I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend server (confidential client) that does.
*Note that I use the term mobile app instead of native app only because the spec defines a native app as being a public client:
From rfc6749
Section 2.1:
A native application is a public client installed and executed on the device used by the resource owner. Protocol data and credentials are accessible to the resource owner. It is assumed that any client authentication credentials included in the application can be extracted. On the other hand, dynamically issued credentials such as access tokens or refresh tokens can receive an acceptable level of protection. At a minimum, these credentials are protected from hostile servers with which the application may interact. On some platforms, these credentials might be protected from other applications residing on the same device.
section 1.1:
client - An application making protected resource requests on behalf of the resource owner and with its authorization
The case that I'm inquiring about is similar to how rfc6749 section 2.1 defines a web application, but instead of an HTML user interface, the interface would be a mobile app:
A web application is a confidential client running on a web server. Resource owners access the client via an HTML user interface rendered in a user-agent on the device used by the resource owner. The client credentials as well as any access token issued to the client are stored on the web server and are not exposed to or accessible by the resource owner.
rfc8252's definition of native app seems more reasonable as it doesn't restrict its use to apps that are public clients:
"native app" An app or application that is installed by the user to their device, as distinct from a web app that runs in the browser context only. Apps implemented using web-based technology but distributed as a native app, so-called "hybrid apps", are considered equivalent to native apps for the purpose of this specification.
But again, the spec only provides the best practice for the case where the native app is also the (public) client.
In summary,
- I'm wondering why I haven't been able to find any mention of the client profile I described above (either in the specs or elsewhere).
- Would the Authorization Code Grant (without PKCE) be considered secure enough since even if a malicious app intercepts the authorization code (sent by the external user-agent to the native app, via inter-app communication) it wouldn't be able to exchange it for an access token as it would not be in possession of the client secret which is stored on the backend?
Note that I'm only asking these questions to gain a better understanding of the theory, and not for anything practical.