Re:Teddit Is Shutting Down
by cratermoon on Monday July 17, 2023 @11:49AM
(#36759690)
That's how oauth2 works. If the app isn't registered with reddit, it doesn't get to act on behalf of the user. No app secrets are necessary, just the user's login credentials, which the app never sees. The resource owner (reddit in this case) can allow or disallow based on the client_id (which is not a secret) and the redirect_uri registered for the app. Reddit, twitter, google, github, apple, and dozens of others handle apps this way.
[ Parent
| on HN ]
Client_id is spoofable.
Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect.
Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients.
The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.