I recently checked the post on Digging Deeper into OAuth 2.0 on Force.com by Pat Patterson.
In client User-Agent authentication flow, the token is sent in the redirect URI only. Now I don't understood, how its secure ? If it is then why we used HTTP POST to get access token in web server authentication flow.
I am relatively new at this, so I don't understood how the fragment URL (only difference) can secure the token?