I am implementing SSO in React SPA with Microsoft identity & using "@azure/msal-browser": "^3.5.0" & "@azure/msal-react": "^2.0.7" as dependency.
Please refer the below sample app provided by Microsoft:
import { useMsal } from "@azure/msal-react";
const { instance } = useMsal()
let loginRequest = {
scopes: ["user.read", "mail.send"]
}
const handleMSLLogin = () => {
instance.acquireTokenPopup({ loginRequest }).then(response => {
console.log(response) //This response contains JWT token with client information and is visible in network calls
})
.catch(e => {
console.log(e)
})
}
**My question, is it safe to use this implementation ? **
I am able to authenticate user with recommended authorization code flow but it seems this has security threat as JWT token returned is visible in network calls