In connectedApp setting, there is an option called require secret for web-server flow. If I understand that correctly, if we choose that option, when using web-server flow, after authentication, the authorization code will still be sent to the client app. But the client app will only need the authorization code to request for access token - instead of authorization code + client secret.
This flow is actually pretty interesting to me? If the client app doesn't need to provide a client secret to verify, how does the extract round of authorization code provide extra security? Is it almost the same thing as user-agent flow?
