protected boolean clientNeedAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
        val callContext = new CallContext(new JEEContext(request, response), sessionStore.getObject());
        val clientId = requestParameterResolver.getObject().resolveClientIdAndClientSecret(callContext).getLeft();
        if (clientId.isEmpty()) {
            return true;
        }

        val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager.getObject(), clientId);
        return registeredService == null || OAuth20Utils.doesServiceNeedAuthentication(registeredService);
    }
Is the client requesting is a OAuth "public" client?
An OAuth "public" client is one that does not define a secret like a mobile application.

@param request  the request
@param response the response
@return true/false
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/OAuth20HandlerInterceptorAdapter.java