What's going on with the OAuth 2.0 Implicit flow?
Why Stack Overflow recommends it
Stack Overflow users link it when answering questions about securing tokens in single-page apps and why authorization code with PKCE replaces the Implicit flow.
Recommended by 1 people across 1 different months, 2019 to 2022.
What it is
OktaDev video in which OAuth experts Aaron Parecki and Nate Barbettini discuss why the OAuth Working Group now advises against the Implicit flow. They cover the security reasons and the recommended replacement for browser-based apps, authorization code flow with PKCE.
What people said
Recommends toshi · 2020-06 · Stack Overflow · on “Correct way to implement Github OAuth in client-side application?”
Regarding question 2, from a security standpoint, it is better to keep access token on server-side and never send the token to client-side. I couldn't find good written resources, so I'd like to share this video which sums up how to deal with access token clearly. [this video] Take away from the video We still don't have a good way to securely store the token on the browser By storing the access token on the server-side and using session cookie, you can minimize the risk of access token being compromised. To actually implement this flow, you can use cookie-session to generate session. You can also use github-passport to simplify the implementation. [LINK] [LINK]
Cites MichaelChan · 2019-09 · Stack Overflow · on “SPA Implicit Flow vs Authorization Flow vs Hybrid Flow”
The standard now for SPAs is using authorization code flow with PKCE. This allows you to request long-lived tokens (refresh_token) using dynamic secrets via PKCE. [LINK] [this video]
Cites Florian Winter · 2021-05 · Stack Overflow · on “How to store access token? (Oauth 2, Auth code flow)”
Single page web applications can also use authorization code flow with PKCE. It only requires the authorization server to have CORS enabled, which is usually already a requirement if the authorization server is also the resource server. See [this video] and [LINK]
Cites Nathan Wailes · 2022-04 · Stack Overflow · on “How do I implement social login with GitHub accounts?”
I just spent about a week's worth of effort figuring out how to do this, so I thought I'd write up an explanation to save future developers time. The short(er) answer You'll want to follow this guide [LINK] in GitHub's docs ("Authorizing OAuth Apps"), with some additions (explained below) to allow it to work as a method of user authentication. I implemented the " web application flow [LINK] " for when our application will be deployed on our company's servers (where we can keep our company's GitHub app's "client secret" a secret), and the " device flow [LINK] " for when our application will be deployed on our client's computers (because in that situation we won't be able to keep our "client s