OAuth with SPAs and a Shared BFF
GitHub: github.com/mnafshin/oauth What we are building A backend-for-frontend (BFF) that handles OAuth for two single-page apps: React (Vite, port 5173) Angular (port 4200) Both SPAs share one Sp
Spring/Java universe
Latest articles
Identity Providers Are Not the Complete Solution
The myth "We'll buy Okta / Auth0 / deploy Keycloak — then auth is done." Identity providers (IdPs) and authorization servers solve a specific, hard problem: issuing tokens after authenticating a use
Authorization Code + PKCE
The one flow to learn first If you implement only one OAuth flow, make it Authorization Code with PKCE (Proof Key for Code Exchange). It works for: Server-side web apps (Spring Boot, Django, Rails)
The OAuth Mental Model
Four roles (memorize these) OAuth names four actors. Everything else hangs off them. Role Plain English Example Resource owner User who can grant access Alice Client App requesting access Yo
Why OAuth Exists
The scenario everyone recognizes Your application wants to access a user's data on another service — their Google Calendar, GitHub repositories, or company files in SharePoint. The naive approach: ask
Stop Inventing Error JSON: A Practical Guide to RFC 7807 Problem Details
Every HTTP API eventually returns an error. The hard part is not the status code — it is the body. One service returns { "error": "not found" }, another returns { "message": "User does not exist" }, a
Idempotency Patterns — Create Orders Exactly Once (With Retries)
Git Repo: https://github.com/mnafshin/idempotency Why This Matters Retries are a fact of life in distributed systems. A mobile client times out, a load balancer gives up, a service restarts — and the