A proposed redesign of the city’s permitting SSO returns an access…

Question

A proposed redesign of the city’s permitting SSO returns an access token in the front-channel redirect fragment (implicit-style) and skips the code-for-token exchange. Relative to the official authorization-code happy path, what is wrong?

Accepted Answer

Implicit skips the back-channel code-for-token exchange the official task requires; code grant is the happy path — Handing the full badge through the lobby window (implicit) skips the secure back-room trade of ticket-for-badge. Official DEVCOR wants the authorization code path with that back-channel token exchange.

Answer

Nothing—implicit is the preferred confidential-client grant in DEVCOR 2.5

Answer

The fragment token must be posted to Meraki before any civic API call

Answer

Implicit is required whenever PKCE is omitted from the authorize URL

A proposed redesign of the city’s permitting SSO returns an access token in the front-channel redirect fragment (implicit-style) and skips the code-for-token exchange. Relative to the official authorization-code happy path, what is wrong?

Short Explanation

Full Explanation