Identity Server 3 implicit grant with mvc application
<p>According to openid spec: Implicit grant is suitable javascript and mobile applications and it is less secure compare with authorization code grant. In other words; as far as i understand, it is not recomended for server based application(like aspnet mvc).</p>

<blockquote>
  <p>The Implicit Flow is mainly used by Clients implemented in a browser
  using a scripting language</p>
</blockquote>

<p>But, i have seen some examples using implicit grant with mvc application(for example: <a href="https://github.com/IdentityServer/IdentityServer3.Samples/tree/master/source/MVC%20Authentication/EmbeddedMvc" rel="nofollow">https://github.com/IdentityServer/IdentityServer3.Samples/tree/master/source/MVC%20Authentication/EmbeddedMvc</a>). So i am confused.</p>

<p>Is it correct(secure) using implicit grant with mvc application especially sso purpose?</p>

<p>If not; is there an owin middleware for mvc client application to handle authorization code flow?</p>