The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for example the 'official' iPhone or Android client application to by backend API.
My question is: how can I guarantee that requests from sources claiming to be this client application can be trusted? For example:
I have registered my android app on my OAuth2 server with the client_id of
android_appwith access to the grant type of
password(i.e. Resource Owner Password Credentials).
As the Android app is a client application so I have assumed it is not trusted to keep the client secret 'secret' and so haven't assigned it one. The app config contains the client_id and grant_type as well as the authentication endpoint.
A user decompiles / unzips / de-obfuscates my app and finds the client_id and endpoint
What's to stop them client making authentication requests to that endpoint with the client id? I'd consider assigning the client a client_secret, but it just seems like that won't solve the issue because a user could just find it in the app.