Forum Discussion

yoelh's avatar
yoelh
Icon for Microsoft rankMicrosoft
Mar 17, 2023

Azure AD B2C authorization code and refresh token size increase update

Update September 11, 2023: This post is irrelevant anymore   As part of ongoing security improvement efforts in Azure Active Directory (AAD), part of Microsoft Entra, Azure AD B2C will be rolling...
Azure AD B2C
Florian Wachs's avatar
Florian Wachs
Copper Contributor
Apr 19, 2023

Completley broke mission critical applications yesterday and today yoelh . I found this document while researching after I found out that the response codes are sometimes extrem long. Our awesome team managed to configure the servers (IIS) to mitigate the issue. This is very disturbing because this article seems to be the only mention of this change. I´m quite sure that many more people around the globe are riddled why their apps are "broken" until they find this article.

  • KStuber's avatar
    KStuber
    Copper Contributor
    Apr 20, 2023

    Florian Wachs If I might ask, what IIS server configuration mitigated this issue for you?

    • Florian Wachs's avatar
      Florian Wachs
      Copper Contributor
      Apr 20, 2023

      KStuber  Sure, here you go, please make sure to add / extend those blocks in the right place:

       

       

      <system.web>
    <httpRuntime maxUrlLength="4096" maxQueryStringLength="4096" />
</system.web>

<system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxUrl="4096" maxQueryString="4096" />
      </requestFiltering>
    </security>
</system.webServer>

       

       

       

      • KStuber's avatar
        KStuber
        Copper Contributor
        Apr 20, 2023

        Florian Wachs Thank you! That worked great. We did see URL lengths in the 5k-6k range, so we just had to bump up the values to accommodate. I really appreciate the reply!

Resources