This question already has an answer here:
I am trying to understand what additional security the the consumer secret(client_secret) for OAuth 2.0 provides. If one want to avoid using the consumer secret when authenticating you can use the User Agent flow rather than Web Server flow.
As far as I can see there is no way to restrict which flow that you allow to be used for your connected app. So what is the purpose of the consumer secret when anyone can easily avoid using consumer secret for authentication by selecting a different response_type(=token) in order to retrieve an access token?
Is this not just like having two doors into the same house. One with two locks, and the other with just one?