Credential Exposure-Surface Control for First-Party SPA Login

Context

If SPA login persists the PKCE verifier/token to storage, XSS immediately equals session hijacking.

Decision

First-party login keeps the AJAX /oauth2/login (json=true) flow that returns the authorization code directly, with the PKCE verifier held by a closure and never persisted; third parties use the authorize full-page redirect + a sessionStorage relay; the access_token lives only in memory and never reaches localStorage; the backend-hosted full-page login-page approach was shelved after review. The security wording follows the corrected framing: shrink the exposure window rather than eradicate leakage.

Consequences and Current State

frontends/user's authService/http implement this; the third-party integration path is documented in oidc-guide.