title: Why the ZUMO token returned by Easy Euth from Azure App Service is absent in a popup scenario?
body: <p>When using the Easy Auth authentication feature of Azure App Service, one can start the authentication process by directing the user to <code>https://my-app.azurewebsites.net/.auth/login/{provider}</code>.</p>
  
  <p>The user is then redirected to the provider login page, and then redirected again to the URL specified on the app declared in the provider (usually <code>https://my-app.azurewebsites.net/.auth/login/{provider}/callback</code>). Then the Easy Auth module redirect to the generic page <code>/.auth/login/{provider}/done</code> indicating that the authentication is successful.</p>
  
  <p>This generic page can be replaced by providing the parameter <code>post_login_redirect_uri</code> in the login URL. With this, the last redirection is not done toward the generic page but to the specified URL.</p>
  
  <p>In this final page, Easy Auth normally add the token which it generated, in the URL after the fragment (#). e.g. : <code>https://my-app.azurewebsites.net/login#token={"authenticationToken"%3A"eyJ0eX[...]</code>.</p>
  
  <p>If I try this workflow in my browser, directly in the address bar, it works (all redirections are done and in the final page, the token is present after the fragment), but as soon as I integrate it in my app in a popup (so opening <code>https://my-app.azurewebsites.net/.auth/login/{provider}?post_login_redirect_uri=[...]</code> in a new window in Javascript with <code>window.open()</code>), the token is <em>not</em> returned by Easy Auth.</p>
  
  <p><strong>Is this behavior of not returning the token if the login URL is opened in a popup normal ?</strong> From the server point of view, I don't see the difference between opening the URL in the address bar or in a popup so I don't explain this behavior.</p>
  
  <p>I tried on Chromium, Firefox and Edge and the result is the same.</p>
  
  <p>This problem seems to be evoked on this post : <a href="https://stackoverflow.com/questions/44893784/how-to-gain-access-tokens-using-azure-easy-auth">How to gain access tokens using Azure Easy Auth?</a> but I'm not sure it's the same since I can see a token in the fragment by opening the URL directly in the browser. The solution provided on this post is not applicable in my scenario since my app is on a separate server (different domain) from the API where Easy Auth is enabled (thus I cannot use the <code>AppServiceAuthSession</code> cookie neither). </p>