OAuth implicit flow is dead

[Tom Scavo]

You've probably already heard about this but the OAuth implicit flow
is all but dead.

A new version of the OAuth 2.0 Security BCP was released yesterday:

https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09#section-2.1.2

The editor of that document gives a justification for the new stance
regarding the implicit flow in the following blog article:

https://medium.com/@torsten_lodderstedt/why-you-should-stop-using-the-oauth-implicit-grant-2436ced1c926

AFAICT, OAuth flows were last discussed on this list in the following thread:

https://marc.info/?t=151061560100010&r=1&w=2&n=10

Cheers,

Tom