I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs were a recommended option.
Here is what I know so far:
- Implicit Grant Flow is less secure than Authentication Code Grant Flow; and thus, Authentication Code Grant Flow should be preferred over Implicit Grant Flow unless some particular use case has no other option but Implicit Grant Flow.
- A JavaScript single-page application that is downloaded from S3 would have no way to complete the last leg of the Authentication Code Grant Flow because (1) it can't create an API for handling this on the S3 server from which it was downloaded, (2) it wouldn't be able to make cross-origin requests, and (3) it can't store a client side secret in the app.
So, if a hypothetical JavaScript SPA that is downloaded from S3 wanted to authenticate a user via Gmail, then it would have to use the Implicit Grant Flow. But if this SPA has no real backend of its own, then why would it ever need to authenticate a user? Is it maybe because this hypothetical S3 SPA has a CORS policy that allows it to access cross-origin APIs? Is this possible in S3? This sounds like a reasonable use case, but one that I'm not personally familiar with - thus, is this something that people are using out in the wild? And are there any notable examples of this?
Finally, if you're SPA does have a backend of its own, then wouldn't the Authentication Code Grant Flow be the recommended grant flow because it is more secure and it can be feasibly implemented given that you own the backend?
P.S. I'm asking what was the point because my understanding is that any use cases that required Implicit Grant Flow should now use Authentication Code Grant Flow with PKCEs.