We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access tokens via the keycloak JS adapter.
However, recently, I've been seeing some emails in the ietf mailing list indicating that Auth code flow should be preferred over implicit flow due to security issues of having access tokens show up in browser history and/or log files (if any SSL termination/inspection is in place/etc).
I understand the security concerns with having an AT show up anywhere in a log file. I do not, however, understand how the Auth Code flow can be considered as more secure, or why it should be preferred over Implicit flow. Isn't having the Refresh Token in the browser/SPA a higher security risk than having a short-lived AT in a log file?
What is the preferred mechanism to use today for an SPA? Is there a recommended approach?