title: CORS Configuration for Azure AD B2C Page UI Customization
body: <p>I'm using a custom page UI template for my Azure AD B2C sign in/sign up and I want to know what domain I need to use in <code>CORS</code> configuration in my Azure Blob Storage account.</p>
  
  <p>Login page seems to come from <code>https://login.microsoftonline.com</code>. Is that the correct origin?</p>
  
  <p>When I use the <code>StorageClient</code> command line tool Microsoft created for uploading my custom UI files to my Azure Blob Storage, I've noticed that it sets it to <code>*</code> for <code>Allowed Origins</code> which the documentation indicates as well. Here's the documentation: <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-ui-customization-custom-dynamic#step-3-configure-cors-in-azure-app-service" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-ui-customization-custom-dynamic#step-3-configure-cors-in-azure-app-service</a></p>
  
  <p>I don't think this is really secure and I want to limit it to only those domains that are absolutely necessary.</p>
  
  <p>I want to do this for two reasons, both of which are pretty important:</p>
  
  <ol>
  <li>I want to keep security as tight as possible and allowing any origin doesn't seem secure.</li>
  <li>More importantly, <code>CORS</code> is set at service level on Azure Blob Storage and not container level. I have other containers under the same storage account that contain user files. Those files should only be accessible from my app which creates a SAS to allow access to them. If I set the <code>Allowed Origins</code> for <code>CORS</code> to any, it will make my app less secure even though the protected files will still require a SAS. As I said before, I want to keep security as tight as possible.</li>
  </ol>
  
  <p>So, the question is: what URL should I enter under <code>Allowed Origins</code> in my <code>CORS</code> configuration for Azure AD B2C? I don't just want to make the assumption that it's <code>https://login.microsoftonline.com</code> because Microsoft usually does a few redirects in their services and I want to make sure all the necessary origins are included.</p>