OAuth 2.0 Implicit Flow to Authorization Code Flow with PKCE Transition

A small-scale application is upgrading its authentication mechanism to align with OAuth 2.1 standards by migrating from the deprecated Implicit Flow to the Authorization Code Flow with PKCE. The goal is to eliminate the exposure of access tokens in the URL fragment without introducing service downtime.

The proposed strategy involves configuring the Authorization Server to support both response_type=token and response_type=code for the same client ID during a transition window. This allows existing clients to function while new versions are deployed.

Uncertainty exists regarding the token lifecycle management during this shift, specifically when introducing refresh tokens to a client that previously relied on short-lived implicit tokens.

• Should the application maintain the existing short-lived access token duration or implement a new expiration strategy alongside refresh tokens?
• What is the recommended approach for handling session persistence for users who authenticated via the Implicit Flow just before the PKCE transition?