My application consist of a web client (implemented in angular or reach) and rest web service, both hosted on different servers. For implementing the OAuth2.0 login for Google, Facebook etc., should i implement the same on client side or server side and why?

  • 2
    Your question is too broad. Narrow it down to the specific design-related problem you are having. Commented Apr 19, 2018 at 18:55
  • When you say "client side" to you mean your "web client"? Typically, client side is the the users browser. If you mean the user's browser, then you want to authenticate on the server, never the client. Clients can be altered and messed with. You can never trust a client only to validate anything.
    – Chillie
    Commented Apr 19, 2018 at 19:10

1 Answer 1


It tends to depend on who is logging in.

If the user is logging in, then you can do it client side. ie. Hit the auth server, enter the username and password, get the token, send the token to whatever server to get whatever data.

If a service account is logging in, say you are using your own google maps account to do postcode lookups or something. Then you do it server side because otherwise it would expose your password to the users.

If you are authenticating the user based on a token you got through either method though, then you obviously have to do that part server side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.