Using Kratos for a Client Side Rendered SPA

[ibrahimbutt]

All SPA examples, as far as I can see, assume Next.js is being used. However, we are building a CSR SPA, for which the Authorization Code Flow with PKCE is recommended, or more recently, the BFF pattern.

This leaves me with the question, is Kratos suitable for A CSR SPA? If so, is there an example kratos.yml?

[vinckr]

Hello @ibrahimbutt

This blogpost might help understand how Ory works with SPAs and so on: https://www.ory.sh/blog/auth-and-modern-software

[ibrahimbutt]

Nothing outright, but I'd imagine yes based on:

At Ory, we decided that Kratos should use cookies (httpOnly) when using browsers, and tokens when using native applications.

Thanks.

[vinckr]

correct, the short answer is yes :D