Spring 5.0 Projects

Implicit

The implicit grant type was designed specifically for single-page JavaScript applications running in the browser. It is most similar to the authorization code flow. The only difference is in the process of exchanging the authorization code. In the implicit grant type, a client will not receive an authorization code from the Authorization Server, in contrast with the authorization code grant type, due to security reasons.

Alternatively, once a User Agent successfully sends the credentials, the Authorization Server issues an access token directly to the Client. Since the implicit flow is targeted at single-page JavaScript applications, the refresh token is also not allowed. The whole process is described in the following diagram.