What is the purpose of the implicit grant authorization type in OAuth 2?

前端 未结 12 852
面向向阳花
面向向阳花 2020-11-28 00:28

I don\'t know if I just have some kind of blind spot or what, but I\'ve read the OAuth 2 spec many times over and perused the mailing list archives, and I have yet to find a

12条回答
  •  渐次进展
    2020-11-28 00:45

    https://tools.ietf.org/html/rfc6749#page-8

    Implicit

    The implicit grant is a simplified authorization code flow optimized for clients implemented in a browser using a scripting language such as JavaScript. In the implicit flow, instead of issuing the client an authorization code, the client is issued an access token directly (as the result of the resource owner authorization). The grant type is implicit, as no intermediate credentials (such as an authorization code) are issued (and later used to obtain an access token).

    When issuing an access token during the implicit grant flow, the
    authorization server does not authenticate the client. In some
    cases, the client identity can be verified via the redirection URI
    used to deliver the access token to the client. The access token may be exposed to the resource owner or other applications with access to the resource owner's user-agent.

    Implicit grants improve the responsiveness and efficiency of some
    clients (such as a client implemented as an in-browser application),
    since it reduces the number of round trips required to obtain an
    access token.

提交回复
热议问题