Difference between open id connect basic client and imlicit client profile

StackOverflow https://stackoverflow.com/questions/19313088

Question

Hi I am working with Open Id Connect protocol for authentication scheme. I just want to know what is the exact difference between basic client and implicit client scenario's in Open Id Connect.

Was it helpful?

Solution

The difference is that basic client uses OAuth2 Authorization code flow, while Implicit client uses OAuth2 implicit flow.

You can find the differences between these two flow in OAuth2 RFC (https://www.rfc-editor.org/rfc/rfc6749), but basically:

  • Authorization code flow is composed by two requests and responses. The first request (response_type=code) asks for a authorization code. The provider responses (if authorizated) with a authorization code. Then a second request is made (response_type=token) sending this code and asking for the access token. This flow is used from server-side.

  • Implicit flow is composed by one request and response. The request (reponse_type=token) asks directly for the access token, and the response injects the access token into the redirection URL. This flow is used form client-side (script).

Hope this help!

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top