|
| 1 | +--- |
| 2 | +title: Script errors when running MSAL.Net in XBAP application with Internet Explorer |
| 3 | +description: Provides a solution to the script error that occurs when you run MSAL.Net in an XBAP application that uses Microsoft Entra ID. |
| 4 | +ms.date: 03/12/2025 |
| 5 | +ms.reviewer: bachoang |
| 6 | +ms.service: entra-id |
| 7 | +ms.custom: sap:Developing or Registering apps with Microsoft identity platform |
| 8 | +--- |
| 9 | +# "Cookies are disabled" error in MSAL.Net XBAP application in Internet Explorer |
| 10 | + |
| 11 | +This article describes a problem in which a script error is returned when you performing a Microsoft Entra ID login by using an XAML Browser Application (XBAP) from Microsoft Internet Explorer. |
| 12 | + |
| 13 | +## Symptoms |
| 14 | + |
| 15 | +You receive a script error warning and an error message stating that **cookies are disabled** when logging into Microsoft Entra ID. This problem happens when you run Microsoft Authentication Library for .NET (MSAL.NET) code similar to the following in an XAML Browser Application (XBAP) from Internet Explorer: |
| 16 | + |
| 17 | +```C# |
| 18 | +string tenantId = "<Tenant ID>"; |
| 19 | +string clientId = "<Application ID>"; |
| 20 | +string[] Scopes = new string[] { "User.Read" }; |
| 21 | +string errorMessage = string.Empty; |
| 22 | +try |
| 23 | + { |
| 24 | + using (HttpClient httpClient = new HttpClient()) |
| 25 | + { |
| 26 | + IPublicClientApplication publicClientApp = PublicClientApplicationBuilder.Create(clientId) |
| 27 | + .WithDefaultRedirectUri() |
| 28 | + .WithAuthority(AzureCloudInstance.AzurePublic, AadAuthorityAudience.AzureAdMyOrg) |
| 29 | + .WithTenantId(tenantId) |
| 30 | + .Build(); |
| 31 | + AuthenticationResult authenticationResult = null; |
| 32 | + var t = Task.Run(async () => |
| 33 | + { |
| 34 | + try |
| 35 | + { |
| 36 | + authenticationResult = await publicClientApp.AcquireTokenInteractive(Scopes) |
| 37 | + .WithAccount(null) |
| 38 | + .WithPrompt(Prompt.ForceLogin) |
| 39 | + .ExecuteAsync(); |
| 40 | + } |
| 41 | + catch (Exception ex) |
| 42 | + { |
| 43 | + errorMessage = "Error while getting token: " + ex.ToString(); |
| 44 | + } |
| 45 | + }); |
| 46 | + t.Wait(); |
| 47 | + |
| 48 | + if (authenticationResult != null) |
| 49 | + { |
| 50 | + return authenticationResult.AccessToken; |
| 51 | + } |
| 52 | + else |
| 53 | + { |
| 54 | + return errorMessage; |
| 55 | + } |
| 56 | + } |
| 57 | + } |
| 58 | + catch (Exception ex) |
| 59 | + { |
| 60 | + return ex.Message; |
| 61 | + } |
| 62 | +``` |
| 63 | +## Cause |
| 64 | + |
| 65 | +Although XBAP applications run within Internet Explorer, they operate in their own process space: **PresentationHost.exe**. This process is a highly secure container. XBAP applications use the WebBrowser control to host the Microsoft Entra ID login page. To minimize security risks from the browser surface, this container is configured yo use security restrictions that include blocking cookies. However, the Microsoft Entra ID login process depends on cookies. This conflict causes a script error. |
| 66 | + |
| 67 | +## Solution |
| 68 | + |
| 69 | +Configure MSAL.Net to use the [System Browser](/azure/active-directory/develop/msal-net-web-browsers#system-browser-experience-on-net) - Microsoft Edge to open the Entra ID login page. Then, follow these steps to make the required updates: |
| 70 | + |
| 71 | +1. In the Azure portal, locate your app in the **App registrations** page. Register `http://localhost` as a redirect URL under **Mobile and desktop applications** platform. |
| 72 | + |
| 73 | + :::image type="content" source="./media/script-errors-running-msal-net-xbap-app/add-uri.png" alt-text="Screenshot that shows the localhost address being registered as a redirect URL" lightbox="./media/script-errors-running-msal-net-xbap-app/add-uri.png"::: |
| 74 | + |
| 75 | +2. Make the following change to your code: |
| 76 | + |
| 77 | + ```C# |
| 78 | + try |
| 79 | + { |
| 80 | + using (HttpClient httpClient = new HttpClient()) |
| 81 | + { |
| 82 | + IPublicClientApplication publicClientApp = PublicClientApplicationBuilder.Create(clientId) |
| 83 | + .WithRedirectUri("http://localhost") |
| 84 | + .WithAuthority(AzureCloudInstance.AzurePublic, AadAuthorityAudience.AzureAdMyOrg) |
| 85 | + .WithTenantId(tenantId) |
| 86 | + .Build(); |
| 87 | + AuthenticationResult authenticationResult = null; |
| 88 | + |
| 89 | + var t = Task.Run(async () => |
| 90 | + { |
| 91 | + try |
| 92 | + { |
| 93 | + authenticationResult = await publicClientApp.AcquireTokenInteractive(Scopes) |
| 94 | + .WithAccount(null) |
| 95 | + .WithPrompt(Prompt.ForceLogin) |
| 96 | + .WithUseEmbeddedWebView(false) |
| 97 | + .ExecuteAsync(); |
| 98 | + } |
| 99 | + catch (Exception ex) |
| 100 | + { |
| 101 | + errorMessage = "Error while getting token: " + ex.ToString(); |
| 102 | + } |
| 103 | + }); |
| 104 | + ``` |
| 105 | + |
| 106 | +[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)] |
0 commit comments