Search code examples
securityweboauth-2.0application-security

How secure is Oauth 2.0 Implicit Grant?


In Implicit Grant, the access token is sent back in the callback URL. Is this not a security risk because, if this callback URL is cached in the hop. In general it is advised, not to send sensitive data in URL params, and this access token will be a token to access all secured user resources. So why is it getting passed as fragment in URL


Solution

  • Elaborating on @vlatko's response...

    To mitigate the risk of sending the token in the fragment (or via any other OAuth2 grant):

    Issuing short-lived access token (as @vlatko said) will reduce the impact of a leaked token, but is not a preventative measure.