# Authentication does not work in ASP.NET MVC OpenIdConnect when I turn off Implicit Flow **URL:** \ **Category:** Get Help\ **Tags:** authorization-code-f, aspnet-mvc, login\ **Created:** [March 1, 2021, 3:30pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693 "2021-03-01T15:30:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Reza](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/reza/32/27909_2.png) [@Reza](https://community.auth0.com/u/Reza)\ **Post date:** [March 1, 2021, 3:30pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/1 "2021-03-01T15:30:43Z")
I followed the documentation regarding how to implement Authentication Code Flow - [Authorization Code Flow](https://auth0.com/docs/flows/authorization-code-flow) - [Add Login Using the Authorization Code](https://auth0.com/docs/flows/add-login-auth-code-flow) Also, as was suggested in the latter, I followed the Quckstart as well, making sure my code and config are identical to the given example. Then I disabled all the authentication flows except Authorization Code and Refresh Token. Now I when I try login with my test user I get an error saying: **unauthorized\_client** : Grant type ‘implicit’ not allowed for the client. When I enable Implicit flow of course it works, but why would I need to enable it even though the documentation says I’m doing an Authorization Code flow? If the documentation is wrong (or misleading) how can I enable Authorization Code flow (as opposed to Implicit flow) in the given [ASP.NET](http://ASP.NET) MVC (OWIN) example? ---
**Author:** ![cibrax](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/cibrax/32/27644_2.png) [@cibrax](https://community.auth0.com/u/cibrax)\ **Post date:** [March 1, 2021, 5:05pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/2 "2021-03-01T17:05:51Z")
Hi Reza, What OWIN example are you using for this ? Implicit Flow runs client side (javascript apps). In an MVC application, there is a callback url running server side so it should be Authorization Code Flow as you stated. In your case, it seems the redirection to the Authorization Server is happening client side so it tries to use implicit flow. Thanks ---
**Author:** ![Reza](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/reza/32/27909_2.png) [@Reza](https://community.auth0.com/u/Reza)\ **Post date:** [March 2, 2021, 6:59am UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/3 "2021-03-02T06:59:20Z")
Thanks for your reply! I am using this example: [https://github.com/auth0-samples/auth0-aspnet-owin-mvc-samples/tree/master/Quickstart/01-Login/MvcApplication/MvcApplication](https://github.com/auth0-samples/auth0-aspnet-owin-mvc-samples/tree/master/Quickstart/01-Login/MvcApplication/MvcApplication) This is the redirection I pasted from the browser; broken down in multiple lines to make it more readable. https://.eu.auth0.com/authorize?client\_id=& redirect\_uri=%2Fcallback& response\_type=code%20id\_token& scope=openid%20profile%20email&state=OpenIdConnect.AuthenticationProperties%3D4Lp7Uxk2sNstiaR2pqrC3PJwy8r\_YzVlLEbl\_hEpf-3N6yzQ\_VTw2jXFKXTsg4I7I\_AbhDv8CMimSoiVHeLl\_nDDrKpajQQVjhp2gdnbJ7IOfLl1H-PRsGFXTnjFt-5CK7IZHLxC1mpyWuKmm7I7Vbh9Fzu4FpC3NXi71fYoZO7iRvcjesINmAdQc3xgOsO690jyxkG\_f1xn1C5fBSiGiKN\_4ARi4XU9YDl3tdqr11g& response\_mode=form\_post& nonce=637502075583186529.MTNhZmVhYWUtZDdjZi00YjZlLThlZGQtYzU4NDUyYTU0NDIwZjBiZmM3M2YtMTVjZS00YmQzLTkyYzUtZWIyOTA5ODIwYjE3& x-client-SKU=ID\_NET461& x-client-ver=5.3.0.0 I’m also expecting it to be Authorization Code Flow, but why when I turn off Implicit in the Advanced settings, it stops working and gives me the error: > [@Reza](#): > > **unauthorized\_client** : Grant type ‘implicit’ not allowed for the client. ---
**Author:** ![cibrax](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/cibrax/32/27644_2.png) [@cibrax](https://community.auth0.com/u/cibrax)\ **Post date:** [March 2, 2021, 1:10pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/4 "2021-03-02T13:10:19Z")
Everything on your end looks right to me. Even the response type in the URL is code, which means Autorization Code Flow. This looks more like an issue on the Auth0 side to me. Thanks ---
