I'd like to confirm that can be generated a React static Single Page Application (SPA) that use Elasticsearch REST APIs for authentication and role authorization and queering data form indexes. This static SPA can be hosted for example in AWS S3. All communication to elasticsearch will be through REST APIs.
For example for authentication can be used "_security/oauth2/token" sending grant_type, username and password and obtaining access_token, refresh token and roles. Having the token can be used for queering the indexes.
Is that possible and recommended? Are there security issues that I'm missing?