We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications.
Would it be better to use a http-only cookie?
Example of request to the API using the Angular quickstart:
- Request URL: https://my-app.com/my-resource - Request Method: GET - Response Headers Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://my-app.com - Request Headers Authorization: bearer eyJhbGciOiJSUzI1N............. Origin: https://my-app.com Referer: https://my-app.com/ User-Agent: Mozilla.............
Link to the angular quickstart: https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-angular2