SPA with Authorization Code Grant

[markd]

This is actually a recommended approach in the current draft for using OAuth with SPAs:

OAuth 2.0 for Browser-Based Apps

I would recommend reading the whole draft, and also recommend reading Vittorio Bertocci’s blog post on the subject:

OAuth2 Implicit Grant and SPA