HttpClient to call Azure AD-protected site
<p>Following some Microsoft samples, I got to this point:</p>

<p><strong>ASP.NET Core setup:</strong></p>

<pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    ClientId = Configuration["Authentication:AzureAD:ClientId"],
    Authority = Configuration["Authentication:AzureAd:Authority"],
    ResponseType = OpenIdConnectResponseType.IdToken,
    AutomaticAuthenticate = true,
    TokenValidationParameters = new TokenValidationParameters()
});
</code></pre>

<p><strong>AuthorizationTest endpoint:</strong></p>

<pre><code>[HttpGet]
[Authorize]
public IActionResult Get()
{
    return Ok("SAMPLE TEXT - if you can read this then call it a day :)");
}
</code></pre>

<p><strong>Client:</strong></p>

<pre><code>try
{
   var result = await authContext.AcquireTokenAsync(WebApiResourceId, WebApiClientId, WebApiRedirectUri, new PlatformParameters(PromptBehavior.Auto));
   authorizedClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

   var authorizedMessage = await authorizedClient.GetAsync("/AuthorizationTest");
   var statusCode = authorizedMessage.StatusCode.ToString();
   var message = await authorizedMessage.Content.ReadAsStringAsync();
   webBrowser.NavigateToString(message);
 }
</code></pre>

<p>And the <code>authorizedClient</code> is initiated as:</p>

<pre><code>private static HttpClientHandler handler = new HttpClientHandler
{
    AllowAutoRedirect = true,
    CookieContainer = new CookieContainer(),
    UseCookies = true
 };
 private static HttpClient authorizedClient = new HttpClient(handler, false) { BaseAddress = WebApiBaseUri };
</code></pre>

<p>I used to initialize it only with the BaseAddress, and later added the handler following an answer here on So.  </p>

<p><strong>The problem:</strong><br>
Even though I get the token from AAD correctly, the response from the <code>WEB API</code> endpoint is an HTML (after an auto-redirect) that is the MS login page with the error "<code>Your browser is set to block cookies.....</code>"</p>

<p>What should I change to make the HttpClient work? Or can I change the WebApi configuration to not use cookies? For the latter option I couldn't find any other alternative.</p>