Issue using Lock in SPA for API authorization and MFA

[jmangelo]

The underlying protocols (OAuth2/OIDC) rely heavily on HTTP redirects so in most situations authentication in a pure AJAX style is not available (assuming you meant AJAX style with delivered in a payload). For some scenarios libraries can abstract the above for you and deliver the response as if it was an AJAX call, but trying to completely avoid redirect-based processes is fighting the protocols you’re using. If you just don’t want the response to be in a query string you can consider the form post response mode.