[Question] OAuth

[YoussefSalameh]

Hello everyone ,

After downloading an application template 4.1.2 with angular interface and with separate identity server
I noticed that in the environment.ts under OAuthConfig there's a response Type: "code " as below
oAuthConfig: {
issuer: 'https://localhost:44392',
redirectUri: baseUrl,
clientId: 'AngularTest_App',
responseType: 'code',
scope: 'offline_access AngularTest',
},
I need to make sure that if the template is only configured to use authorization_code as grant type or can I use a different response type such as "token" ?

[YoussefSalameh]

@ZouZou

[maliming]

See #7610

[hikalkan]

@mehmet-erim what can you say?

[ZouZou]

According to what we understood about the flows is
OAuth 2.0 flows

• Authorization code used when there is front channel + back channel
• Implicit used when there is front channel only
• Resource owner password credentials used when there is back channel only
• Client credentials used when there is back channel only
  And the Angular app is considered as a front channel only, so shouldn't we be able to use responseType: 'token'?

[mehmet-erim]

Hi @YoussefSalameh

ABP only supports the authorization code flow. So if you set oAuthConfig.responseType to 'token' or 'id_token', you cannot log in.

[hikalkan]

Actually, the account module only supports it because we only implemented it. That's not related to the framework. You can download the source code of the account module and customize it. However, authorization code flow is the suggested way for SPAs. See https://docs.identityserver.io/en/latest/topics/grant_types.html#interactive-clients and https://auth0.com/docs/authorization/which-oauth-2-0-flow-should-i-use#is-the-client-a-single-page-app- for references.