You are developing a client-side React single-page application (SPA) that will run in users' web browsers. The application must authenticate users against Microsoft Entra ID and access a secure downstream web API. You need to configure the authentication and identity settings for the React application. Which configuration should you implement in Microsoft Entra ID?
- Register the application in Microsoft Entra ID, configure a redirect URI with the Single-page application (SPA) platform type, and use the authorization code flow with PKCE.Cevap
- BConfigure a system-assigned managed identity for the React application to authenticate the user session and retrieve tokens from the browser.
- CRegister the application as a Web platform client type, configure a client secret, and use the client credentials flow to authenticate users.
- DGenerate a Shared Access Signature (SAS) token in Azure Storage and embed it in the React application configuration to authenticate users.
Cevap
Register the application in Microsoft Entra ID, configure a redirect URI with the Single-page application (SPA) platform type, and use the authorization code flow with PKCE.
The correct option is to register the application in Microsoft Entra ID with the platform type set to Single-page application (SPA) and use the authorization code flow with PKCE. Because the React app runs in the user's browser, it is a public client and cannot secure a client secret. PKCE eliminates the need for a client secret while protecting the flow against authorization code interception attacks. Furthermore, registering as an SPA enables the necessary CORS support on Entra ID token endpoints.
Adım Adım Çözüm
Anahtar Kavram
Selecting the correct platform registration and authentication flow in Microsoft Entra ID for public client applications.