A React single-page app hosted on a static site needs users to sign in with Entra ID and then call a protected REST API. Which OAuth 2.0 grant should the SPA's client registration use?
Show answer and explanation
Answer: A
Browser-based SPAs are public clients: anything shipped to the browser can be read, so they cannot keep a client secret confidential. The authorization code grant with PKCE solves this by having the app create a one-time code verifier and challenge, so an intercepted authorization code cannot be redeemed by anyone else. Microsoft's identity platform recommends this flow for SPAs, and tokens are returned through a back-channel exchange rather than in the URL. The implicit grant is no longer recommended for new SPA work.
Why the other options are wrong
- B. The implicit grant exposes access tokens in the URL fragment, where they can leak through browser history, logs, and referrers. Current guidance moves SPAs to the authorization code flow with PKCE.
- C. Client credentials acquire tokens for the application itself, not for a signed-in user. Embedding a secret in browser code would also expose it to anyone who opens developer tools.
- D. The resource owner password grant requires the app to handle user passwords directly, which defeats federated sign-in and multi-factor authentication. It is discouraged for new applications.