Using /.auth/ behind Azure Front Door

Martin Hinshelwood nkdAgility.com 75 Reputation points MVP
2024-12-04T13:33:50.9966667+00:00

I have AFD in front of my Azure Static Web App on https://nkdagility.com and I want to use the OOB /.auth/login/github to login. However it returns to the Static Web domain instead of the AFD domain... and /{AFDDoamin}/.auth/me is empty.

Is there any documentation or good practices around how to configure a Azure Static Web App behind AFD.

I already have a /.auth/login/github?post_login_redirect_uri=https://nkdagility.com/ but it still ends up at https://yellow-pond.nkdagility.com.

Azure Front Door
Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
712 questions
Azure Static Web Apps
Azure Static Web Apps
An Azure service that provides streamlined full-stack web app development.
1,022 questions
{count} votes

Accepted answer
  1. ChaitanyaNaykodi-MSFT 26,936 Reputation points Microsoft Employee
    2024-12-04T18:59:10.3933333+00:00

    @Martin Hinshelwood nkdAgility.com

    Thank you for reaching out. I think the issue might be due to host name preservation as described in the article here
    https://zcusa.951200.xyz/en-us/azure/architecture/best-practices/host-name-preservation

    We recommend that you preserve the original HTTP host name when you use a reverse proxy in front of a web application. Having a different host name at the reverse proxy than the one that's provided to the back-end application server can lead to cookies or redirect URLs that don't work properly.

    A common and more specific case of the previous scenario occurs when absolute redirect URLs are generated as described here.

    The documentation does not specifically talk about static web apps as backend but The recommendation to preserve the host name typically still applies for any components in your application that depend on it, unless you specifically make your application aware of reverse proxies and respect the forwarded or X-Forwarded-Host headers, for example.
    Update 12/12:

    Thank you for your patience here, I just heard back from the team and the approach above for host name preservation is recommended by them in this scenario.

    Hope this helps! Please let me know if you have any additional questions. Thanks


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.