Authorization Code Authentication Flow Implementation Discussion

Hello Johar,

Thank you for posting question on Microsoft Windows Forum.

Based on the provided error message "The connection for this site is not secure / localhost sent an invalid response". The possible cause for that error might be of how the redirect URI is registered vs how the browser is actually connecting to it (HTTP vs HTTPS, port mismatch, or an untrusted local cert).

On the other hand, when you registered an https://localhost… redirect but your local redirect endpoint is not serving a valid TLS certificate or (the browser will not trust the cert). The browser then blocks the callback and shows “site is not secure / invalid response”.

The following are some suggested troubleshooting steps for this issue.

1.Change Redirect to Loopback HTTP.

• In Azure AD → App Registration → Authentication → Add your chosen Redirect URI like http://localhost:53123 under Mobile and desktop applications.
• Update your app to listen on that port and to expect the authorization callback there.
• Try the auth flow again. Browser will do an HTTP callback — no TLS required — this will probably remove the “site not secure” error.

2.If You Need HTTPS Redirect.

• Keep https://localhost:port in registration.
• Ensure your local server uses a TLS cert trusted by the OS/browser (trust the dev cert). Tools: dotnet dev-certs https --trust (for dotnet dev), or mkcert to create and trust local CA certs.
• Once the certificate is trusted, the browser will accept the callback.

For further reference regarding your concern.

• https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/web-apps-apis/authorization-codes

Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same issue too.