openId connect plugin / guidance
In MVC, we have Microsoft OpenId Connect / Owin to secure the application using Hybrid flow with a Single Page Application on the front end.
The request is to have capabilities to move from MVC SPA (self hosted VM) to Serverless (Azure blob + Azure function as backend) to do Hybrid flow authentication.
1
vote
Anonymous
shared this idea
2 comments
-
Anonymous
commented
Reference links Implicit flow is insecure:
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09#section-2.1.2
https://medium.com/oauth-2/why-you-should-stop-using-the-oauth-implicit-grant-2436ced1c926 -
Anonymous
commented
Implicit flow is not secure, so that option is out for Serverless Architecture.