---
type: "post"
id: "oauth-2-0-for-browser-based-apps-analysis-8950b5"
slug: "oauth-2-0-for-browser-based-apps-analysis-8950b5"
title: "OAuth 2.0 for Browser-Based Apps"
description: "Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials."
retrieval_nugget: "Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials."
published_at: "2026-10-17"
updated_at: "2026-10-17"
record_date: "2026-10-17"
date_kind: "published_at"
topics: ["security"]
source_urls: ["https://oauth.net/2/browser-based-apps"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:oauth-2-0-for-browser-based-apps-analysis-8950b5"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:5493f8d3d0a5882d72a1f38cc2ebf07c8e8fc02a82bbb1459add8817ce243172","reviewed_at":"2026-10-17T18:02:21.388Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.","observed_facts":[{"text":"The OAuth.net page says RFC 10017 covers security requirements and best practices for OAuth 2.0 in applications whose code runs entirely in the browser.","source_urls":["https://oauth.net/2/browser-based-apps"]},{"text":"The page says browser-based apps cannot store a client secret and that code, tokens, and storage are visible to JavaScript on the page, including third-party scripts.","source_urls":["https://oauth.net/2/browser-based-apps"]}],"mechanism":"Because browser code and storage are exposed to page JavaScript, the guide recommends Authorization Code with PKCE and says not to use the Implicit flow. It recommends tokens in memory rather than localStorage, or a Backend-for-Frontend that holds tokens server-side and communicates via HttpOnly cookies.","why_now":"RFC 10017 makes the browser-specific threat model and corresponding implementation choices explicit for teams building SPAs.","implications":["Teams should decide whether browser-held tokens are acceptable or whether a BFF should retain them server-side."],"evidence_boundary":"The supplied source excerpt reports the guidance and rationale; it does not establish adoption rates, comparative security outcomes, or implementation costs.","watch_conditions":["Watch whether browser-app frameworks and identity providers make PKCE and BFF architectures straightforward defaults."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied for this specific browser-app OAuth guidance, so this begins a distinct analytical record."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5/","markdown":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5.md","json":"https://newruntime.com/posts/oauth-2-0-for-browser-based-apps-analysis-8950b5.json"}
---

# OAuth 2.0 for Browser-Based Apps

## Retrieval answer

Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.

Thesis: Browser-based OAuth security depends on treating the browser as an exposed public-client environment, not as a place to keep confidential credentials.

Observed facts: The OAuth.net page says RFC 10017 covers security requirements and best practices for OAuth 2.0 in applications whose code runs entirely in the browser. It says browser-based apps cannot store a client secret and that code, tokens, and storage are visible to JavaScript on the page, including third-party scripts.

Mechanism: Because browser code and storage are exposed to page JavaScript, the guide recommends Authorization Code with PKCE and says not to use the Implicit flow. It recommends tokens in memory rather than localStorage, or a Backend-for-Frontend that holds tokens server-side and communicates via HttpOnly cookies.

Why now: RFC 10017 makes the browser-specific threat model and corresponding implementation choices explicit for teams building SPAs.

Implication: Teams should decide whether browser-held tokens are acceptable or whether a BFF should retain them server-side.

Evidence boundary: The supplied source excerpt reports the guidance and rationale; it does not establish adoption rates, comparative security outcomes, or implementation costs.

Watch condition: Watch whether browser-app frameworks and identity providers make PKCE and BFF architectures straightforward defaults.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)