OAuth 2.0 Implicit Grant#

The Implicit Grant :

!!! OAuth 2.0 Security Best Current Practice absolutely discourages the use of Implicit flow. Instead, use Authorization code flow with PKCE -OAuth 2.0 for Browser-Based Apps. Further reading

Sequence Diagram#

sequenceDiagram
    title Implicit flow
    autonumber 1

    participant User as Resource owner User
    participant Client
    participant JansAS as Jans AS
    participant WebResource as Web - Hosted client resource

    Client->>JansAS:Authorization Request
    activate Client
    activate JansAS
    User->>JansAS:User login and consent
    JansAS-->>Client:Access Token in the URI fragment
    deactivate Client
    deactivate JansAS

    Client->>JansAS:Validate Access Token
    activate Client
    activate JansAS
    JansAS-->>Client:Validate response
    deactivate Client
    deactivate JansAS

    Client->>WebResource:Call API with Access Token
    activate Client
    activate JansAS
    JansAS-->>Client:Protected resource
    deactivate Client
    deactivate JansAS