We have a few backend services that our frontend SPAs fetch data from. Right now, the SPAs use JS libraries to authenticate with the Auth server (Azure AD) which returns a JWT which is validated by my backend services before responding to the requests. We also have a couple of native mobile apps and they too are using platform specific libraries for auth. This works fine for now.
But slowly the number of our SPAs are increasing and it is becoming a pain to write and maintain the same auth code in all the applications. Moreover, we are also looking to deploy our apps on-premise for some of our clients who might have separate auth needs (say Auth0 or Okta). This is also true for our native mobile apps.
As such, I was thinking of removing authentication handling from our SPAs and proxy all requests through a reverse proxy like NGINX which can also authenticate requests by redirecting them to a sign-in page.
But, I don't know if this will help us in doing something similar in a native mobile app. As far as I understand, since the client is not requesting a page everytime it loads (like an SPA does), I am not sure where exactly the popup(or maybe redirection?) should happen in a mobile app. Or is that even possible? Is using platform specific auth SDKs the only way in a mobile app? If so, is there a way (or a library) that is not auth provider specific and I can switch out auth easily?
