I understand that in the User Agent flow, due to the client's limitation of protecting the consumer secret, it is never shared but at the same time, the refresh token can be issued in the user agent flow. Given that a refresh token should also be closely guarded but it is still issued in this flow, why can't the consumer secret be shared?
4 comentarios
Thanks @Petr Svestka . @Ashley Jose I understand the difference between the two but the refresh token is just as important as a consumer secret so why allow one but not the other. To Petr's point, it seems it's just an additional layer of security and nothing else.
