Is the Salesforce User-Agent Flow truly an "Implicit" grant type? It can most definitely issue a refresh token.
And yet per RFC 6749 Section 4.2 Implicit Grant documentation...
The implicit grant type is used to obtain access tokens (it does not
support the issuance of refresh tokens)...
and
The authorization server MUST NOT issue a refresh token.
Sort of.
You only get the refresh token if you ask for it explicitly with scope = refresh_token and your flow meets other documented constraints such as custom protocol on the callback URL. We agree that this "extension" is not compliant with implicit grant type spec. If memory serves, it was created by SF for mobile apps a while ago. While some might still be using it, it's more or less a legacy option as of now.
Implicit grant is no longer recommended. From oAuth Security BCP:
The implicit grant (response type "token") and other response types causing the authorization server to issue access tokens in the authorization response are vulnerable to access token leakage and access token replay
The BCP goes on to say you might be able to use it if you mitigate certain issues and Salesforce helps you with some of this by e.g. enforcing same-origin on user agent. Still, the threat model is extensive and mitigation strategies are fragile. Thus, the authorization code grant with PKCE is the recommended way to go nowadays for any public client, native mobile or browser-based.
