Ask HN: App Authentication in OAuth 2.0

How do you authorise apps in OAuth 2.0? Facebook do it by comparing the requested redirect_url with one supplied. However, I believe this is not secure. For example, I publish my client_id and redirect_url in my Javascript application. A Bad Person extracts this information and constructs an application that detects a redirect to this url, extracts the token and then makes requests as my app. Have I misunderstood something?