Google Oauth for installed applications and Oauth for web applications

Question

So it's hard for me to understand something ...

If you use Oauth for web applications, you register your site with a callback URL and get a unique secret secret key. But once you have received the Oauth token for web applications, you do not need to generate Oauth calls to the google server from the registered domain. I regularly use my key and token from scripts running on the apache server on localhost on my laptop, and Google never says "you are not sending this request from the registered domain." He just sends me the data.

Now, as I understand it, if you use Oauth for installed applications, you use "anonymous" instead of the secret key that you received from Google.

I thought about just using the OAuth auth method for Web Apps, and then passed this token to the installed application, in which my secret code is embedded in its internals. The concern is that code can be detected by bad people. But what is safer ... making them work on secret code or letting them default anonymously?

What is really bad if a “secret” is discovered when an alternative uses “anonymous” as secrecy?

Answer 1

The main difference between OAuth for web applications and OAuth for installed applications (for example, anonymous / anonymous as your consumer key / secret) is the approval page.

For installed applications, Google cannot verify the identity so that a yellow warning box will be shown to the user.

For web applications, there is an actual URL (from within the application) that can be verified. Therefore, the user is not provided with an ugly warning box.

Answer 2

The only thing you need to identify when making an OAuth call is the signature, which is the HMAC-SHA1 string signed with your user secret . There is no connection with any area.

The only thing you need to ensure reasonable security is the user's secret . I don’t quite understand what you mean by “anonymous,” though ...