How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications?

The Authorization Code flow has the client redirect the user to an authorization server to authenticate and consent, receive a short-lived authorization code via redirect, then exchange that code (server-side, using a client secret) for an access token via a direct back-channel request -- keeping the actual token exchange off the browser's history and network logs. The Implicit flow, which returned tokens directly in the redirect URL fragment, is now deprecated because it exposed tokens to browser history, referrer leakage, and had no refresh token support.

// Step 1: Redirect user to authorization server
// GET https://auth.example.com/authorize?client_id=...&response_type=code&redirect_uri=...

// Step 2: User authenticates, redirected back with a code
// GET https://myapp.com/callback?code=abc123

// Step 3: Server exchanges code for tokens (back-channel, not visible to browser)
// POST https://auth.example.com/token  { code: 'abc123', client_secret: '...' }