Adding Origin header on Postman OAuth 2.0 flow

Question

This question is related to the problem described in this question. During OAuth 2.0 authorization code with PKCE grant, Azure AD requires Origin header to be present on the request to /token endpoint. If header is not present, authorization flow fails with the following error:

Error: AADSTS9002327: Tokens issued for the 'Single-Page Application' 
client-type may only be redeemed via cross-origin requests

Unfortunately, Postman is not adding this header to the flow, hence the request for a token fails.

Is there a way to add a custom header into the requests that are executed behind "Get new access token" flow? I have tried adding headers to the request that the token is attached to, as well as "pre-request script". Neither of these methods helped.

Attaching a screenshot for reference

Answer 1

I tried to reproduce the same in my environment and got the results like below:

I created an Azure AD SPA Application:

To generate the access token, I used Authorization-Code flow + PKCE like below:

To generate the auth_code, try using the below link:

GET https://login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize?  
response_type=code  
&client_id=Client_ID
&scope=Your_scope 
&redirect_uri=Your_Redirect_URI 
&code_challenge=Your_code_challenge
&code_challenge_method=S256

The auth_code will be generated after sign-in like below:

Now, by using the below parameters, when I tried to generate the token got the same error as below:

grant_type=authorization_code
redirect_uri=YourRedirectURI
client_id=****
code_verifier=S256
scope=YourScope
code= auth_code

To resolve the error, make sure to add the header in the Header tab like below:

origin = yourredirecturi

After adding the header, I am able to generate the token successfully like below: