Question

What is the advantage in OAuth2 of the implicit grant over authorization code grant?

Specifically I’m wondering why the implicit grant is recommended for public clients but the authorization code grant is not. They seem so similar that the difference is unimportant.

Answer 1

Compare client action in both cases keeping in mind that client – is a piece of software you will have to write on your own.

In case of Authorization code grant client does those steps defined in spec:

1. The client requests an access token from the authorization server’s token
   endpoint by including the authorization code received in the previous step. When
   making the request, the client authenticates with the authorization server. The
   client includes the redirection URI used to obtain the authorization code for
   verification.
2. The authorization server authenticates the client, validates the authorization code,
   and ensures the redirection URI received matches the URI used to redirect the
   client in step (C). If valid, the authorization server responds back with an access
   token and optionally, a refresh token.

In case of Implicit Grant it has to do:

1. Receive an Access Token.

Now the answer is more or less trivial: the amount of code in first approach is unknown but could substantial against almost negligible for the second approach.