title: Disadvantages of the Implicit Authorization Workflow vs Authorization Code Grant for Authentication Only?
body: <p>I cannot figure out advantages of using Authorization Code Grant vs. Implicit Flow for <strong>authentication purposes only</strong> for a classic web-app?</p>
  
  <p>Say, there is an web-app which authenticates via a 3rd party Iaas provider. The web-app only needs to know if a user (identified by some ID) is authenticated. The web-app does not hit any 3rd party services and so does not need to have any access tokens for authorisation purposes.</p>
  
  <p>In this example, I do not see how getting user_id (JWT token) directly into the web-browser from the IaaS is less secure then getting the same user_id via the web backend? In both cases a session will be established. What do I loose if I use implicit grant in this case?</p>