Assuming the need for OAuth
Imagine an application that is:
- A single page web application hosted on S3
- Authenticated using implicit OAuth flow implicit
- Have the web application access resources with their JWTs
I understand that conventionally, the session has been stored in an http-only cookie. Where, what is essentially a proxy server which hosts the client, is responsible for accessing resources using the session stored in a cookie.
While the former approach simplifies development and is more akin to native app development, is it too insecure to be a technique to be considered?
What type/size of project would be an example of an acceptable use case? Twitter? Reddit? Finance Provider? Banking institution?