<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">This answer scares me because we already use OIDC but we realize that it is not enough. Indeed, PKCE stores access tokens within the reach of javascript and therefore of an XSS type attack. To overcome this, we use a reverse proxy overlay (NextAuth) to make our OIDC authorization server believe that we are still in Authorization Code flow. But this results in an overly complex system which I think could be simplified with SAML. If you yourself are against the use of SAML in this increasingly widespread use case, then I am afraid of us :)<br clear="all"></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font color="#888888"><span><p dir="ltr" style="line-height:1.656;margin-left:4pt;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><span style="border:none;display:inline-block;overflow:hidden;width:267px;height:56px"><img src="https://lh5.googleusercontent.com/mLThoaiNugBlY4336DnmDiuIG7T4T71JCb3kLkYrOMcE-1nM3a1lA0fpE33NtqLXdQp8lUz4a4inFD0brKSjQaBudko0GGV3VfNTExNt3kX1_2QriimWy587sTrXfElf-Y435tWF" style="margin-left:0px;margin-top:0px" width="267" height="56"></span></span></p><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:10pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap">Fabien Berteau </span><span style="font-size:9.5pt;font-family:Verdana;color:rgb(61,133,198);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap">|</span><span style="font-size:10pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;font-weight:700;vertical-align:baseline;white-space:pre-wrap"> Security Architect</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;font-family:Verdana;color:rgb(102,102,102);background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Bordeaux</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-size:9.5pt;font-family:Verdana;color:rgb(17,85,204);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><a href="mailto:aurelien.lajoie@manomano.com" target="_blank">fabien.berteau@manomano.com</a></span></p></span></font></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le jeu. 21 oct. 2021 à 15:05, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 10/21/21, 9:01 AM, "users on behalf of Fabien BERTEAU" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:fabien.berteau@manomano.com" target="_blank">fabien.berteau@manomano.com</a>> wrote:<br>
<br>
> I know how to use Shibboleth to protect classical server side applications but I am a newbie about protecting<br>
> a SPA. Do you have documentation on how to do that ?<br>
<br>
No, I know nothing about that sort of abomination. I suspect you need OIDC, not SAML.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>