What are the trade-offs between implicit grant flow and authorization code flow?

1 How implicit grant flow works

In implicit grant flow, the application redirects the user to the authorization server, where the user authenticates and grants consent to the application. The authorization server then returns an access token directly to the application via the browser's URL fragment. The application can use the access token to access the protected resources from the resource server. There is no intermediate step of exchanging an authorization code for an access token, as in authorization code flow.

3 Disadvantages of implicit grant flow

However, implicit grant flow also has some significant disadvantages that limit its security and functionality. One of the main disadvantages is that the access token is exposed in the browser's URL fragment, which can be accessed by scripts, browser extensions, or other parties that can intercept the browser traffic. The access token can also be leaked through browser history, bookmarks, or referrer headers. Another disadvantage is that the access token cannot be refreshed, which means that the application has to request a new one when it expires, which can interrupt the user experience. Implicit grant flow also does not support PKCE (Proof Key for Code Exchange), which is a mechanism that prevents authorization code interception attacks.

4 When to use implicit grant flow

Implicit grant flow is suitable for applications that have a short-lived and limited scope of access to the protected resources, and that do not handle sensitive or confidential data. For example, implicit grant flow can be used for applications that display public information from a third-party API, such as social media feeds or weather forecasts. Implicit grant flow is also compatible with older OAuth 2.0 implementations that do not support other flows.

6 Advantages of authorization code flow

One of the main advantages of authorization code flow is that it is more secure and reliable. The access token and the refresh token are never exposed in the browser's URL, which reduces the risk of leakage or theft. The application can also use PKCE to prevent authorization code interception attacks, which enhances the security of the flow. Another advantage is that the application can obtain a refresh token, which allows it to maintain a long-term and uninterrupted access to the protected resources, without requiring the user to re-authenticate or re-consent.

7 Disadvantages of authorization code flow

However, authorization code flow also has some drawbacks that increase its complexity and overhead. One of the main drawbacks is that the application needs to make an extra request to the authorization server to exchange the authorization code for an access token, which adds latency and network load. Another drawback is that the application needs to store and transmit its client credentials, which increases the risk of compromising them if the backend server is not secure. Authorization code flow also requires a backend server, which complicates the application architecture and deployment.