title: Stackexchange API Implicit vs Explicit
body: <p>This question is inspired by the documentation on the stackexchange and facebook API (<a href="http://api.stackexchange.com/docs/authentication">http://api.stackexchange.com/docs/authentication</a>) but is probably more widely applicable to OAUTH 2.0 in general. </p>
  
  <p>My question is, why would you want to use the explicit authentication model when the implicit model seems like much simpler why of authenticating and getting access to content? </p>
  
  <p>Are there limitations implied by the implicit approach and which is the most suitable method for a node.js application which is technically a server side app but which seems like would be suited to the use of the client side javascript libs. </p>
  
  <p><strong>Edit</strong></p>
  
  <p>After doing some reading it appears the "implicit" nature of the web client flow stems from the fact that the Resource Owner (user), implicitly trusts the client (the web browser). This means the simplified flow is appropriate, given this implied trust is a given.</p>
  
  <p>This still leads to the question that when performing authentication via OAUTH 2.0 that the Resource Owner (user) must be vigilant as to whether they implicitly trust the client or not. This seems like a potentially dangerous stance as it assumes awareness AND knowledge on behalf of the user and there seems likely to lead to security concerns.</p>