What is the point in sending client_id and client_secret in SPAs to auth server?

Question

I am trying to understand some concepts in oauth and openid connect. To provide some context, let's say I am building a SPA (single page application) that talks to a bunch of microservices. A user needs to authenticate themselves (through the application) before they can access any data and the user will authenticate themselves on a trusted site.

Looking at oauth 2 and some of the suggested flows, Resource Owner Password Credentials Grant seems to be a fitting candidate.

 +----------+
 | Resource |
 |  Owner   |
 |          |
 +----------+
      v
      |    Resource Owner
     (A) Password Credentials
      |
      v
 +---------+                                  +---------------+
 |         |>--(B)---- Resource Owner ------->|               |
 |         |         Password Credentials     | Authorization |
 | Client  |                                  |     Server    |
 |         |<--(C)---- Access Token ---------<|               |
 |         |    (w/ Optional Refresh Token)   |               |
 +---------+                                  +---------------+

Some articles I have read say you should send your client_id and client_secret to the authorization server with your payload (username, password ... etc) when requesting authorization. My question is, does this hold for SPA? Can't someone just inspect your javascript and see what your client_id and client_secret? Is there any point in sending this information?

Answer 1

You're correct, a SPA on it's own cannot keep secrets or perform client authentication so there is no point in sending the client_secret.

In the OAuth2 world these clients are known as public clients or non-confidential clients in opposition to confidential clients which are able to perform client authentication, for example, a traditional server-side application that could keep a client secret in a secure way on the server-side.

Performing client authentication is not mandatory, however, you'll lose the ability to perform decisions based on knowing for sure the client identity.