Any up to date getting started with React and Ory?...
# talk-kratos
e
Any up to date getting started with React and Ory? I have a golang backend, and a React SPA frontend, the only guide I could find is the getting started, integrating ory into react guide , which misleadingly titled, covers only protecting a page. Nothing about sessions, login, registration, recovery... I am thinking of following the node guide. My question is, since this is a SPA, can I handle all of the authentication logic on the frontend side? Basically the golang server wouldn't have to call any APIs? Or should I do the opposite and actually make the frontend go through the backend and call the
FrontendAPI
like its described here. Basically is there any benefit to one or the other? I've went through the docs and still left a bit puzzled, especially since the
Flows for Browser
api's are marked as experimental. Any guidance would be super useful! For now I just wanna add password auth, before looking into webauthn and other options, I am only using Kratos and will later add Oathkeeper
a
Make authentication api calls go through the backend: better security, browsers won’t know that you are using kratos, kratos can even be hosted in your private network. Cons: lot’s of coding proxying all auth calls. Handling everything on the frontend would be be the quickest, but you need to at least call kratos from your backend to validate the session and get the user identity ID. (We’re making a solution that bootstraps golang microservices using ory for auth under the hood. Planning to opensource soon https://hoodoo.sh/ )
d
Yes, you can do all the flows in a SPA
You get your React app to login through Kratos, which sets a cookie. Your Golang API needs to check that requests from your app are authorised by calling whoami / toSession with the client’s cookie