title: How does hello.js avoid storing the client_secret?
body: <p>I'm currently on a mission to figure out how to adequately utilize an OAuth 2.0 provider strictly from client-side javascript and have concerns about exposing the application's <code>client_secret</code>.  Which is essentially the "password" of the OAuth client.</p>
  
  <p>How does <a href="https://github.com/MrSwitch/hello.js" rel="nofollow">hello.js</a> avoid the <code>client_secret</code> all together?</p>
  
  <p>Do these providers rely on the referrer and application domain to validate (identify) client requests?</p>