Is it possible to use the SPA as a login form in the authorization code flow?

Viewed 148

I'm building an app involving my own first party authentication service and third party authentication services (such as Google, Facebook etc.)

I decided to go through the OAuth2 Authorization Code Flow for my own first party authentication service and build it with Node.js.

So i have an Angular SPA, a Node.js authorization server and of course a Node.js API.

If i follow the OAuth2 Authorization Code Flow with PKCE challenge, my Angular SPA is supposed to :

  1. The user click on the login button
  2. The SPA generate a PKCE code and challenge
  3. The SPA send the PKCE code to /oauth2/auth
  4. The authorization server request the user approval (so it displays a login form if the user isn't authenticated yet)
  5. The authorization server redirect the user on the SPA with an authorization code
  6. The SPA request an access token providing the PKCE challenge and the authorization code
  7. The authorization server issue an access token and we are good.

My question is : is it possible in the step 4 to use the SPA itself as a login form of the authorization server ?

I don't want my Node.js app to render any HTML content and in all examples i see on the web they pretend that the authorization service has its own login form.

0 Answers
Related