# OAuth2 implicit grant flow leaks access token in URL fragment

- **ID:** `security/oauth2-implicit-grant-token-in-url`
- **Domain:** security
- **Category:** protocol_error
- **Verification:** ai_generated
- **Fix Rate:** 88%

## Root Cause

The OAuth2 implicit grant flow returns the access token in the URL fragment, which is exposed in browser history, referrer headers, and server logs.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth 2.0 RFC 6749 | active | — | — |
| OAuth 2.0 Security BCP (RFC 9700) | active | — | — |

## Workarounds

1. **Migrate from the implicit flow to the authorization code flow with PKCE. Example: `response_type=code&code_challenge=...&code_challenge_method=S256` instead of `response_type=token`.** (95% success)
   ```
   Migrate from the implicit flow to the authorization code flow with PKCE. Example: `response_type=code&code_challenge=...&code_challenge_method=S256` instead of `response_type=token`.
   ```
2. **If migration is not possible, add `Referrer-Policy: no-referrer` headers and discourage browser history retention via `Cache-Control: no-store` on the page.** (60% success)
   ```
   If migration is not possible, add `Referrer-Policy: no-referrer` headers and discourage browser history retention via `Cache-Control: no-store` on the page.
   ```
3. **Use a custom scheme for mobile apps to reduce exposure to browser history and referrer leakage.** (70% success)
   ```
   Use a custom scheme for mobile apps to reduce exposure to browser history and referrer leakage.
   ```

## Dead Ends

- **** — Removing the token from the URL fragment entirely breaks the flow because the client expects it there. (70% fail)
- **** — Using HTTPS alone doesn't prevent token leakage via browser history or referrer headers. (50% fail)
- **** — Shortening token expiry doesn't solve the underlying exposure; tokens are still captured in logs. (30% fail)