Microsoft Auth Proxy
Microsoft Auth Proxy
To enable OneDrive streaming, Freak-Flix requires interaction with the Microsoft Identity Platform. However, Microsoft's OAuth 2.0 endpoints do not support Cross-Origin Resource Sharing (CORS) for direct client-side requests from web browsers.
The Microsoft Auth Proxy acts as a secure intermediary. It forwards authentication requests to Microsoft, strips problematic headers (like Origin), and injects the necessary CORS headers to allow the Freak-Flix frontend (especially the Web version) to securely exchange authorization codes for access tokens.
🌐 Proxy Endpoints
Depending on your deployment environment, the proxy is available at the following base paths:
| Environment | Base Proxy URL |
| :--- | :--- |
| Cloudflare Workers | /microsoft/proxy/ |
| Netlify Functions | /api/ms_auth/ |
The proxy transparently maps any path appended to these bases to https://login.microsoftonline.com/.
🛠️ Usage Example
When performing an OAuth 2.0 token exchange, instead of calling Microsoft directly, the application targets the proxy.
Request Transformation:
- Original Target:
https://login.microsoftonline.com/common/oauth2/v2.0/token - Proxy Target (Netlify):
https://your-domain.com/api/ms_auth/common/oauth2/v2.0/token
Example Token Request
POST /api/ms_auth/common/oauth2/v2.0/token HTTP/1.1
Host: your-backend-api.com
Content-Type: application/x-www-form-urlencoded
client_id=YOUR_AZURE_APP_ID
&redirect_uri=YOUR_REDIRECT_URI
&code=AUTHORIZATION_CODE
&grant_type=authorization_code
⚙️ How it Handles Requests
- Path Resolution: The proxy extracts the portion of the URL following the base proxy path (e.g.,
{tenant}/oauth2/v2.0/token). - Header Sanitization: To comply with Microsoft's security policies, the proxy forwards standard headers like
Content-TypeandAuthorizationwhile explicitly omitting theOriginandRefererheaders that usually cause CORS rejections. - CORS Injection: The backend appends
Access-Control-Allow-Origin: *to the response from Microsoft, allowing the Flutter Web client to read the returned JSON payload (containingaccess_tokenandrefresh_token).
🔑 Security Considerations
- Internal Routing: While the proxy is a public-facing interface, it is designed strictly for the Microsoft Identity Platform. It does not allow arbitrary forwarding to other domains.
- Token Safety: The proxy does not log or store the
access_tokenorclient_secret. It acts as a "pass-through" pipe. - HTTPS: All requests to the proxy must be made over HTTPS to ensure that sensitive authentication data is encrypted in transit.
🚀 Developer Setup
If you are hosting your own version of the Freak-Flix backend:
- Cloudflare: Ensure your
wrangler.tomlis configured and theJWT_SECRETis set in your environment variables. - Netlify: The rewrite rule in
netlify.tomlshould map/api/ms_auth/*to thems_auth_proxy.jsfunction:[[redirects]] from = "/api/ms_auth/*" to = "/.netlify/functions/ms_auth_proxy" status = 200 - Azure Configuration: When registering your app in the Azure Portal, ensure your Redirect URI matches the one configured in the Freak-Flix frontend settings.