What's going on with the OAuth 2.0 Implicit flow?

Aaron Parecki and Nate Barbettini discuss the recent developments from the OAuth Working Group's recommendations around the Implicit Flow.

Links mentioned in the video:

BOOK: OAuth 2.0 Simplified

BLOG: Is the OAuth 2.0 Implicit Flow Dead? (With sample code!)

VIDEO: OAuth: When Things Go Wrong

IMPLICIT FLOW:

---------------------------------------------------------------------------------------------------------------

[hemanth.alluri]

I really like how a lot of the potential questions were anticipated, asked and also answered here. I really respect your work here!

[Dhruv-ncxo]

Implicit flow was required as we didn’t have CORS back then. But, how come applications were able to call resource servers at that time? Or were resource server and client app usually had the same domain ?

[dmoka]

So far I have read many articles about Oauth2 and the difference between Implicit and AuthCode flow, but this video owned all of them! Great job guys, thanks for it, keep it up!

[LMasniuk]

I am currently working on a solution for a system that will involve OAuth2 and I can't thank you enough for this video and the one about OAuth and OIDC in plain english. Very great conversation between a Product person and a dev that I will be doing something similar to. Thank you thank you thank you!

[YoavRaman]

This made the differences between the security level of the flows an the reasons behind them much clearer for me, also cleared up the reasons why it was not one before on some environments, great video!

[sahngcobo]

The interviewer did the first and best presentation he is well versed in the technical bit.

[omarjarkas]

Aaron has a very unique way and explaining hard concepts simply, great job by Okta team!

[ssougnez]

These guys have a way to explain complicated thing in a very understandable way. Thanks !

[pwerinside]

I'm really glad I watched this video. Thank you for uploading!

[FedericoDiDio-sr]

Very informative and well presented, thank you! It annoys me to no end that we basically solved this problem with SSL client certificates a long time ago and we keep wasting time on this, but this is kinda beside the point...

[alanrice]

this is such a great explanation haha. honestly the interviewer questions were 100% spot on

[smokelessboy]

That's so useful! So many things I explained I was wondering about and trying to find answers for!

[adamglass]

10 points for basic clarity as to how and why.

[tvh]

This answered a lot of my questions! Thank you.

[Omikoshi]

Really nice discussion, I can tell a lot of thought went into both the question and answer. Thank you!

[khanhtranduy]

Great video that reveal a lot of my confusion. Thanks!

[NoTalentGuy]

This was surprisingly too good. Thank you so much! 😎

[bennorthrop]

Very helpful. Thanks for posting this!

[starbuck]

Finally a good explanation about this, i have been days searching in the internet, all this oauth2 protocol is the most confusing thing i had ever to learn. Had no idea what was the problem of just sending a token in the url. But if it is not implicit just make the post directly to get the access token?

[wiggerlywoo]

Great video. All the right questions asked. Thank you!