Is Salesforce's "OAuth 2.0 User-Agent Flow the same as OAuth Implicit Flow?  Salesforce documentation references OAuth 2.0 User-Agent Flow, but I can't find a reference to this name in any non-Salesforce documentation.  From reading the description of the flow, it *almost* matches what other OAuth-related resources call Implicit Flow or Implicit Grant.  BUT, the Implicit Flow doesn't return a refresh token, while documentation for User-Agent Flow say that a refresh token is returned.  Furthermore, non-Salesforce documents discourage the use of Implicit Flow and instead now recommend Authorization Code with PKCE as an alternative.  So what is this User-Agent flow and how does it map to the flows defined in the OAuth standard?

@Ladies Be Architects #Identity and Access Management #OAuth Flow #Security