Azure AD B2C token enpoint allows access to unknown origins

Question

I have set up an Azure AD B2C tenant with an API and a SPA client app. I am successfully being redirected to B2C login and login works fine. Now we have a security audit report saying the B2C token endpoint allows access to any origin. So, I thought it would be simple to whitelist my domain in CORS config in B2C. However, I found no single place for CORS configuration (tenant or app registrations or user flows). I spent a whole day looking for this but couldn't figure out how to prevent unknown origins from accessing the B2C token endpoint. I also tried to create a custom policy but couldn't figure out how to specify CORS-related things in the policy. Could anyone please help me out?

Below is a request for a token from BurpSuit (or Fiddler). In this, I have replaced the origin with a fake site and see that the endpoint still accepts the origin.

Answer 1

Correct, this is a publicly available and implemented as per the OAuth 2.0 Authorization Framework spec which does not include validating an origin header, an optional header as per The Web Origin Concept. There are no ways to restrict what clients call the endpoint, however it is protected in other ways, such as with your PKCE key for public clients, or your client secret for confidential clients.

Moreover, your authorize endpoint requires a pre-registered redirect_uri to get the authorization code that is exchanged in the token endpoint request.

TLDR; if you are in possession of the authorization code, client id, code verifier or client secret/certificate then you should be allowed to exchange the authorization code for the JWTs regardless of origin.