Storing client secret in SPA

[markd]

Hello @reganm,

There is definitely no good way to handle secrets on the client side. This isn’t an Auth0 thing … the client is not under your control and can never be trusted. The old default way to handle SPA authentication was the implicit grant flow, but there is new guidance coming out on that front. The link below should be helpful:

SPA with Authorization Code Grant

This is actually a recommended approach in the current draft for using OAuth with SPAs: I would recommend reading the whole draft, and also recommend reading Vittorio Bertocci’s blog post on the subject: