title: Can I use Oauth2 Authorization Code flow for a SPA (React app), if I have a server-side proxy?
body: <p>After watching an obscene amount of tutorials on OAuth2, there is one best practice that everyone repeatedly states - if you have a React app (or Angular, or Ember) - you <strong>must</strong> use <em>Implicit flow</em> with it.</p>
  
  <p>I understand that storing client credentials in publicly visible javascript would not work. However, my scenario is a bit different:</p>
  
  <ol>
  <li>I'm only using Oauth2 for single sign on and token generation for microservices. I chose it instead of simply generating tokens, since well-supported third party libraries are built around the Oauth2 idea.</li>
  <li>My idea is to have a React app, and a ASP.NET MVC app which serves the javascript and acts as a proxy for API requests. The user authenticates for the server-side app (by using Oauth2 authorization code flow).</li>
  <li>Then if I need to retrieve data from an API, I call my ASP.NET MVC app from React (by sending a simple cookie). The MVC app holds the token without ever exposing it to the user's browser.</li>
  <li>Obviously, when called, my MVC app then redirects the request to the necessary API, providing the bearer token.</li>
  </ol>
  
  <p>To better understand why this is what I came up with, here are some requirements I've received that might be unusual:</p>
  
  <ol>
  <li>I really don't want the access token to be shared - even if it's relatively short lived.</li>
  <li>I also want to be able to limit each user account to 3 concurrent user sessions. Easy to do using cookies and server-side sessions.</li>
  </ol>
  
  <p>I can't wrap my head around why this idea would be that bad. Is there any technical problem that might prevent this from working? Or maybe a security risk?</p>