What causes "token_endpoint must be a Microsoft login endpoint" in decolua/9router?

Use the standard endpoint host: https://login.microsoftonline.com/ /oauth2/v2.0/token.

token_endpoint must be a Microsoft login endpoint

Error message

token_endpoint must be a Microsoft login endpoint

What it means

Even a valid https URL is rejected unless its hostname is in MICROSOFT_TOKEN_ENDPOINT_HOSTS (login.microsoftonline.com and related Microsoft login hosts). This prevents token leakage to attacker-controlled https endpoints via a tampered token_endpoint.

Source

Thrown at src/lib/oauth/kiroExternalIdp.js:31

export function validateMicrosoftTokenEndpoint(rawEndpoint) {
  const tokenEndpoint = normalizeString(rawEndpoint);
  if (!tokenEndpoint) throw new Error("token_endpoint is required");

  let parsed;
  try {
    parsed = new URL(tokenEndpoint);
  } catch {
    throw new Error("token_endpoint must be a valid URL");
  }

  if (parsed.protocol !== "https:") {
    throw new Error("token_endpoint must use https");
  }

  const host = parsed.hostname.toLowerCase();
  if (!MICROSOFT_TOKEN_ENDPOINT_HOSTS.has(host)) {
    throw new Error("token_endpoint must be a Microsoft login endpoint");
  }

  return parsed.toString();
}

export function normalizeScope(scopes) {
  if (Array.isArray(scopes)) {
    return scopes.map(normalizeString).filter(Boolean).join(" ");
  }
  return normalizeString(scopes);
}

export function decodeJwtPayload(jwt) {
  try {
    if (!jwt || typeof jwt !== "string") return null;
    const parts = jwt.split(".");
    if (parts.length !== 3) return null;
    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");

View on GitHub (pinned to 90b52e06ff)

Solutions

Use the standard endpoint host: https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token.
If you must use a sovereign/alternative Microsoft host, check MICROSOFT_TOKEN_ENDPOINT_HOSTS in src/lib/oauth/constants or kiroExternalIdp.js and add it deliberately.
Remove any custom proxy host from the token_endpoint; if TLS interception is needed, configure it at the network layer on the standard host instead.
Fix hostname typos by pasting token_endpoint directly from the tenant's openid-configuration document.

Example fix

// before
validateMicrosoftTokenEndpoint("https://my-relay.example.com/microsoft/token");
// after
validateMicrosoftTokenEndpoint("https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token");

Defensive patterns

Strategy: validation

Validate before calling

const MICROSOFT_TOKEN_ENDPOINT_HOSTS = new Set(["login.microsoftonline.com", "login.microsoft.com", "login.windows.net"]);
const host = new URL(raw).hostname.toLowerCase();
if (!MICROSOFT_TOKEN_ENDPOINT_HOSTS.has(host)) {
  throw new Error(`token_endpoint host "${host}" is not a Microsoft login endpoint`);
}
validateMicrosoftTokenEndpoint(raw);

Try / catch

try {
  endpoint = validateMicrosoftTokenEndpoint(raw);
} catch (err) {
  if (err.message === "token_endpoint must be a Microsoft login endpoint") {
    throw new Error(`token_endpoint must point at login.microsoftonline.com (got "${new URL(raw).hostname}")`);
  }
  throw err;
}

Prevention

Use the canonical host login.microsoftonline.com; don't route OAuth through custom proxies or relays.
If you need a sovereign-cloud tenant, verify its host is in MICROSOFT_TOKEN_ENDPOINT_HOSTS and extend the allowlist deliberately.
Copy token_endpoint from the tenant's openid-configuration document to avoid hostname typos.
Treat any non-Microsoft token endpoint as a credential-theft risk — the allowlist exists to block it.

When it happens

Trigger: token_endpoint pointing at https://evil.example.com/token, a personal proxy/relay host, or a regional/alternate host not in the allowlist (e.g. login.partner.microsoftonline.cn if it isn't allowlisted), or a typo'd host like login.micrsoftonline.com.

Common situations: User routed Microsoft auth through a self-hosted proxy for network reasons; using a sovereign-cloud tenant endpoint that the allowlist doesn't cover; typo in the hostname; enterprise gateway re-hosting the login endpoint.

Related errors

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/2b07236fec8eeabb. Report an issue: GitHub.