I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs were a recommended option.
Here is what I know so far:
- Implicit Grant Flow is less secure than Authentication Code Grant Flow; and thus, Authentication Code Grant Flow should be preferred over Implicit Grant Flow unless some particular use case has no other option but Implicit Grant Flow.
Finally, if you're SPA does have a backend of its own, then wouldn't the Authentication Code Grant Flow be the recommended grant flow because it is more secure and it can be feasibly implemented given that you own the backend?
P.S. I'm asking what was the point because my understanding is that any use cases that required Implicit Grant Flow should now use Authentication Code Grant Flow with PKCEs.