title: Why I shouldn't keep client_secret in mobile app in OAuth 2.0 (authorization code grant flow)
body: <p>We've got an app, which should use authentification through 3-rd party OAuth 2.0 server, which acts as an authorization server.</p>
  
  <p>As i understand there are two possibilities.</p>
  
  <p>The "right" one is:</p>
  
  <ol>
  <li>Mobile app stores client_id</li>
  <li>Mobile app starts with GET /auth to receive authorization_code</li>
  <li>Authorization server returns response with redirect to redirect_uri
  and attached authorization code. We assume, that redirect_uri is an
  endpoint on our own server.</li>
  <li>Mobile app follows redirect</li>
  <li>Our server receives request, takes authorization_code from query and
  exchanges it for access_token using POST /token method and
  client_secret (stored on server).</li>
  <li>Server responses to mobile app with access_token</li>
  <li>Mobile app takes access_token and uses it in future requests.</li>
  </ol>
  
  <p>The "bad" one is:</p>
  
  <ol>
  <li>Mobile app stores client_id <strong>and client_secret</strong></li>
  <li>Mobile app starts with GET /auth to receive authorization_code</li>
  <li>Authorization server returns response with redirect to redirect_uri
  and attached authorization code. We assume, that application
  intercept it and takes authorization_code (we can simply ask to
  redirect to localhost).</li>
  <li>Mobile app exchanges it for access_token using POST /token method
  and client_secret.</li>
  <li>Mobile app takes access_token and uses it in all future requests.</li>
  </ol>
  
  <p>So i can't see real difference between this two alternatives. In both cases we end up with access token. In both cases we need real user to enter his login and password in rather secure webview.</p>
  
  <p>Even if some bad guys will distribute fake application... what do prohibit them from using our server's callback to exchange authorisation code for access_token? Our server can't distinguish "bad" and "good" application - it just receives request GET \callback?code=blablabla and replies with access_token.</p>
  
  <p>So why should we keep secret on server? What is the case of fraud with faked applications?</p>