OpenID Connect Flows: From Implicit to Authorization Code with PKCE & BFF

This article will review the principles behind various OpenID Connect (OIDC) authentication flows, from the simplest to the most modern, highlighting the vulnerabilities present in each.

We will explore each of the following OpenID Connect flows in detail:

Frontend-only implementations:

• Implicit Flow


• Authorization Code Flow with Proof Key for Code Exchange (PKCE)

Frontend and Backend implementations:

• Authorization Code Flow with Token-Mediating Backend


• Authorization Code Flow with Token-Mediating Backend and PKCE


• Authorization Code Flow with PKCE and Backend for Frontend (BFF) …

article authentication authorization code connect flow frontend key oauth2 oidc openid openid connect principles proof review security vulnerabilities webdev