My application is a hybrid approach, using ASP.NET Core MVC as the backend. I have various controllers that my frontend uses to pull data from the database and make API calls on MS Graph. I use the following program.cs file to initiate authentication when a user logs into the website for the first time:

//authentication pipline
builder.Services.AddHttpContextAccessor();
var initialScopes = builder.Configuration.GetValue<string>("DownstreamApi:Scopes")?.Split(' ');
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(options =>
                {
                    builder.Configuration.Bind("AzureAd", options);
                    options.Events = new OpenIdConnectEvents
                    {
                        //Tap into this event to add a UserID Claim to a new HttpContext identity
                        OnTokenValidated = context =>
                        {
                            //This query returns the UserID from the DB by sending the email address in the claim from Azure AD
                            string query = "select dbo.A2F_0013_ReturnUserIDForEmail(@Email) as UserID";
                            string connectionString = builder.Configuration.GetValue<string>("ConnectionStrings:DBContext");
                            string signInEmailAddress = context.Principal.FindFirst   Value("preferred_username");

                            using (var connection = new SqlConnection(connectionString))
                            {
                                var queryResult = connection.QueryFirst(query, new { Email = signInEmailAddress });

                                var claims = new List<Claim>
                                {
                                    new Claim("UserID", queryResult.UserID.ToString())
                                };

                                var appIdentity = new ClaimsIdentity(claims);

                                context.Principal.AddIdentity(appIdentity);
                            }

                            return Task.CompletedTask;
                        },
                    };
                }).EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
                        .AddMicrosoftGraph(builder.Configuration.GetSection("DownstreamApi"))
                        .AddInMemoryTokenCaches();

//Add Transient Services
builder.Services.AddTransient<IOneDrive, OneDrive>();

builder.Services.AddControllers(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
}).AddMicrosoftIdentityUI();

builder.Services.AddRazorPages().AddRazorPagesOptions(options =>
{
    options.Conventions.AllowAnonymousToFolder("/Login");
    options.Conventions.AuthorizeFolder("/");
    options.Conventions.AuthorizeFolder("/files");
}).AddMicrosoftIdentityUI();

// Add the UI support to handle claims challenges
builder.Services.AddServerSideBlazor()
   .AddMicrosoftIdentityConsentHandler();
builder.Services.AddRequiredScopeAuthorization();

In the Azure AD portal, my application is registered as a web application. Therefore, when users initially visit the website, they are redirected to https://login.microsoftonline.com/blahblah to begin the login process. This is performed automatically by the Azure AD identity platform. Then, once the login occurs, they are redirected to the localhost (localhost:43862) where VueJS spa is loaded. My spa uses various axios requests to controllers, which pull data, and vue router to load components. However, my problem is that the user needs to log back in because the cookie has expired or they logged out in another tab. The next axios request from an expired session does not redirect the user to the Azure login screen but results in a CORS error. So I need to have my axios request force the page to redirect to the Azure AD login screen (which is probably the worst idea since the CORS policy will cause errors), or have it redirect back to localhost/login, which is what I Your own custom login screen using the Azure AD login button should not affect CORS. So how do I intercept this Azure AD redirect to the Azure AD login and replace it with my own?

I also tried returning a 401 error code so I could check for that in the axios request, but to no avail, it does nothing. If I put a breakpoint there, it does hit this code, but it doesn't change the status code of the response, I still get a 302. My code is trying to add to the event:

OnRedirectToIdentityProvider = context =>
                    {
                        context.Response.StatusCode = 401;
                        return Task.CompletedTask;
                    }

My other thoughts are maybe I should set up the CORS policy to allow redirects from login.microsoft.com? Or is this bad practice?