OAuth 2.0, OpenID Connect, and a Browser SPA: How Identity Server and SPA App Talk
Authentication looks simple until you ship it across several products, several domains, and more than one way to sign in. We put login in one place: an identity service that authenticates the user once and issues tokens other apps can trust. Browser apps use Authorization Code + PKCE . We also have SSO and Google/Facebook on the identity server, not in each SPA. This is how we actually built it,…
Authentication can seem straightforward, but implementing it across multiple products, domains, and sign-in methods introduces complexity. To address this, we introduce an identity service that handles user authentication and issues tokens. This approach allows browser apps to utilize Authorization Code + PKCE, while also incorporating Single Sign-On (SSO) and social logins from Google and Facebook.
Our implementation involves a dedicated identity provider (IdP) that handles user credentials, issues tokens, manages sessions (including SSO), and publishes JWKS for token verification. The SPA communicates with the IdP, receiving access, ID, and refresh tokens which are used to access APIs without re-entering credentials. The IdP cookie enables SSO, allowing users to access multiple apps without repeated logins.
Social login is handled by configuring the IdP to authenticate with Google and Facebook, directing users to our authentication page where they can sign in using their Google or Facebook accounts. Once authenticated, tokens are issued and shared between the SPA and APIs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
