Skip to content
Sarj Repo Standards
rest/security/oauth-implicit-grant

OAuth implicit flow

OAuth schemes prefer code-based flows over the legacy implicit flow.

warning beta

Examples

FlaggedFails
{
  "documents": {
    "openapi.json": {
      "components": {
        "securitySchemes": {
          "oauth": {
            "flows": {
              "implicit": {}
            },
            "type": "oauth2"
          }
        }
      },
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}
PassesClean
{
  "documents": {
    "openapi.json": {
      "components": {
        "securitySchemes": {
          "oauth": {
            "flows": {
              "authorizationCode": {}
            },
            "type": "oauth2"
          }
        }
      },
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}

Why it matters

The legacy browser flow has weaker token protections than code-based flows.

How detection works

An OAuth 2.0 security scheme declares flows.implicit.

What is inspected

  • the exact components.securitySchemes.*.flows.implicit key

Limits

  • claiming an RFC violation
  • assessing runtime token security
  • Only exact flow keys under a security scheme whose type is oauth2 are checked.
  • Scheme names, descriptions, and non-OAuth scheme types are ignored.
  • The finding remains advisory.

How to fix it

Review and replace the legacy flow.

  1. Use authorization code with appropriate client protections where applicable.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.