A Client Secret is no longer required for Web Server OAuth Flow. This is not a new feature (Spring'17), but I have not given it much thought until now.
"If a client application can’t securely store the client secret and can’t use the user-agent authentication flow, the web server flow is your best option. Previously, the client secret was always required. Now, you can make the client_secret parameter optional in the web server flow by configuring the connected app to not require it."
When would a Client Application NOT be able to use the User-Agent OAuth Flow (but still be able to use Web Server OAuth Flow)?