title: How do client-side JS libraries for OAuth2 maintain secure authentication?
body: <p>I'm new to OAuth2 and there's a problem I've been struggling with and despite research still can't grasp.</p>
  
  <p>The difficulty in having a JS client for OAuth2 is that you can't store the client secret, because it will be widely accessible in the browser. I.e. in <a href="https://stackoverflow.com/questions/1221371/application-that-uses-oauth-and-javascript">this SO question</a> the highest-rated comment says: </p>
  
  <blockquote>
    <p>"I think tokenSecret and consumerSekret parameters are supposed to be
    secret! How could they remain secret when downloaded to browser?!!!"</p>
  </blockquote>
  
  <p>Therefore how do client-side OAuth2 frameworks like <a href="http://adodson.com/hello.js/" rel="noreferrer">hello.js</a> or <a href="https://oauth.io/" rel="noreferrer">oauth.io</a> overcome this problem? I know they use a server-side proxy (which knows the ID and secret) for their requests, but the client JS code still needs to somehow tell the proxy who it is. So what prevents anyone from taking the JS code from my website and talking to the proxy on my behalf?</p>
  
  <p>I've also found the <a href="https://developers.google.com/api-client-library/javascript/" rel="noreferrer">Google APIs Client Library for JavaScript</a>. AFAIK there the client code does not pass a secret. Do I understand correctly that they manage this by having a predefined OAuth response address? (so that the tokens are always returned via a predefined HTTP address). So even if somebody tries to impersonate my website by using my ID, the tokens will still get returned to my website?</p>
  
  <p>Maybe I'm confusing a few different topics here, any light on the subject would be appreciated.</p>