Spring Boot、React 和 OpenId Connect

Question

We have a use case where we are implementing OpenId Connect in a Spring Boot (backend) + React (frontend) application. We are implementing Authorization code flow.
The backend and frontend are on separate domain.
Here is the flow that happens:

1. The backend returns the generated URL which can be open by the React App for login (redirecting to Cognito in our case - but it can be anything) - or even this URL can be generated on the Frontend itself - since the clientId will be exposed in the URL anyway
2. The user logs in, a request is sent to the redirect uri, where the Authorization Code is used to get an access token, id token and refresh token
3. When this ends, we have the tokens but how do we transfer them to the React App in the other domain? I assume redirection and passing the tokens as query parameters makes sense - something like return "redirect://http://www.yourfrontenddomain.com?access_token" + tokenValue;

Am i missing something here or my approach is fine?
Using Implicit flow here would be easier - but this is less secure and only recommended for Javascript apps - here we have a mix of Backend + Frontend.
Thanks a lot in advance

Answer 1

Ok it seems i was not understanding the concepts correctly. Authorization code flow with PCKE is exactly made for this use case - to be used in SPA's or Mobile clients. By using that flow, we can just use Spring Security and just validate the tokens on the backend (without generating them or anything)