OAuth2.0 - 四种授权模式(2 - 简化模式 [implicit grant type])

https://tools.ietf.org/html/rfc6749#section-4.2

4.2. Implicit Grant【简化模式】

不通过第三方应用程序的服务器，直接在浏览器中向认证服务器申请令牌，跳过了"授权码"这个步骤，因此得名。所有步骤在浏览器中完成，令牌对访问者是可见的，且客户端不需要认证。

    The implicit grant type is used to obtain access tokens (it does not support the issuance of refresh tokens) and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript. 【简化模式（implicit grant type）用于获取访问令牌（它不支持发行刷新令牌），并针对已知要操作特定重定向URI的公共客户端进行了优化。这些客户机通常使用脚本语言（如javascript）在浏览器中实现。】

Since this is a redirection-based flow, the client must be capable of interacting with the resource owner's user-agent (typically a web browser) and capable of receiving incoming requests (via redirection) from the authorization server. 【由于这是一个基于重定向的流程，客户端必须能够与用户的用户代理（通常是Web浏览器）进行交互，并且能够接收来自授权服务器传入的请求（通过重定向）。】

Unlike the authorization code grant type, in which the client makes separate requests for authorization and for an access token, the client receives the access token as the result of the authorization request.【不同于授权码（混合）模式，在该模式中，客户机将授权和访问令牌的请求分开，客户机接收的访问令牌是由授权请求产生的结果。】 

The implicit grant type does not include client authentication, and relies on the presence of the resource owner and the registration of the redirection URI. Because the access token is encoded into the redirection URI, it may be exposed to the resource owner and other applications residing on the same device. 【简化模式不包括客户端身份验证，它依赖于用户是否存在和重定向URI是否注册。因为访问令牌被硬编码到重定向URI中，所以它可能会暴露给用户和位于同一设备上的其他应用程序。】

 
     +----------+
     | Resource |
     |  Owner   |
     |          |
     +----------+
          ^
          |
         (B)
     +----|-----+          Client Identifier     +---------------+
     |         -+----(A)-- & Redirection URI --->|               |
     |  User-   |                                | Authorization |
     |  Agent  -|----(B)-- User authenticates -->|     Server    |
     |          |                                |               |
     |          |<---(C)--- Redirection URI ----<|               |
     |          |          with Access Token     +---------------+
     |          |            in Fragment
     |          |                                +---------------+
     |          |----(D)--- Redirection URI ---->|   Web-Hosted  |
     |          |          without Fragment      |     Client    |
     |          |                                |    Resource   |
     |     (F)  |<---(E)------- Script ---------<|               |
     |          |                                +---------------+