{"type":"post","id":"oauth-2-0-for-browser-based-apps-analysis-8950b5","slug":"oauth-2-0-for-browser-based-apps-analysis-8950b5","title":"OAuth 2.0 for Browser-Based Apps","description":"Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.","retrieval_nugget":"Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.","published_at":"2026-10-17","updated_at":"2026-10-17","record_date":"2026-10-17","date_kind":"published_at","topics":["security"],"source_urls":["https://oauth.net/2/browser-based-apps"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:oauth-2-0-for-browser-based-apps-analysis-8950b5","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:5493f8d3d0a5882d72a1f38cc2ebf07c8e8fc02a82bbb1459add8817ce243172","reviewed_at":"2026-10-17T18:02:21.388Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.","observed_facts":[{"text":"The OAuth.net page says RFC 10017 covers security requirements and best practices for OAuth 2.0 in applications whose code runs entirely in the browser.","source_urls":["https://oauth.net/2/browser-based-apps"]},{"text":"The page says browser-based apps cannot store a client secret and that code, tokens, and storage are visible to JavaScript on the page, including third-party scripts.","source_urls":["https://oauth.net/2/browser-based-apps"]}],"mechanism":"Because browser code and storage are exposed to page JavaScript, the guide recommends Authorization Code with PKCE and says not to use the Implicit flow. It recommends tokens in memory rather than localStorage, or a Backend-for-Frontend that holds tokens server-side and communicates via HttpOnly cookies.","why_now":"RFC 10017 makes the browser-specific threat model and corresponding implementation choices explicit for teams building SPAs.","implications":["Teams should decide whether browser-held tokens are acceptable or whether a BFF should retain them server-side."],"evidence_boundary":"The supplied source excerpt reports the guidance and rationale; it does not establish adoption rates, comparative security outcomes, or implementation costs.","watch_conditions":["Watch whether browser-app frameworks and identity providers make PKCE and BFF architectures straightforward defaults."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied for this specific browser-app OAuth guidance, so this begins a distinct analytical record."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5/","markdown":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5.md","json":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5.json"},"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}