Azure AD B2C - how is username/password exchanged for id_token?

Question

We have a project in development that uses Azure AD B2C exclusively to authenticate users. I am in the process of preparing some documentation on how the login flow works, tracing it in Fiddler.

For a user that correctly submits their username and password to the form rendered by login.microsoftonline.com, I understand they get an id_token in response, which they then present to our website to have their authentication validated and establish a session.

In Fiddler, I see the POST to ourtenant.onmicrosoft.com which includes the correct username and password. The response body is "{"status":"200"}" with a bunch of set-cookie headers (content omitted for brevity).

x-ms-cpim-slice
x-ms-cpim-dc
x-ms-cpim-cache
x-ms-cpim-trans

Following this, I see a GET to ourtenant.onmicrosoft.com which includes the above cookies, and ourtenant.onmicrosoft.com responds with a blob of HTML which contains the id_token in a hidden field.

My question is, in simple terms, how does Azure AD B2C correlate the correct username/password entry in the first POST to the id_token provided in response to the proceeding GET?

My rookie guess is that it uses the x-ms-cpim-cache cookie and, if so, I just want to understand what it stores and how robustly it's protected.

Answer 1

As far as the contract is concerned, cookies are internal to B2C. Since they are generated and consumed by B2C service, the internal structure can be changed anytime.

Passwords are validated in the same request in which the user provides them, and then discarded.

B2C keeps track of the progress a user has made in the authentication process using cookie(s). Such cookie(s) are encrypted. Beyond that, it does not help to state what's in these cookie(s). Today, it could be a GUID that allows B2C to store some state in a DB, tomorrow it could be some short-lived security tokens, etc.