| name | ai-memory-decision-log |
| description | Technical decisions made for this project, with reasoning and rejected alternatives. Load when proposing architectural changes, evaluating alternatives, or asked why a choice was made. Topics: Adopt OAuth 2.0 authorization code flow with PKCE for the customer portal SPA. |
Technical Decision Log
Auto-generated by ai-memory from AI chat history. Edit memories via ai-memory list / extract / resolve rather than this file — it is fully regenerated on every ai-memory rules --target skills.
Adopt OAuth 2.0 authorization code flow with PKCE for the customer portal SPA
Switch the SPA to OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange). Retire the implicit-flow client config. Require HTTPS-only redirect URIs. Migration is gated behind a feature flag; deprecate the old client_id by end of quarter.
Why: PKCE keeps the access token off the URL (auth code is the only thing exchanged via the front channel), and our existing oauth4webapi library supports PKCE out of the box. The migration is a few lines per auth provider plus an extra round-trip on first login — acceptable for the security gain.
Rejected: Stay on implicit flow ("works today") rejected: deprecated since 2019, security review will not sign off. Custom auth backend rejected: high cost, no incremental benefit over PKCE.
