Advanced Single Page App Authentication
At the end of 2018, the OAuth working group released a new best current practices (BCP) document which recommended developers no longer implement the Implicit Grant Authorization Flow and instead implement the Auth Code with PKCE Authorization Flow. Unfortunately, the majority of Single Page Applications today implement the Implicit Flow.