**Author:** ![StephanieMunck](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephaniemunck/32/30644_2.png) [@StephanieMunck](https://community.auth0.com/u/StephanieMunck)\ **Post date:** [July 20, 2021, 2:15pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/5 "2021-07-20T14:15:16Z")
I realize that this question was asked a while ago, but I thought I’d follow up since we just ran in to the same problem. It looks like the [ASP.NET](http://ASP.NET) OWIN example is a little outdated with respect to the recommended flows. I think the reason for the warning is that you are requesting both `code` and `id_token` in the `response_type`, which triggers the Hybrid Flow rather than the Authorization Code Flow. And as far as I can tell, the Implicit grant type must be enabled to use Hybrid Flow. So you can either choose to enable the Implicit grant type (not recommended), or remove `id_token` from the `response_type` argument and find a way to handle the token exchange. ---
**Author:** ![frederik.prijck](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/frederik.prijck/32/27014_2.png) [@frederik.prijck](https://community.auth0.com/u/frederik.prijck)\ **Post date:** [July 25, 2021, 1:03pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/6 "2021-07-25T13:03:24Z")
Shiming in a bit late here but I came across this thread and wanted to point out that, apart from what is being mentioned by @StephanieMunck, with Katana it is important to ensure you have set a `RedeemCode = true`, see [How implements Authorization Code Flow ? · Issue #369 · aspnet/AspNetKatana · GitHub](https://github.com/aspnet/AspNetKatana/issues/369#issuecomment-664414368). I would also like to add that, I believe using Implicit Flow is a good idea, as long as you ensure you set the response type to be `form_post`. Doing so ensures you have no need to use a Client Secret (even though that is kept server-side, it is still better not having to use any at all), and should be perfectly fine unless you have the need to call an external API using an Access Token, in that case you probably want to resort to the Authorization Code Flow as being mentioned above. ---
**Author:** ![Reza](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/reza/32/27909_2.png) [@Reza](https://community.auth0.com/u/Reza)\ **Post date:** [July 25, 2021, 1:24pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/7 "2021-07-25T13:24:15Z")
Thanks @StephanieMunck and @frederik.prijck I will give both of these a try and post here if it worked (or not). It is pity though if the official samples that are just a few are not up to date with the latest evolutions. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [July 26, 2021, 9:26am UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/8 "2021-07-26T09:26:55Z")
Let us know if you have any other questions down the road! ---
**Author:** ![ChrisMylonas](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/chrismylonas/32/33663_2.png) [@ChrisMylonas](https://community.auth0.com/u/ChrisMylonas)\ **Post date:** [December 10, 2021, 11:10am UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/9 "2021-12-10T11:10:45Z")
I can confirm too that for ASPNET MVC/OWIN to work correctly with OIDC you need both values set in Options otherwise Auth0 considers the request as of type Implicit (even if it’s not). ```auto Options.ResponseType = OpenIdConnectResponseType.Code; Options.RedeemCode = true; ``` Thanks @Reza, @StephanieMunck and @frederik.prijck for valuable help. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [December 13, 2021, 8:48am UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/10 "2021-12-13T08:48:06Z")
Thanks for sharing that with the rest of community! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [December 22, 2021, 3:12pm UTC](https://community.auth0.com/t/authentication-does-not-work-in-asp-net-mvc-openidconnect-when-i-turn-off-implicit-flow/58693/11 "2021-12-22T15:12:30Z")