Authorization Code Flow support

[lgleim]

When are you planning to add support for the Authorization Code Flow?

Should be reasonably easy given that you already implemented all logic for identity, access, and refresh tokens, including refreshing the access token with the refresh token - or am I missing something?

[manfredsteyer]

can you create a pull request?

[DavidParks8]

Is there a technical reason you want support for the authorization code flow? It was not designed for use with client side applications. According to the specification, the Authorization Code flow is suitable for Clients that can securely maintain a Client Secret between themselves and the Authorization Server. Angular apps are not able to maintain such a secret.

[lgleim]

Some OIDC Servers implement authorization code flow with shortlived refresh and id tokens. Keycloak (cf. https://keycloak.gitbooks.io/documentation/content/server_admin/topics/sso-protocols/oidc.html, js adapter code: https://github.com/keycloak/keycloak/tree/master/adapters/oidc/js/src/main/resources) would be an example of that.
And when you consider it a problem for the client to be able to access the refresh/id token, supporting the direct access grant flow is certainly much more of a concern. Nevertheless there is a plethora of (especially hybrid mobile) apps that handle password entry right in the web app.

[manfredsteyer]

Yes, Code Flow for a SPA seems to be a gray zone and can be used safely. But it is not the indented way. I would prefere implicit flow with token refresh (which is possible without refresh_tokens by leveraging a well known hack).

[manfredsteyer]

As the next version of this lib (lands i a few days) is supporting silent refresh with implicit flow there is IMHO no need for code flow for browser scenarios. When it comes to hybrid scenarios (cordova, ionic) it would make sense. I would accept PR on this and there is a pull request for hybrid flow which contains a lot of code that can be used when writing support for code flow.

I would suggest to introduce a new method initCodeFlow(...) for this.

[manfredsteyer]

Oh, if anyone creates a PR for this, please have a look at the RFC about Code Flow and mobile apps.

[sbueringer]

What do you thing about the Authorization Code Flow with PKCE for SPAs? (https://tools.ietf.org/html/rfc7636)

[manfredsteyer]

If think, when we are implementing Code Flow we should also implement PKCE alongside b/c this is THE way to go for mobile apps/ hybrid apps. When it comes to web apps, I would prefer Implicit Flow + Silent Refresh.

Do you have a current project where code flow + PKCE is needed?
If yes, when would you need it?
If yes, would you be interested into contributing such an addition?

[sbueringer]

I'm not sure if we're going to use code flow with PKCE, yet. I'll get back to you when I know.

If we're going to use it, I would absolutely be interested in contributing this addition.

[manfredsteyer]

Cool, just reach out in case.

[CallumBrankin]

+1 for Authorization Code Flow.

[khamlaoui]

+1 Authorization Code Flow