CodePark/ questions / OAuth 2.0 & OpenID Connect
START PRACTICINGPRACTICE
Backend question · Auth & security › OAuth 2.0 & OpenID Connect

Which OAuth grant types are left out of OAuth 2.1 and advised against by the OAuth 2.0 Security Best Current Practice (RFC 9700)?

Implicit and Resource Owner Password Credentials

The answer is "Implicit and Resource Owner Password Credentials".
• The implicit grant returns tokens in the redirect URL. There they leak through browser history, logs and the Referer header.
• The password grant gives the user's username and password straight to the client.

Authorization Code with PKCE replaces both for apps that users log in to. "Client Credentials and Implicit" is wrong, because Client Credentials is still the standard machine-to-machine flow.