Constrain Graph v4 authentication to the configured origin

[Ignacio Inglese (iNinja)]

Summary

• Bind Graph v4 authentication to the configured or factory-created HTTPS origin.
• Attach credentials only when the request destination matches that origin, including after request customization.
• Preserve the Graph SDK default URL and custom Graph proxy support through the client's effective base URL.

Release notes

Graph v4 authentication now attaches credentials only to absolute HTTPS request destinations matching the configured client origin. Requests for other destinations continue without an authorization header. Blank base URL configuration continues to use the Graph SDK default, while custom factories must return a client with an absolute HTTPS base URL.

Testing

• 73 focused provider and registration tests passed on .NET 8.
• Stable and Beta Graph projects built successfully across their configured target frameworks.

[Copilot]

Pull request overview

Constrains Graph v4 authentication tokens to the configured HTTPS origin, including custom Graph proxies.

Changes:

• Validates request origins before and after customization.
• Binds factory-created clients to their HTTPS base URL.
• Adds focused origin-validation and factory tests.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Microsoft.Identity.Web.MicrosoftGraph/TokenAcquisitionAuthenticationProvider.cs	Implements origin binding and validation.
src/Microsoft.Identity.Web.MicrosoftGraph/MicrosoftGraphExtensions.cs	Binds factory clients to their origin.
src/Microsoft.Identity.Web.MicrosoftGraph/GraphServiceCollectionExtensions.cs	Binds configured Graph clients securely.
src/Microsoft.Identity.Web.MicrosoftGraph/Properties/InternalsVisibleTo.cs	Enables internal provider testing.
tests/Microsoft.Identity.Web.Test/TokenAcquisitionAuthenticationProviderTests.cs	Covers URI validation and authorization cleanup.
tests/Microsoft.Identity.Web.Test/WebAppExtensionsTests.cs	Covers custom factory base URLs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.