Client_id is spoofable. Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a pro

Client_id is spoofable. Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect. Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients. The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.