A samphire-harvest SPA and a confidential server web app both need interactive user sign-in to Microsoft Entra ID. Which OAuth flow should the developer select for modern interactive users?
Select an answer to reveal the explanation.
Short Explanation
Authorization code with PKCE is today’s front door for people signing in—SPA or server web. Implicit grant is the old side door. Client credentials is app-only, and password grant is not the interactive path you want.
Full Explanation
Modern interactive user authentication for both SPAs and confidential server web apps centers on the OAuth 2.0 authorization code flow, with PKCE required for public clients such as SPAs and recommended broadly. Authorization code with PKCE returns codes that are exchanged at the token endpoint instead of delivering tokens in URL fragments. Implicit grant is legacy for SPAs and should not be the default design. Client credentials are for daemon/service auth without a user and do not cover interactive user sign-in. Therefore the samphire-harvest SPA and confidential server web app should both target authorization code (with PKCE for the SPA), treating implicit as legacy.
Implicit grant for both apps because modern SPAs still require fragment tokens fails current guidance: SPAs should use auth code + PKCE; implicit is discouraged due to token exposure in the browser history/fragment.
Resource owner password credentials for the SPA and implicit for the server app fails twice: ROPC is highly constrained/discouraged and unsuitable for SPAs, and server web apps should use authorization code, not implicit.
Client credentials only fails because that flow authenticates the application itself without interactive user delegation—it cannot replace user sign-in when people must authenticate.
Exam caveat: confidential server apps still use authorization code but exchange the code with a client secret or certificate; SPAs must not embed secrets and rely on PKCE instead. Operational check: configure both apps for authorization code (PKCE on the SPA), complete interactive sign-in, and confirm tokens arrive via code exchange rather than implicit fragment responses.