Does it make sense to use authorization code flow in a SPA I

Question

Does it make sense to use authorization code flow in a SPA I mean I could use resource owner password flow for the SPA

limited-tent-11422 · Answer

Resource Owner Password Credentials flow is deprecated as it leaks credentials to the client application

limited-tent-11422 · Answer

It is even completely omitted from OAuth 2 1 specification

magnificent-energy-493 · Answer

Thanks Stepan We also have a blogpost going a bit into some unsafe OAuth2 0 practices for SPAs and what you can use instead <https www ory sh oauth2 for mobile app spa browser avoid the oauth2 resource owner password credentials flow>

magnificent-energy-493 · Answer

Also check out this more recent tutorial if you want to add sign up and login to a SPA it will be much less complex than PKCE <https www ory sh login spa react nextjs authentication example api open source >

silly-telephone-79802 · Answer

< magnificent energy 493> Your next app IS using Resource Owner Password Credentials Flow

steep-lamp-91158 · Answer

that example is not using OAuth in any way it uses Kratos and its API flows

steep-lamp-91158 · Answer

I recommend to move this to either < C012RBW0F18|hydra> or < C012RJ2MQ1H|kratos> depending on what you actually use

silly-telephone-79802 · Answer

Why doesnt it throw the Error that the Request has Origin header when it is utilizing an API Flow

steep-lamp-91158 · Answer

gt Then we will add Ory s Next js Edge Integration helpers to our project which will act as a tunnel to Ory Kratos

steep-lamp-91158 · Answer

i e there is a backend proxy between the SPA and kratos

silly-telephone-79802 · Answer

So it fakes a resource owner password grant

steep-lamp-91158 · Answer

this has nothing to do with oauth2

steep-lamp-91158 · Answer

it just posts the credentials and gets a session cookie as a response

silly-telephone-79802 · Answer

hmm and because it uses a session cookie instead of bearer or MAC token it is considered to be not oauth2

steep-lamp-91158 · Answer

kratos is no oauth2 provider it only allows first party login it does NOT use oauth2

steep-lamp-91158 · Answer

it has it s own APIs and stuff not related to oauth2 which is a standard that dictates all the APIs

silly-telephone-79802 · Answer

understood

miniature-pillow-89683 · Answer

As others mentioned resource owner password flow is not a good option and the spec mentions not to go with it unless you really trust the client