My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario.
I know Oauth 2 authorization with implicit grant type is recommended for public clients (in my situation, a SPA). I have read lots of things about that but I couldn't understand some points, so I'm asking for your help:
Do you think Oauth 2 with implicit grant type is the best way to accomplish this? I know password credentials grant type is not safe for SPAs, because they can not maintain the confidentiality of a client secret. So should I go with Oauth 2 with implicit grant type?
In Oauth 2, i can use the implicit grant type with auto approval, so taking the consent of users are not necessary anymore. But as i think of my SPA as a first party app, i don't want any users to redirect anywhere to login and get back to SPA page.
Do you think it is secure and sensible to enable http basic authentication for my API, so then my first party app would be able to get user credentials and add it to authorization header and sent to my Authorization server over SSL/TLS channel to authenticate and get access token?
If it is not appropriate, what do you recommend to achieve this goal?
I want also unauthenticated users to consume some resources in my SPA; should I make those resources public for any client and any user (actually I don't prefer) or expect SPA to authenticate and authorize with a dummy anonymous user to get an access token with anonymous privileges to consume public API resources.
For a Wikipedia-like website, how long should it take an access token to expire?
When it is expired, what method should I follow? There is no refresh token in OAuth 2 implicit grant type. Should I ask users to enter their credentials again (this is not user-friendly) or store their credentials in a storage and sent it to an authorization server silently to get a new access token?