oauth2 implicit flow should allow custom protocols

[aeneasr]

But first, check the spec for further information on this.

[boyvinall]

As per gitter, take a look at https://tools.ietf.org/html/draft-ietf-oauth-native-apps-03

[boyvinall]

BTW - for my purposes, I'm looking at using the implicit flow, but I think this can also affect the authorisation code flow. Perhaps this makes the implementation easier?

[aeneasr]

No, the implicit flow is the only one where you can use custom uri schemes. Using this with the authorization code will leak the token to anyone who is listening. Seriously anyone, including me. ;)

[aeneasr]

upstream ory/fosite#60

[aeneasr]

this is justified by https://tools.ietf.org/html/rfc6819#section-4.4.2