Given in OAuth 2.0 or some other Web Application or even REST API server. How would you protect users from using a malicious client or a compromised browser?
For OAuth client secret can be placed in an existing application and extracted Risk of keeping OAuth2 client_secret in application
Even with the use of a redirect_uri, the malicious client can simply take it and still redirect to their own site.
With a normal web app, a XSRF token is still generated on the server and passed to the client and the user can still enter their credentials.
A compromised client can also ignore the CORS checks and send whatever it wants as the Origin
header.
I'm sort of leaning towards that the only prevention is to tell users make sure you get your clients/apps/browsers from a trusted sources and it is not really something that can be addressed technically.