I have been trying to fiddle with OAuth user-agent flow and understand that you need to have a connected app defined in Salesforce. You would then use the client secret from that in your app to be able to start the OAuth dance.
How come workbench.developerforce.com is able to do this without us creating any connected app in any Salesforce org? Does this web app have some special privileges with Salesforce that it gets the client secret from any Salesforce org?