Trying to get access token in Nitro from Microsoft Entra ID where app is setup as SPA fails due to CORS

[arif-hanif]

Product

Nitro

Version

23.0.2

Link to minimal reproduction

https://hotchocolategraphql.slack.com/archives/C02A2NX3WAH/p1732026469001429

Steps to reproduce

The authorize endpoint is working just fine and returns a code challenge but obtaining access token fails due to below.

Either on the Desktop or Web obtaining token returns bad request 400 error, using postman with same settings returns the same error but when the origin value is modified in postman a successful token is obtained.

In Nitro the origin field does not seem to be passed in to the request header.

What is expected?

• Access token to be returned

What is actually happening?

• Bad request due to CORS

Relevant log output

Additional context

No response