opened
juliepwchen
username_0
Hi, my SPA app tried to call a Microsoft Graph API on behalf of an user.  I have configured my app to use "Implicit Flow" as suggested by the document.

By calling "loginRedirect" (SPA javascript client), my app was able to get to the login screen; but after the credentials were entered, it returned an URL with an "id_token" and an error message on my debugger "SecurityError: Permission denied to access property "msal" on cross-origin object".  

Does anyone know about this error?
CORS issue?
issue
created
rohitnarula7176
username_1
@username_0 Can you provide a code repro for this issue. Msal should be able to get an access_token for your app without any issues. Can you try using the samples under the devApps folder in the repo and see if it helps you in any way.
comment
created
juliepwchen
username_0
I used the repo at https://github.com/Azure-Samples/active-directory-javascript-graphapi-v2. I practically used the same code as it is in app.js.  I deployed my app on a developer's cloud at https://licenseshare-route-licenseshare.7e14.starter-us-west-2.openshiftapps.com/html/base.html.  If you click on the "Start Clock" button, you will see the error on the debugger.  You will also see the return URL with the id_token.  Is this an Error or am I missing some coding/configuration steps?  Thanks for any advise.
comment
created
rohitnarula7176
username_1
@username_0 Can you please deploy your app with non-minified msal code so I can debug it without any issues.
comment
created
rohitnarula7176
username_1
@username_0 The issue is related to the presence of #! which was introduced in angular 1.6>. Please use the below lines of code after app.config in your code to remove the #!.
```
app.config(['$locationProvider', function($locationProvider) {
  $locationProvider.hashPrefix('');
  $locationProvider.html5Mode(true);
}]);
And then set base to / in the <head> on your base.html
<head>
    <base href="/">
</head>
```
comment
created
juliepwchen
username_0
Hi, I just added your suggestion and commented out the un-needed ADAL libraries; BUT the problem is the same.  I have included the un-minified version of the MSAL libraries, for easy debugging.  I would appreciate further help.
comment
created
juliepwchen
username_0
Hi, when I used your suggested changes with AngularJS 1.6, CORS issue stills exists, and the AngularJS route was not working any longer.  I decided to revert back to AngularJS 1.5.8, and the CORS issue is gone.  Plus, the Micrograph API is now working.  Thanks for point out the new AngularJS 1.6 issue.
comment
closed
rohitnarula7176
username_1
issue