We want to develop an Angular 2 App with an external OAuth2 server (IdentityServer4).
We also want to identify each client for uniqueness. But how to protect the ClientID in the Angular 2 / Javascript source? Do we have to work here with CORS and check for the origin of the request? Do we have to build a server-side application for the authentication?
Our Mobile App should use the ClientID 12345 Our Angular App should use ClientID 99999
But if anybody else would try to use ClientID 12345 it should be rejected.
What is the best practise here? - Authenticate directly with Angular? - Use for each angular App a Serverapp for Auth?