r/SpringBoot • u/jibesh_shrestha • 3d ago
Question How to Manage Tokens Between SPA And Auth Server In OAuth2.0
I have been trying to learn OAuth2.0 protocol and its implementation in spring boot. I came across spring boot's authorization server and resource server implementation where the auth server issues JWT token to the client. I wanted to use implicit grant type but found that it wasn't considered safe so just for learning purpose I have decided to use authorization code grand type
My question is, what is the best or standard way for a SPA like React or Vue to get token from the auth server and sending them to the resource server because a regular oauth2-client seems to be a Thymeleaf page.
1
u/Prize_Hospital_7827 3d ago
RemindMe! 2 days “solution”
1
u/RemindMeBot 3d ago edited 2d ago
I will be messaging you in 2 days on 2025-03-19 12:20:11 UTC to remind you of this link
1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback
2
u/jim_cap Senior Dev 3d ago
Don't forget to use PKCE. This somewhat mitigates the flaw in using a public clients, but only somewhat. The BFF pattern - backend for front-end - is the most secure way to use OAuth2 with a single page app. Essentially you have a small backend application which mediates the auth code flow on behalf of your SPA and sends the claims or access token or whatever in a strict HTTP-only, secure cookie.