Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: Implicit Grant flow is deprecated danger warning #1543

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: Implicit Grant flow is deprecated danger warning #1543

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions guide/oauth2/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,10 @@ The `identify` scope will allow your application to get basic user information f

### Implicit grant flow

::: danger
Implict grant flow is a deprecated grant type due to being vulnerable to token leakage and replay attacks. It is advised to use the authorization code grant flow instead. For more information check [here](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#name-removal-of-the-oauth-20-imp) and [here](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-24#name-implicit-grant).
:::

You have your website, and you have a URL. Now you need to use those two things to get an access token. For basic applications like [SPAs](https://en.wikipedia.org/wiki/Single-page_application), getting an access token directly is enough. You can do so by changing the `response_type` in the URL to `token`. However, this means you will not get a refresh token, which means the user will have to explicitly re-authorize when this access token has expired.

After you change the `response_type`, you can test the URL right away. Visiting it in your browser, you will be directed to a page that looks like this:
Expand Down