AAAfshin Aminiinmnafshin.info·Jul 5 · 7 min readOAuth with SPAs and a Shared BFFGitHub: github.com/mnafshin/oauth What we are building A backend-for-frontend (BFF) that handles OAuth for two single-page apps: React (Vite, port 5173) Angular (port 4200) Both SPAs share one Sp00
AAAfshin Aminiinmnafshin.info·Jul 5 · 8 min readKeycloak Integration End to EndGitHub: github.com/mnafshin/oauth Goal Stand up Keycloak locally, create realm clients, and connect the demos from posts 6–9: Thymeleaf Spring Boot (orders-web on port 8080) Plain Java (orders-web 00
AAAfshin Aminiinmnafshin.info·Jul 5 · 5 min readOAuth in Plain JavaGitHub: github.com/mnafshin/oauth Why this post exists Spring Security hides PKCE, state, discovery, and token exchange behind auto-configuration. That is good for productivity — bad for interviews a00
AAAfshin Aminiinmnafshin.info·Jul 5 · 7 min readOAuth with Spring SecurityGitHub: github.com/mnafshin/oauth What we are building A minimal server-rendered Spring Boot web app that: Redirects unauthenticated users to Keycloak Completes Authorization Code + PKCE (Spring ha00
AAAfshin Aminiinmnafshin.info·Jul 4 · 4 min readOAuth Mistakes in ProductionThis post is a checklist disguised as war stories Every item below appears in real audits. OAuth did not fail — configuration and application code did. 1. Redirect URI laxity Mistake: Register https:00
