In researching OAuth 2.0, I see that implicit grant is no longer recommended:-
In order to avoid these issues, clients SHOULD NOT use the implicit grant (response type "token") or any other response type issuing access tokens in the authorization response, such as "token id_token" and "code token id_token", unless the issued access tokens are sender-constrained and access token injection in the authorization response is prevented.
I'm looking into the implementation of Open ID Connect (specifically the Microsoft implementation for Azure AD) and notice the OpenID concept of implicit flow is the basis for many of their implementation examples.
I can see that implicit grant != implicit flow, however, the explanations of the various scenarios seem to indicate that it works the same way, and it's not immediately obvious what the material differences are (at least to me).
Is OpenID Connect implicit flow as unsafe as OAuth 2.0 implicit grant, or does it somehow avoid/mediate the issues that cause implicit grant to be discouraged?