3 ms·
I had the same setup and was dissapointed with OAuth/OpenID Connect same as you, as there is NO way to make that work with modern flows. Your only option is to
by littlecranky67 2y ago
I had the same setup and was dissapointed with OAuth/OpenID Connect same as you, as there is NO way to make that work with modern flows. Your only option is to use the implicit flow and store refresh/access token in localStorage.
The "modern" code flow involves a piece of backend code that performs the exchange of the code for tokens - and you are actually not supposed to make those token available to the (insecure) browser.
- taeric 2y agoBeing fair, the code flow can be done on the client. And it does protect from most of the URL sniffing attacks that are there for the implicit flow. It just feels weird to still be doing all of that from the client.
- littlecranky67 2y agoI'd be genuinely interested how you can do the code flow on the client (browser). So far, all OAuth providers I tested will not let you do that due to CORS issues.