Yep exactly, I wrote some sample code for doing that here: • Aaron Parecki

43°F

sentenza https://twitter.com/delphinauge • Jun 13
@oktadev @oauth_2 @aaronpk What is the current OpenId Connect recommendation for a SPA without a dedicated backend, is it Auth Code Flow + PKCE in Browser?
#oauth #openidconnect

Yep exactly, I wrote some sample code for doing that here: https://developer.okta.com/blog/2019/05/01/is-the-oauth-implicit-flow-dead

Portland, Oregon

Thu, Jun 13, 2019 9:56am -07:00

3 replies
Have you written a response to this? Let me know the URL:
- sentenza twitter.com/delphinauge
  
  Yes, there is some lack of clarity how all the flow variants compare. It's just clear now that implicit flow is disregarded, even though it's still "out there"..
  
  Thu, Jun 13, 2019 5:24pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  yeah, having a backend is much more secure. I feel like this needs to be my next blog post.
  
  Thu, Jun 13, 2019 5:21pm +00:00 (via brid-gy.appspot.com)
- sentenza twitter.com/delphinauge
  
  Thanks, what are the implications of storing the tokens in the browser? Is Auth Code Flow with a backend server much more secure?
  
  Thu, Jun 13, 2019 5:20pm +00:00 (via brid-gy.appspot.com)

Posted in /replies using monocle.p3k.io