OAuth 2.0 Implicit Grant

tools.ietf.org/html/rfc6749#section-1.3.2

The Implicit flow was a simplified OAuth flow previously recommended for native apps and JavaScript apps where the access token was returned immediately without an extra authorization code exchange step.

It is not recommended to use the implicit flow (and some servers prohibit this flow entirely) due to the inherent risks of returning access tokens in an HTTP redirect without any confirmation that it has been received by the client.

Public clients such as native apps and JavaScript apps should now use the authorization code flow with the PKCE extension instead.

The OAuth 2.0 Security Best Current Practice document recommends against using the Implicit flow entirely, and OAuth 2.0 for Browser-Based Apps describes the technique of using the authorization code flow with PKCE instead.

More resources

• VIDEO: What's Going On with the Implicit Flow? by Aaron Parecki
• Is the OAuth 2.0 Implicit Flow Dead? by Aaron Parecki (developer.okta.com)
• OAuth 2 Implicit Grant and SPAs by Vittorio Bertocci (auth0.com)
• Securely Using the OIDC Authorization Code Flow and a Public Client with Single Page Applications by Robert Broeckelmann (pingidentity.com)
• Why you should stop using the OAuth implicit grant (Torsten Lodderstedt)
• What is the OAuth 2.0 Implicit Grant Type? (developer.okta.com)
• Deprecated Implicit Flow (developer.yahoo.com)
• OAuth 2.0 Security Best Current Practice (ietf.org)
• OAuth 2.0 for Browser-Based Apps (ietf.org)
• Single-Page Apps (aaronparecki.com)
• Implicit Grant on the OAuth 2.0 Playground
• Implicit Flow Detector browser extension for Chrome