title: OAuth2 Authorization Code Flow - exchange authorization code on Frontend VS Backend?
body: <p>i am developing an application with Angular Frontend and Java/Spring-Backend. For logging into our backend we are using <strong>Oauth2 Authorization Code Flow with PKCE</strong> and <strong>Open ID Connect</strong>.</p>
  <p>When the user navigates to a protected route he is redirected to his IDP and has to login. After that he is returned to a redirect_uri with the authorization_code as URL parameter. So far everything is clear.</p>
  <p>Now I am not sure what the best way to exchange this code for the access_token is? So far I've done this on the client (in JavaScript) and used the received JWT for further backend calls (on the backend I just verify the signature) and that does seem to work. But in other projects I've seen that colleagues actually used the backend kind of like a proxy. So they send the authorization_code to the Java-backend and the backend does the exchange.</p>
  <p>Now I've read a lot, but can't seem to grasp the full implications of that. It does seem to me that it's safer to have the client/frontend do this. But on the other hand the backend is actually trusted, so we could actually use a client_secret in this case.</p>
  <p>The question now is: Are both cases considered safe? Or is one considered more secure and if so: why?</p>
  <p>Thanks in advance</p>
  <p>*<strong>Edit</strong>: Just to clarify - we don't really need to access another resource server, the use case is that we just want to be safely authenticated <strong>to our own backend</strong> - once authenticated we switch to a session cookie anyway, so we don't store the access_token anywhere at all</p>