "oauth2RequirePostResponse" property to true in your Azure AD application's manifest file. This can be done using the following C# code:

[Newtonsoft.Json.JsonProperty(PropertyName="oauth2RequirePostResponse")] public bool? Oauth2RequirePostResponse { get; set; }

To troubleshoot this issue, you can try the following steps:

Verify that the "oauth2RequirePostResponse" setting is set to true in your Microsoft Entr ID/Azure application's manifest file.

Check the logs of your application to see if there are any errors or warnings related to the callback URL.

Verify that the callback URL is correct and matches the URL specified in your Azure application's manifest file.

Thanks,

Navya.
Navya 19,795 Reputation points Microsoft External Staff Moderator

2024-12-30T18:20:43.37+00:00

Hi @Carlos Araujo

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Navya 19,795 Reputation points Microsoft External Staff Moderator

2025-01-02T20:20:47.43+00:00

Hi @Carlos Araujo

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Paul Strinati 0 Reputation points

2025-01-08T15:50:46.53+00:00

Hi - I have exactly the same issue with a containerised python app deployed as an Azure web app. Using Oauth2 with EntraID as the identity provider, successfully acquiring the token before submitting the (POST) request over https.

The app expects a POST request, and we have HTTPS enforced and end-to-end TLS encryption within the web app.

Postman console shows the final redirect is being passed as a GET request, resulting in a 405 Method Not Allowed response. Is this configurable at the Azure Portal level?
Bizarrely, the forced HTTPS was working fine without Oauth2 enabled, it is only since configuring Oauth2 with client id / secret that this problem has appeared.

UPDATE
This is an issue with the way browsers (or in my case, Postman) handle redirects. This article provides more detail, and changing the setting as suggested in my postman request resolved the issue without any changes to code or Azure config:
https://support.postman.com/hc/en-us/articles/211913929-My-request-is-redirected-to-a-GET-request

Share via

Azure AD application callback calls being made with GET instead of POST

Your answer