Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended flow seems to be the Authorization Code Flow.

With a stateless Backend of multiple microservices, how would a implementation of Authorization Code Flow possible in an SPA?

I understand, that you could use PKCE in the Browser also nowadays in order to protect from somebody who intercepts the code from the redirect URL.

If you would perform the exchange from code to token on the client, you would get the id_token and access_token in a safe way via a CORS request. But what to do with it now? I understood, that storing it in Local- or SessionStorage is not a safe way since those tokens could be leaked.

So I struggle between introducing state on the server and potentially insecure storage of the token.

What is the default recommendation for such a scenario?

  • Best to store the tokens in memory without any persistence. As long as the user has an active session at the IdP, you should be able to use silent authentication to renew/get a new token, for example when reloading the page or revisiting, without user interaction, not? auth0.com/docs/api-auth/tutorials/silent-authentication – Mathias Conradt Jun 18 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.