Configuring applications as public OAuth2 clients is now discouraged. For this reason, we'll use an architecture in which the requests from the frontend are authorized with sessions on a middleware on the server: a Backend For Frontend. As opposed to SPAs and mobile apps, such a BFF can be a confidential client. Also, with such a configuration, tokens stay safe on servers we trust. Over the last 18 months, I have answered many questions (maybe 500) about OAuth2 and Spring.