RFC 9700 (OAuth 2.0 Security Best Current Practice) and OAuth 2.1 both drop the implicit grant: it returns an access token directly in a URL fragment, with no code-exchange step, which makes token leakage (browser history, referrer headers, logs) much easier than the authorization_code grant. This plugin registers it by default (`Types\Implicit`, response_type=token).
PKCE (#1) had to explicitly special-case this grant (a PKCE-required client is refused when using it, since there's no code for a challenge to bind to) — a good example of the implicit grant not fitting cleanly into a spec-compliant server. Worth deciding whether to deprecate it, make it opt-in, or document it as discouraged.
RFC 9700 (OAuth 2.0 Security Best Current Practice) and OAuth 2.1 both drop the implicit grant: it returns an access token directly in a URL fragment, with no code-exchange step, which makes token leakage (browser history, referrer headers, logs) much easier than the authorization_code grant. This plugin registers it by default (`Types\Implicit`, response_type=token).
PKCE (#1) had to explicitly special-case this grant (a PKCE-required client is refused when using it, since there's no code for a challenge to bind to) — a good example of the implicit grant not fitting cleanly into a spec-compliant server. Worth deciding whether to deprecate it, make it opt-in, or document it as discouraged.