{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1356","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1356/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1356/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1356/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1356","id":76316954,"number":1356,"title":"Question about the right Flow","user":{"login":"imperugo","id":758620,"avatar_url":"https://avatars.githubusercontent.com/u/758620?v=3","gravatar_id":"","url":"https://api.github.com/users/imperugo","html_url":"https://github.com/imperugo","followers_url":"https://api.github.com/users/imperugo/followers","following_url":"https://api.github.com/users/imperugo/following{/other_user}","gists_url":"https://api.github.com/users/imperugo/gists{/gist_id}","starred_url":"https://api.github.com/users/imperugo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imperugo/subscriptions","organizations_url":"https://api.github.com/users/imperugo/orgs","repos_url":"https://api.github.com/users/imperugo/repos","events_url":"https://api.github.com/users/imperugo/events{/privacy}","received_events_url":"https://api.github.com/users/imperugo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-14T10:39:45Z","updated_at":"2015-05-14T16:45:34Z","closed_at":null,"body":"Hi, \r\nI'm working on an application that has several clients (mobile and web but both have the same problem).\r\nThe web part is a Single Page Application hosted on a CDN that will call protected APIs hosted on another domain using CORS.\r\n\r\nThe idea is to protect the APIs only to authorised Client and Users, and the security must be compliant with the following scenarios:\r\n\r\n- anonymous users from my SPA must be able to call some service with specific scopes;\r\n- logged users from my SPA must be able to call the APIs (scope + profile)\r\n- not authorised client can't call my APIs\r\n\r\nI was thinking to use Implicit flow for authenticated users and Client Credentials flow for not authenticated but for this one I should put the secret into the JS and it doesn't seem so good.\r\n\r\nWhat's the best way to cover the scenarios above?"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/102099230","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1356#issuecomment-102099230","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1356","id":102099230,"user":{"login":"jawadatgithub","id":12063236,"avatar_url":"https://avatars.githubusercontent.com/u/12063236?v=3","gravatar_id":"","url":"https://api.github.com/users/jawadatgithub","html_url":"https://github.com/jawadatgithub","followers_url":"https://api.github.com/users/jawadatgithub/followers","following_url":"https://api.github.com/users/jawadatgithub/following{/other_user}","gists_url":"https://api.github.com/users/jawadatgithub/gists{/gist_id}","starred_url":"https://api.github.com/users/jawadatgithub/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jawadatgithub/subscriptions","organizations_url":"https://api.github.com/users/jawadatgithub/orgs","repos_url":"https://api.github.com/users/jawadatgithub/repos","events_url":"https://api.github.com/users/jawadatgithub/events{/privacy}","received_events_url":"https://api.github.com/users/jawadatgithub/received_events","type":"User","site_admin":false},"created_at":"2015-05-14T16:45:34Z","updated_at":"2015-05-14T16:45:34Z","body":"Client Credentials flow doesn't support End User at all. code flow & resource owner flows designed for trusted clients/environments (e.g., MVC app, Intranet environment).\r\n\r\nso its recommended to stick with implicit and hybrid flows for Mobile and SPAs.\r\n\r\nabout Apis: if its MS web Apis, decorate with [anonymous] the methods that you want be accessed anonymously.\r\n\r\nif Mobile is native app (differ than SPA), then define two clients in IdentityServer3.\r\nif you want single Implicit Client to act differently in SPA and Mobile, then remember that you can define multiple redirectUris (e.g., when requesting Authorize Endpoint from SPA use RedirectURI-A, and from mobile use RedirectURI-B).\r\n\r\nhope this help, please follow up with pending concerns, so we can resolve it.\r\n"}}