3 ms·

How does authenticating the user help? The whole point of the exercise is to block 3rd party apps. It is assumed that the user is authorized to access Reddit th

• cratermoon 3y ago
  That's how oauth2 works. If the app isn't registered with reddit, it doesn't get to act on behalf of the user. No app secrets are necessary, just the user's login credentials, which the app never sees. The resource owner (reddit in this case) can allow or disallow based on the client_id (which is not a secret) and the redirect_uri registered for the app. Reddit, twitter, google, github, apple, and dozens of others handle apps this way.
  • gizmo686 3y ago
    Client_id is spoofable. Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect. Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients. The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.