First step here is really to start on a more detailed proposal. If someone from the community wants to take that on that'd be great, otherwise this will end up in the backlog for a while.

It's also quite relevant to reassess the security around a SPA integration. There's different approaches mentioned in oauth best practices, and we only support the least secure approach today. There's also some techniques that can be used to make it more secure with the current approach by sandboxing the tokens more (if I don't remember incorrectly it's called service workers).

Final point to make here is that we should also review if there are better oauth/oidc libraries out there now that can either be used as is, or be used within a thinner wrapper library from our end.

Yes, we certainly need to work on a proposal taking more modern standards into account. I am absolutely in favor of looking around to see if there are existing projects out there that can provide value in this regard (suggestions welcome).

Maybe it would also help a lot to give some guidelines. I wanted to use a generic OAuth library with Capacitor but got somehow lost in terminology and in understanding what do I need to provide for the configuration. I often see me confronted with the problem, that example configurations for Google, Azure, Auth0 but rarely for Keycloak.

Maybe it's a good idea to check how existing solutions can be used.

For example

• For capacitor: https://github.com/moberwasserlechner/capacitor-oauth2
• For angular: https://github.com/manfredsteyer/angular-oauth2-oidc

I am a big fan of the work of Manfred on angular-oauth2-oidc, unfortunately it is largely Angular specific.

Well, from my experience of working with keycloak-ionic there are two core parts in working with keycloak-js is generating the URLs and parsing the response. As one of the few still maintained generic solutions I found https://github.com/salte-auth/salte-auth
But as I see the handlers expect a full response with the tokens.

For me currently the hardest part is to understand how parsing of the data and retrieving consecutive requests in the callbacks work and how SSO checks and the silent renewal of tokens should work. Probably having this parts split into small modules would make it a lot easier to create implementations for different libraries.