title: Is Oauth2.0 appropriate for first-party apps?
body: <p>I am developing a SPA application in angular and I have a lot of confusion about the correct way to implement authentication and authorization.</p>
  <p>First of all, the application is a first-party app, which means that I am developing both the authorization server and resource servers.</p>
  <p>The users that logs in the application must have full access to their resources on the platform.</p>
  <p>So, I am doing it using OAuth2.0 and I have a couple of doubts about the domain of the protocol as well as security concerns.</p>
  <p><strong>First question:</strong></p>
  <p>The first question is if OAuth should be actually used to authorize first party applications. From my understanding this is a delegation protocol used to grant a third-party application controlled access to the user's resources on the platform, upon user consent. How does this fit in the context of a first-party app? In that case the app should get an access token with a scope that allows full access, right?</p>
  <p><strong>Second question:</strong></p>
  <p>Since this is a Single Page Application I couldn't store a secret on client side. So I am opting for using the authorization code grant with PKCE which would seem to be appropriate to manage this scenario. In this case I wouldn't ask for a refresh token but I would only retrieve the access token and using silent check to refresh it. I do not want to have refresh token insecurely stored on the browser. Is this PKCE really secure? The secret is generated dynamically but a attacker could eventually create a system using the same public client id and managing the PKCE properly, and finally get an access token that, in my case, gives full access to the users resources.</p>
  <p>I could in the future allow controlled access to my app's resources to third party app, that's also one of the reason why I stick with OAuth.</p>