I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect URI happens on the backend. If it happens on the front end, I would need to use PKCE.
The confusion I have is that I saw this spec about Form Post Response at https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html Auth0 also had an article about it https://auth0.com/docs/login/spa/authenticate-with-cookies Since my SPA is hosted on the same domain as our backend, this looks to be a valid option. I do not see much info about this spec online.
I do not understand the difference between Authorization Code grant type and using Form Post Response. Wouldn't both the mechanisms send the access token to my backend? It would be great if someone can shed some light on this.