Autentication Azure ad Client Secret is necessary?

Question

I have the following doubt, I have a project that is based on microsoft authentication, a frontend with angular using msal and the backend with passport-azure-ad. My question is the following, is it necessary to use the client secret?

Answer 1

When we are using authorization code flow or hybrid flow in OpenID Connect, the client exchanges an authorization code for an access token. During this step, the client has to authenticate itself to the server. One way to authenticate the client is by using a client secret.

Client secret is required for web apps which can store the client_secret securely on the server side.All confidential clients have a choice of using client secrets or certificate credentials and passport azure ad library is designed for auth flows in server side web apps.

Note:ClientID and Client Secrets are passed to AAD by MSAL, and if you are using a confidential client (like: WebApp, WebAPI or Daemon/Service) that runs on Azure PaaS Service, or any other secured servers, only the clientID gets exposed by MSAL but not the client secret, as the client secret is passed only in the backend (server side) to AAD and never directly exposed and requires proper authentication.

msal client apps

If your app is native(spa), client secret is not needed

Public clients, which include native applications and single page apps, must not use secrets or certificates when redeeming an authorization code as client_secret can't be reliably stored on devices or web pages and the secret can be vulnerable to attacks if it is client side exposed..

Reference: v2-oauth2-auth-code-flow-Client secret