This Terraform resource provisions an OAuth client with the implicit grant enabled (grant_types or allowed_oauth_flows contains "implicit").

Why this matters

The implicit flow returns access tokens in the URL fragment, has no client authentication, and cannot use refresh-token rotation. It is removed from OAuth 2.1 and disallowed by the OAuth security BCP (RFC 9700) precisely because those tokens leak through browser history, referrers, and logs. Use the authorization_code grant with PKCE instead. Drop "implicit" from the flow list and let the client exchange a code for tokens over the back channel.

# ruleid: auth.iac.tf-oauth-implicit-grant
resource "auth0_client" "web" {
  name        = "My SPA"
  app_type    = "spa"
  grant_types = ["implicit", "authorization_code"]
}

# ruleid: auth.iac.tf-oauth-implicit-grant
resource "aws_cognito_user_pool_client" "app" {
  name                = "app-client"
  user_pool_id        = aws_cognito_user_pool.main.id
  allowed_oauth_flows = ["implicit", "code"]
}

resource "auth0_client" "web" {
  name        = "My SPA"
  app_type    = "spa"
  grant_types = ["authorization_code", "refresh_token"]
}

resource "aws_cognito_user_pool_client" "app" {
  name                = "app-client"
  user_pool_id        = aws_cognito_user_pool.main.id
  allowed_oauth_flows = ["code"]
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.tf-oauth-implicit-grant -- <reason>

References