Implicit

• Flow is pretty much now deprecated due to security issues.

• It is recommended that public clients should now use the authorization code flow with the PKCE extension.

  • Native applications (such as mobile applications) can use dynamnic registration so each instance of the application can register itself with the Authorization Server yielding each instance its own unique Client ID & Client Secret.

• Returns the token directly from the Authorization Endpoint, without requiring the extra authorization code exchange step.

  • Designed for Javascript apps (primarily single page apps) where the client_secret cannot be safely stored aka public clients.

• Lately, it has not been recommended to use the implicit flow due to the inherit risks of returning access tokens in the HTTP redirect without any confirmation that it has been received by the client.

Flow In Action

1. Client redirects the user to the Authorization's Server authorization endpoint.

2. The user approves the scope in which then the Authorization Server redirects the user back to the Client's redirect_url with the access token in the URL fragment.

This flow is all done using front-channel requests in the browser.