title: How to secure angular/spring app with keycloak?
body: <p>I have a spring boot (backend) &amp; angular (frontend) app that I'd like to secure with keycloak (for the authentication).</p>
  <p>I have a very basic deployment, in which the executable jar created by spring also serves the client code (from angular).</p>
  <p>I have seen several tutorials where the front and back are separated, and the front uses the code flow + pkce to delegate its authentication to keycloak, while the back is stateless and checks for presence of a jwt token certified by the keycloak instance.</p>
  <p>However since I have a backend server, I'd like to avoid using a public client and instead rely on the back-channel token exchange on the server side. So the front should not have any knowledge of the keycloak instance.</p>
  <p>Is that possible / is it a best practice ? Is there a front library that helps me to achieve that ? I've come across the library keycloak-angular, but it seems to be directed towards the first case, where the SPA connects directly to Keycloak instead of using a backend server.</p>