I'm building an app involving my own first party authentication service and third party authentication services (such as Google, Facebook etc.)
I decided to go through the OAuth2 Authorization Code Flow for my own first party authentication service and build it with Node.js.
So i have an Angular SPA, a Node.js authorization server and of course a Node.js API.
If i follow the OAuth2 Authorization Code Flow with PKCE challenge, my Angular SPA is supposed to :
- The user click on the login button
- The SPA generate a PKCE code and challenge
- The SPA send the PKCE code to /oauth2/auth
- The authorization server request the user approval (so it displays a login form if the user isn't authenticated yet)
- The authorization server redirect the user on the SPA with an authorization code
- The SPA request an access token providing the PKCE challenge and the authorization code
- The authorization server issue an access token and we are good.
My question is : is it possible in the step 4 to use the SPA itself as a login form of the authorization server ?
I don't want my Node.js app to render any HTML content and in all examples i see on the web they pretend that the authorization service has its own login form.