Getting Started with OAuth 2.0

Security Properties

In the Implicit Grant flow, the application does not store long-lived refresh tokens on a server, limiting the exposure if the server is compromised. It also requires that the user be authenticated to the API provider’s authorization server in order to “refresh” access tokens on the client, ensuring that a leaked access token’s value is time-limited, depending on the OAuth implementation.

Because the access token is sent to the user’s web browser, this flow offers less accountability than the Authorization Code flow. API calls that appear to have originated from a third-party app may have in fact been made directly by the resource owner themselves.