title: Can I use Resource owner password flow with SPA?
body: <p>I'm trying to implement authentication/authorization in my solution. I have a bunch of backend services(including identity service) under API Gateway, "backend for frontend" service, and SPA (React + Redux). I have read about OAuth2.0/OpenIdConnect, and I can't understand, why I shouldn't use Resource owner password flow? </p>
  
  <p>A client ( my backend for frontend server ) is absolutely trusted, I can simply send users login/password to the server, then it forwards them to Identity server, receives the access token &amp;&amp; refresh token and stores refresh token in memory(session, Redis, etc), and send the access token to SPA, which stores it in local storage. If SPA will send a request with the expired access token, the server will request a new one using refresh token and forwards the request to API Gateway with the new access token.</p>
  
  <p>I think in my case a flows with redirects can provide worth user experience, and are too complicated.</p>
  
  <p>What have I misunderstood? What potholes I'll hit if I'll implement authentication/authorization as I described above? </p>