Using the Authorization Code Flow for JavaScript Applications

Best practice is honestly to use the authorization code flow for all of these different things. Back in 2010, JavaScript was very, very limited. Chores did not exist as a technology. These days we can do a much, much better job. If you're working on mobile applications today, I would tell all of your listeners to use Google's app off libraries for both Android and iOS.