Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended flow seems to be the Authorization Code Flow.
With a stateless Backend of multiple microservices, how would a implementation of Authorization Code Flow possible in an SPA?
I understand, that you could use PKCE in the Browser also nowadays in order to protect from somebody who intercepts the code from the redirect URL.
If you would perform the exchange from code to token on the client, you would get the id_token and access_token in a safe way via a CORS request. But what to do with it now? I understood, that storing it in Local- or SessionStorage is not a safe way since those tokens could be leaked.
So I struggle between introducing state on the server and potentially insecure storage of the token.
What is the default recommendation for such a scenario?