full implicit flow support?

@tikurahul I know you have mentioned this in https://github.com/openid/AppAuth-JS/issues/8#issuecomment-309239324 but implicit auth would still be cool feature. For SPA implicit auth is required and support for it is basically already there, we only need make sure that the correct data is returned here: https://github.com/openid/AppAuth-JS/blob/master/src/redirect_based_handler.ts#L102 if ‘token’ (instead code) was requested.

what I do now in my spa as a workaround:

const {AuthorizationServiceConfiguration} = require('@openid/appauth/built/authorization_service_configuration.js');
const {AuthorizationRequest} = require('@openid/appauth/built/authorization_request.js');
const {AuthorizationNotifier} = require('@openid/appauth/built/authorization_request_handler.js');
const {RedirectRequestHandler} = require('@openid/appauth/built/redirect_based_handler.js');

var login = {
  init: function() {
    this.notifier = new AuthorizationNotifier();
    this.handler = new RedirectRequestHandler();

    this.notifier.setAuthorizationListener(function (request, response, error) {
      var hash = login.parseAuthorizationResponse();
      if (response && hash.access_token) {
        //do something usefull here with hash.access_token...
      } else {
        //error
      }
       
      //destroy hash
      window.location.hash = '';
    });
    
    this.handler.setAuthorizationNotifier(this.notifier);
    this.handler.completeAuthorizationRequestIfPossible();
  },

  initOidcAuth: function(idp) {  
    AuthorizationServiceConfiguration.fetchFromIssuer(idp.providerUrl).then(configuration => {
      var request = new AuthorizationRequest(
        idp.clientId, idp.redirectUri, idp.scope, 'id_token token', undefined, {'nonce': Math.random().toString(36).slice(2)});
  
      login.handler.performAuthorizationRequest(configuration, request);
    });
  },

  parseAuthorizationResponse: function() {
    var hash = window.location.hash.substr(1);
    var obj = {};
    var pairs = hash.split('&');
    
    for(let i in pairs){
      let split = pairs[i].split('=');
      obj[decodeURIComponent(split[0])] = decodeURIComponent(split[1]);
    }

    return obj;
  }
}

[panva]

Isn’t the idea behind AppAuth to follow the almost-BCP. On the topic of implicit,

8.2. OAuth Implicit Grant Authorization Flow

The OAuth 2.0 implicit grant authorization flow as defined in Section 4.2 of OAuth 2.0 [RFC6749] generally works with the practice of performing the authorization request in the browser, and receiving the authorization response via URI-based inter-app communication. However, as the implicit flow cannot be protected by PKCE [RFC7636] (which is a required in Section 8.1), the use of the Implicit Flow with native apps is NOT RECOMMENDED.

Tokens granted via the implicit flow also cannot be refreshed without user interaction, making the authorization code grant flow - which can issue refresh tokens - the more practical option for native app authorizations that require refreshing.

However the problem really is whether the application holds on to the user’s password when it needs another access token.

I believe this to be the relevant when ROPC is used, which again, is not what AppAuth is bringing.

[wi3land]

if you are using ionic i have created an extension for appauth-js called ionic-appauth. This includes an implicit flow for use when using a browser with ionic.