Which OAuth 2.0 flow is recommended for single-page apps and mobile apps?
Options
- Implicit flow
- Resource Owner Password Credentials
- Authorization Code with PKCE (Correct option)
- Client Credentials
Answer
Authorization Code with PKCE
Why
Apps running on a user's device cannot keep a secret (anyone can inspect the code).
Authorization Code + PKCE adds a one-time random 'proof' so that even if someone steals the authorization code, they cannot exchange it for tokens.
The Implicit and Password flows are deprecated. Client Credentials is for server-to-server calls with no user.
Remember
Browser/mobile login with OAuth → Authorization Code + PKCE.