The explicit flow approach is the most commonly used in server-side web applications for a number of good reasons: the auth source code is not publicly exposed, the client SecretC confidentiality can be maintained, and the whole process is definitely more secure due to the presence of the authorization code, that is nothing less than an additional security layer.
On top of that, in our given scenario, we can rely on an excellent server-side tool--the Microsoft.AspNetCore.Identity service--which natively supports a wide bunch of external providers, including Facebook, Google, Twitter, and so on. All we need to do is implement a couple of action methods in our existing TokenController.
The only real downside about ...
