Microsoft Entra ID: AADSTS9002326: Cross-origin token redemption is permitted
The browser swapped the authorisation code for tokens itself, with a fetch that carries an Origin header, but the redirect URI is registered under the Web platform, which Entra treats as a server-side confidential client. MSAL.js 2 and later always does this from the browser using PKCE, so the URI must be listed under Single-page application instead. Apps moved off MSAL.js 1 and the implicit flow hit this because their URIs were registered under Web years ago.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Where is each redirect URI registered?
az ad app show --id <client-id> --query "{web:web.redirectUris, spa:spa.redirectUris}"
# Move the browser URIs to the SPA platform. In the portal:
# App registrations > Authentication > Add a platform > Single-page application
# Or with Microsoft Graph:
az rest --method PATCH \
--uri "https://graph.microsoft.com/v1.0/applications(appId='<client-id>')" \
--body '{"spa":{"redirectUris":["http://localhost:3000","https://app.example.com"]}}'
# Then remove the same URIs from the Web platform, unless a server-side
# part of the app still redeems codes with a client secret
# If your server is meant to redeem the code, keep the URI under Web and
# make sure it does not forward the browser's Origin header to /tokenHow to diagnose Auth errors
Identity errors are almost always configuration mismatches between two systems rather than code bugs: a redirect URI registered with a trailing slash, a client secret that was rotated on one side only, a clock that has drifted past the token skew allowance. Because the identity provider deliberately returns vague errors to avoid leaking information to attackers, the provider's own log is usually far more informative than the message your application receives.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Open the identity provider's log or event stream first. Auth0, Okta and Keycloak all record a detailed reason that they never send back to the client.
- Compare the redirect URI byte for byte, including scheme, port and trailing slash.
http://localhost:3000/callbackandhttp://localhost:3000/callback/are different URIs. - Decode the token rather than guessing. Paste it into a local JWT decoder and check
iss,aud,expandnbf, never a remote paste site, because tokens are credentials. - Check clock skew with
timedatectlorntpq -p. Kerberos, SAML and JWT all reject tokens outside a tight time window, and a drifting VM clock produces intermittent, unreproducible auth failures. - For passkeys and WebAuthn, verify the Relying Party ID matches the origin exactly and that the page is served over HTTPS or on
localhost. Nothing else is a secure context.
Tools worth reaching for
Provider audit logsjwt decoding (locally)openssl x509 -noout -textbrowser devtools network tab
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Auth errors
- Auth.js: UntrustedHost: Host must be trusted. URL was: http://localhost:3000Auth.js (NextAuth v5) will not build callback URLs from a Host header it has not been told to…
- Auth0: Callback URL mismatchAuth0 rejected the login because the redirect URL in the request is not in the application's…
- Google OAuth: Error 403: access_denied, app is in testingThe OAuth consent screen is in Testing mode, which only allows the accounts explicitly listed…
- JWT: token used before issued / not valid yetValidation compared the token's iat or nbf claim against the verifier's clock and decided the…
- Keycloak: Cookie not found. Please make sure cookies are enabledKeycloak sets a cookie when the login page loads and expects it back when the form is…
- Keycloak: Invalid parameter: redirect_uriKeycloak rejected the redirect URI because it is not listed in the client's Valid Redirect…
- Keycloak: Invalid token issuer. Expected 'http://keycloak:8080/realms/myrealm'The token's iss claim comes from whichever hostname the client used to reach Keycloak, and…
- MFA: challenge timeout / code expiredA TOTP or push challenge was rejected because it expired or the device clock drifted outside…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.