Tagged spa

One entry carries the tag spa, newest first. All tags.

• How do I coordinate Microsoft Entra ID sign-in between a single-page app and a separately hosted backend API?

  howto · identity · identity · entra-id · oauth · oidc · spa · bff · cors · Sep 18, 2026

  A bearer-token SPA runs MSAL.js itself and attaches its own access token to calls the API's CORS policy allows across origins - simplest to stand up, but every token lives in the browser. A backend-for-frontend (BFF) makes the backend the confidential OIDC client instead: it owns the redirect, keeps tokens server-side, and hands the SPA a same-origin cookie needing no CORS setup. Default to the BFF when the backend can own a session; reach for the bearer-token SPA only when the API also has to serve other, non-browser callers with the same token.