Forum Discussion

Microsoft

Mar 17, 2023

Azure AD B2C authorization code and refresh token size increase update

Update September 11, 2023: This post is irrelevant anymore As part of ongoing security improvement efforts in Azure Active Directory (AAD), part of Microsoft Entra, Azure AD B2C will be rolling...

Azure AD B2C

KStuber

Copper Contributor

Apr 20, 2023

Florian Wachs If I might ask, what IIS server configuration mitigated this issue for you?

Florian Wachs

Copper Contributor

Apr 20, 2023

KStuber Sure, here you go, please make sure to add / extend those blocks in the right place:

<system.web>
    <httpRuntime maxUrlLength="4096" maxQueryStringLength="4096" />
</system.web>

<system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxUrl="4096" maxQueryString="4096" />
      </requestFiltering>
    </security>
</system.webServer>

KStuber
Copper Contributor
Apr 20, 2023
Florian Wachs Thank you! That worked great. We did see URL lengths in the 5k-6k range, so we just had to bump up the values to accommodate. I really appreciate the reply!