.net-core - ConfidentialClientApplication 和 PublicClientApplication 有什么区别？

Question

我正在组合一个提供 RESTful API 的 Web 服务。我已经构建了一个使用 的 UWP 客户端。 PublicClientApplication 它工作得很好。现在我正在构建一个 Web 应用程序来与相同的服务对话，我发现的示例使用了 保密客户申请为用户获取访问 token 。那么这两个似乎都产生访问 token 的类之间有什么区别(文档非常少甚至不存在)以及 to 类之间的用例是什么。

Answer 1

在我自己查看 MSAL 时，我设法找到了 MSAL.net 的一些文档。包括 chapter关于客户端应用程序。

它明确地谈到了 之间的区别。保密客户端应用类和 公共(public)客户端应用类 .

保密客户

Confidential client applications are typically applications which run on servers (Web Apps, Web API, or even service/daemon applications). They are considered difficult to access, and therefore capable of keeping an application secret. Confidential clients are able to hold configuration time secrets. Each instance of the client has a distinct configuration (including clientId and secret). These values are difficult for end users to extract. A web app is the most common confidential client. The clientId is exposed through the web browser, but the secret is passed only in the back channel and never directly exposed.

公共(public)客户端

On the contrary public client applications are typically applications which run on devices (phones for instance) or desktop machines. They are not trusted to safely keep application secrets, and therefore access Web APIs in the name of the user only (they only support public client flows). Public clients are unable to hold configuration time secrets, and as a result have no client secret