I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token.

Basically they provide you with a read-only (for the most part) token that you can get by a POST request and providing the parameters:

  1. client_id (this is publicly known)
  2. grant_type (which would be "implicit")

In their docs, they say that implicit tokens are generally for front-end applications, however I'm not sure what the point of this is. What is the benefit if the client_id is exposed thus allowing anyone to generate these tokens? On top of that, they are only allowed access to non-sensitive data. It is odd to me because visitors to your shop would be given a token just to visit your site and read your listings. It seems more beneficial to not have a token at all for reading data but have one if you plan to write or view more sensitive data.


Your point makes sense.

The OAuth2.0 RFC (section 1.3.2) explains this :

Implicit grants improve the responsiveness and efficiency of some
clients (such as a client implemented as an in-browser application),
since it reduces the number of round trips required to obtain an
access token.

But the industry best practice has changed. The OAuth 2.0 Security Best Current Practice document recommends against using the Implicit flow entirely:

[...]clients SHOULD NOT use the implicit grant (response type "token") or any other response type issuing access tokens in the authorization response, such as "token id_token" and "code token id_token", unless the issued access tokens are sender-constrained and access token injection in the authorization response is prevented.

| improve this answer | |
  • So in the scenario that companies stop using the implicit flow, how are public APIs (such as Moltin) being protected then if they allow anyone to freely call their APIs? – Jake Tapper Jun 20 '19 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.