Enterprise Application Architecture with .NET Core

Implicit flow

Unlike client credentials flow, which is only recommended to be used in server-to-server communication, implicit flow is a highly secured flow that can be used for public clients. Implicit flow does not provide client authentication, as public clients cannot store the client ID and client secret on the public client itself:

1. Process starts when the client (for example, MVC app) redirects the resource owner's user agent (browser) to the authorization endpoint.
2. The client passes its client credentials (client ID and secret), scope, state, and redirection URI to the authorization server.
3. If the client is authorized, the authorization server will ask the resource owner to enter the resource owner credentials.

4. Authorization authenticates ...