What is the purpose of the OAuth2 client secret?

Question

A typical OAuth2 Authorization Code Flow scenario looks like this:

What I'm not understanding is the purpose of the client secret in steps 6 and 7. If the auth server is guaranteed to redirect back to the web app and send its authorization code there, how could an attacker get the authorization code (which is presumably the reason for the client secret)?

In addition, it seems that the PKCE extension does away with the need for the client secret, but reading the RFC for that I can't see any reason why it should. Could somebody explain this for me?

Answer 1

In the context of an authorization code grant, the main purpose of the client secret is to prevent client impersonation. That is to say, it prevents a malicious client from pretending to be a legitimate client in order to get an access token from the resource owner under false pretenses.

It is worth pointing out that using a client secret is not the only means available to prevent client impersonation. For public clients (such as mobile apps and single page apps), client impersonation is prevented by the use of fixed https redirect uris. By only allowing specific, https redirect uris, a malicious client attempting to act as a legitimate client would be unable to intercept the authorization code. By being unable to intercept the authorization code, the malicious client would be unable to make the request to the token endpoint.

PKCE solves a different problem - basically, it prevents a malicious client that has somehow received an authorization code from using it to request an access token from the token endpoint. This was originally recognized as a problem in the mobile app space, but it is a useful technique for single page apps too. There is actually no harm in using PKCE with every OAuth 2 client, even those which use a client secret. The OAuth 2 Best Current Practice recommends using it everywhere.

Answer 2

"What is the purpose of the OAuth2 client secret?"

As described in the oauth.com documentation, the client_secret can be considered as a password that is known only by the client itself and the authorization server. That's basically it, it's a password used to authenticate the "Regular Web App" on the "Auth0 Tenant".

The client_secret is a secret known only to the application and the authorization server.

The important part here is to not get confused about the user password, and the client_secret, that are different secrets, and are used in different parts of the OAuth 2.0 flow.

tl;dr: client_secret = Regular Web App's password. client_id = Regular Web App's user name.