{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2666","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2666/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2666/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2666/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2666","id":138471023,"number":2666,"title":"Protecting SPA URI properly","user":{"login":"mohanr","id":367258,"avatar_url":"https://avatars.githubusercontent.com/u/367258?v=3","gravatar_id":"","url":"https://api.github.com/users/mohanr","html_url":"https://github.com/mohanr","followers_url":"https://api.github.com/users/mohanr/followers","following_url":"https://api.github.com/users/mohanr/following{/other_user}","gists_url":"https://api.github.com/users/mohanr/gists{/gist_id}","starred_url":"https://api.github.com/users/mohanr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mohanr/subscriptions","organizations_url":"https://api.github.com/users/mohanr/orgs","repos_url":"https://api.github.com/users/mohanr/repos","events_url":"https://api.github.com/users/mohanr/events{/privacy}","received_events_url":"https://api.github.com/users/mohanr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-04T13:02:17Z","updated_at":"2016-03-04T13:02:17Z","closed_at":null,"body":"- [x] I read and understood how to enable [logging](https://identityserver.github.io/Documentation/docsv2/configuration/logging.html)\r\n\r\n### Question / Issue\r\n\r\nI am able to protect my SPA's URI and get a token if I hit https://localhost:port1/context/connect/authorize?client_id=implicitclient&redirect_uri=http://localhost:port2/App/&response_type=token&scope=test. Now if I type my SPA's URI directly in the browser I get the page back without authorization.\r\n\r\nI think I am missing something in this flow. Any pointers ?\r\n\r\nThe AngularJS SPA is a empty ASP.NET MVC 5 project. Should this project be configured with some type of authentication ?\r\n\r\n### Relevant parts of the log file\r\n\r\n```\r\n<log goes here>\r\n```\r\n"}}