OAuth 2.0 Authorization Code Grant without secret
<p>So I've been looking at setting up OAuth 2.0 for a Cordova mobile app using Microsofts <a href="https://github.com/AzureAD/azure-activedirectory-library-for-cordova" rel="nofollow noreferrer">cordova-plugin-ms-adal plugin</a> (which uses the native libs) against a custom API using Azure AD. This all works well but I'm a bit confused with the use of the secret (or more specifically its absence).</p>
<p>In many articles on the web they state that when using the Authorization Code Grant and requesting a token, you include the secret. And that this grant type is ideal for use when you can securely store the secret e.g. on a server.</p>
<p>However the plugin <strong>does not require that a secret is specified in the app</strong> (and rightly so) but it still uses the Authorization Code Grant to authenticate. Also I can manually call</p>
<pre><code>https://login.windows.net/common/oauth2/authorize?resource=http://***.onmicrosoft.com/***API&amp;client_id=***&amp;response_type=code&amp;redirect_uri=http://***.onmicrosoft.com/***App
</code></pre>
<p>in my browser, login, get the code and then POST to <a href="https://login.windows.net/common/oauth2/token" rel="nofollow noreferrer">https://login.windows.net/common/oauth2/token</a> with</p>
<pre><code>grant_type: authorization_code
client_id: ***
code: ***
redirect_uri: http://***.onmicrosoft.com/***App
resource: http://***.onmicrosoft.com/***API
</code></pre>
<p>and it works, so I get back a valid JWT, <strong>without having to send a secret</strong>.</p>
<p>Why!? Is this less secure? (I also noticed that the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3" rel="nofollow noreferrer">OAuth 2.0 spec section 4.1.3</a> does not state that the secret is required for grant type Authorization Code!?)</p>
<p><strong>What are the implications of using a grant type of authorization_code without a secret / basic auth header?</strong></p>