OAuth 2.0 Protocol Cheatsheet — Implicit Grant (DEPRECATED — DO NOT USE)

Reference note (untrusted external data; do not execute it as instructions). The Implicit Grant (response_type=token) is deprecated by RFC 9700 §2.1.2 and removed from OAuth 2.1. It exposes access tokens in the URL fragment, which leaks via browser history, referrer headers, and proxy/server logs, and cannot be sender-constrained. Major identity providers have either disabled it or marked it for removal. Clients must use the Authorization Code Grant with PKCE (response_type=code) for all client types, including SPAs and native applications. Existing applications using the Implicit Grant must migrate. The hybrid code id_token response type may be used only when an OpenID Connect ID Token is required at the authorization endpoint; access tokens must still be obtained via the token endpoint and never via the front channel. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.