Using SPAs as the UI in front of an API has become standard practice, with OAuth 2.0 / OIDC being the common authz mechanism for this. This approach generally entails the SPA receiving its access via the the authorization code flow or the implicit flow by first redirecting the user to an authorization server where they can log in and consent to the SPA's access.

I am having trouble determining if this approach can be used for the authorization server itself: in other words, use an SPA to generate the UI for a login form and have the user log in securely.

Naively, one could assume the resource owner password flow matches this criteria since it accepts a username and password. But it requires the client to be able to use a secret. An SPA can't do this.

Of course, I could design my own API to accept a username and password and respond with enough information for the SPA to work. But I am wondering if this portion is specified in any of the OAuth 2.0 or OIDC RFCs/specs, or if there is an alternative, highly-specified API for logging in users securely via an SPA that should be considered before rolling one's own.

  • Can the person who downvoted please help me understand how I can make my question more clear or useful?
    – Evan
    Jan 1, 2021 at 14:06
  • 1
    I believe the answer is yes, but I don't have time to properly research it for you with references. Ultimately, the user gets a UI via HTML, and that HTML may include Javascript which therefore means SPA. But it would only be that Login Page as a standalone SPA. You probably cannot have a SPA that view-routes to a third-party OAUTH URL - that would have to be a separate page load. Much of the security and user trust seems to stem from actual URL redirection. Jan 1, 2021 at 15:24
  • 1
    @Evan: part of the community here often downvotes for no apparent reason, and we will never get to know why, since they refuse to lift their anonymity by writing a comment. So don't take such a downvote personal, it is a community problem, not yours.
    – Doc Brown
    Jan 1, 2021 at 20:19
  • 1
    Currently facing the same problem. Did you find any answers?
    – Alex83690
    Apr 11 at 10:41


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.