A harbor-radio companion app is a public mobile client, yet its app registration lists only a web redirect URI and treats the app as a confidential client with a client secret. What should the security engineer correct on the registration?
Select an answer to reveal the explanation.
Short Explanation
Phones are public clients—they cannot hide a secret any better than a sticky note on the screen. Register the mobile platform and redirect URI, drop the pretend confidential secret, and stop treating the radio app like a web server.
Full Explanation
App registration platform and redirect URI settings must match the real client. Public mobile clients use public-client flows and platform-appropriate redirect URIs; embedding client secrets in mobile binaries is insecure and misclassifies the app as confidential. NSGs do not validate OAuth redirect URIs. Rewriting the app as a daemon changes the scenario rather than fixing the registration for an interactive mobile client.