Web Security · Middle · Question 49 of 75
Which OAuth 2.0 flow is recommended for a single-page app today?
- 1Implicit flow, with the token in the URL fragment
- ✓Correct answer: Authorization code flow with PKCE
- 3Resource owner password flow, where the SPA collects the password
Explanation
The implicit flow exposes tokens in URLs and history and is deprecated by the OAuth security best practices. PKCE protects the code exchange.