Setting up a SPA + API combo with React and .NET Core

Unfortunately that guide involves authorising the SPA through the implicit flow which is ‘deprecated’.