{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/889","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/889/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/889/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/889/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/889","id":315103294,"number":889,"title":"Password grant for SPA's","user":{"login":"boyd91","id":6942044,"avatar_url":"https://avatars1.githubusercontent.com/u/6942044?v=4","gravatar_id":"","url":"https://api.github.com/users/boyd91","html_url":"https://github.com/boyd91","followers_url":"https://api.github.com/users/boyd91/followers","following_url":"https://api.github.com/users/boyd91/following{/other_user}","gists_url":"https://api.github.com/users/boyd91/gists{/gist_id}","starred_url":"https://api.github.com/users/boyd91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boyd91/subscriptions","organizations_url":"https://api.github.com/users/boyd91/orgs","repos_url":"https://api.github.com/users/boyd91/repos","events_url":"https://api.github.com/users/boyd91/events{/privacy}","received_events_url":"https://api.github.com/users/boyd91/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-04-17T15:05:24Z","updated_at":"2018-04-17T17:24:45Z","closed_at":null,"author_association":"NONE","body":"The documentation advises to use the password grant type for first party frontend apps such as single page applications. ([link](http://oauth2.thephpleague.com/authorization-server/which-grant/))\r\n\r\nThis confuses me because the password grant requires the client to store the `client_secret`. Considering your first party SPA has no backend component I wouldn't know how to securely store that secret.\r\n\r\nCan someone elaborate on that?"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/382075010","html_url":"https://github.com/thephpleague/oauth2-server/issues/889#issuecomment-382075010","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/889","id":382075010,"user":{"login":"boyd91","id":6942044,"avatar_url":"https://avatars1.githubusercontent.com/u/6942044?v=4","gravatar_id":"","url":"https://api.github.com/users/boyd91","html_url":"https://github.com/boyd91","followers_url":"https://api.github.com/users/boyd91/followers","following_url":"https://api.github.com/users/boyd91/following{/other_user}","gists_url":"https://api.github.com/users/boyd91/gists{/gist_id}","starred_url":"https://api.github.com/users/boyd91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boyd91/subscriptions","organizations_url":"https://api.github.com/users/boyd91/orgs","repos_url":"https://api.github.com/users/boyd91/repos","events_url":"https://api.github.com/users/boyd91/events{/privacy}","received_events_url":"https://api.github.com/users/boyd91/received_events","type":"User","site_admin":false},"created_at":"2018-04-17T17:24:45Z","updated_at":"2018-04-17T17:24:45Z","author_association":"NONE","body":"The Password grant referred to in the docs does require to pass the `client_secret`. See http://oauth2.thephpleague.com/authorization-server/resource-owner-password-credentials-grant/"}}
{"actor":{"display_login":"boyd91"}}