The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain length to prevent phishing attacks. Also it says that e.g. single page applications shouldn't use a secret in some cases.

I am a little bit confused but all of this. Imagine we have a user(Browser), a relaying party and an id provider and starting an authentication process using the authorization code mode (maybe also the implicit mode). At which points could this process lead to vulnerabilities/risks when we are misusing/not using the client id or client secret?

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain length to prevent phishing attacks. Also it says that e.g. single page applications shouldn't use a secret in some cases.

I am a little bit confused but all of this. Imagine we have a user(browser), a relying party and an id provider and starting an authentication process using the authorization code mode (maybe also the implicit mode). At which points could this process lead to vulnerabilities/risks when we are misusing/not using the client id or client secret?

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain length to prevent phishing attacks. Also it says that e.g. single page applications shouldn't use a secret in some cases.

I am a little bit confused but all of this. Imagine we have a user(Browser), a relaying party and an id provider and starting an authentication process using the authorization code mode. At which points could this process lead to vulnerabilities/risks when we are misusing/not using the client id or client secret?

The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain length to prevent phishing attacks. Also it says that e.g. single page applications shouldn't use a secret in some cases.

I am a little bit confused but all of this. Imagine we have a user(Browser), a relaying party and an id provider and starting an authentication process using the authorization code mode (maybe also the implicit mode). At which points could this process lead to vulnerabilities/risks when we are misusing/not using the client id or client secret?