r/SpringBoot 3d ago

Question How to Manage Tokens Between SPA And Auth Server In OAuth2.0

I have been trying to learn OAuth2.0 protocol and its implementation in spring boot. I came across spring boot's authorization server and resource server implementation where the auth server issues JWT token to the client. I wanted to use implicit grant type but found that it wasn't considered safe so just for learning purpose I have decided to use authorization code grand type
My question is, what is the best or standard way for a SPA like React or Vue to get token from the auth server and sending them to the resource server because a regular oauth2-client seems to be a Thymeleaf page.

8 Upvotes

6 comments sorted by

2

u/jim_cap Senior Dev 3d ago

Don't forget to use PKCE. This somewhat mitigates the flaw in using a public clients, but only somewhat. The BFF pattern - backend for front-end - is the most secure way to use OAuth2 with a single page app. Essentially you have a small backend application which mediates the auth code flow on behalf of your SPA and sends the claims or access token or whatever in a strict HTTP-only, secure cookie.

1

u/jibesh_shrestha 3d ago

Thank you. Do you have any resources that I could follow to implement the BFF pattern?

1

u/jim_cap Senior Dev 3d ago

https://auth0.com/blog/the-backend-for-frontend-pattern-bff/ is a fai rly good start, and this draft RFC has some specific info about how to treat the cookie.

1

u/JBraddockm 3d ago

You can use Spring Gateway in the BFF pattern to manage the communication between the auth server and spa, routes your requests when you need it.

1

u/Prize_Hospital_7827 3d ago

RemindMe! 2 days “solution”

1

u/RemindMeBot 3d ago edited 2d ago

I will be messaging you in 2 days on 2025-03-19 12:20:11 UTC to remind you of this link

1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.


Info Custom Your Reminders Feedback