Question

A development team is building a public single-page application (SPA) that runs entirely in the user's browser and must authenticate users against a corporate identity provider using OAuth 2.0. Because the SPA cannot securely store a client secret, the security architect must recommend the appropriate authorization flow to prevent authorization code interception attacks. Which approach should the architect recommend?

Accepted Answer

Use the Authorization Code flow with PKCE (Proof Key for Code Exchange)

Answer

Use the Implicit flow to return the access token directly in the redirect URI

Answer

Use the Resource Owner Password Credentials grant so the SPA collects the user's password directly

Answer

Use the Client Credentials grant with an embedded client secret in the JavaScript bundle