OAuth implicit flow is dead

[Cantor, Scott]

On 11/10/18, 5:41 PM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:

> You've probably already heard about this but the OAuth implicit flow is all but dead.

Most of those arguments don't make the least bit of sense in the context of short-lived tokens in OIDC, and they definitely don't change my opinion about the trade-offs.

-- Scott