ConfidentialClientApplication和PublicClientApplication有什么区别？

Question

I'm putting together a web service that provides a RESTful API. I've built a UWP client that uses a PublicClientApplication and it works pretty well. Now I'm building a Web Application to also speak to the same service and the examples I've found use the ConfidentialClientApplication to acquire access tokens for the user. So what is the difference between the two classes that both seem to produce access tokens (documentation is very light to non-existent) and what are the use cases between the to classes.

Answer 1

While looking into MSAL myself I managed to find some documentation for MSAL.net including a chapter about Client applications.

It explicitly talks about the differences between the Confidential client application class and the Public client application class .

Confidential Client

Confidential client applications are typically applications which run on servers (Web Apps, Web API, or even service/daemon applications). They are considered difficult to access, and therefore capable of keeping an application secret. Confidential clients are able to hold configuration time secrets. Each instance of the client has a distinct configuration (including clientId and secret). These values are difficult for end users to extract. A web app is the most common confidential client. The clientId is exposed through the web browser, but the secret is passed only in the back channel and never directly exposed.

Public Client

On the contrary public client applications are typically applications which run on devices (phones for instance) or desktop machines. They are not trusted to safely keep application secrets, and therefore access Web APIs in the name of the user only (they only support public client flows). Public clients are unable to hold configuration time secrets, and as a result have no client secret