How secure is Oauth 2.0 Implicit Grant?

Question

In Implicit Grant, the access token is sent back in the callback URL. Is this not a security risk because, if this callback URL is cached in the hop. In general it is advised, not to send sensitive data in URL params, and this access token will be a token to access all secured user resources. So why is it getting passed as fragment in URL

Answer 1

Elaborating on @vlatko's response...

To mitigate the risk of sending the token in the fragment (or via any other OAuth2 grant):

• ensure that the OAuth endpoint and the callback endpoint are TLS (https) (See countermeasures)
• send a state parameter to prevent cross-site forgery (Also see: https://www.rfc-editor.org/rfc/rfc6749#section-4.2.1)

Issuing short-lived access token (as @vlatko said) will reduce the impact of a leaked token, but is not a preventative measure.