protected boolean requestRequiresAuthentication(final HttpServletRequest request,
                                                    final HttpServletResponse response) {
        val context = new JEEContext(request, response);
        val revokeTokenRequest = isRevokeTokenRequest(request, response);

        if (revokeTokenRequest) {
            return clientNeedAuthentication(request, response);
        }

        val accessTokenRequest = isAccessTokenRequest(request, response);
        val extractor = extractAccessTokenGrantRequest(context);
        if (accessTokenRequest) {
            request.setAttribute(OAuth20Constants.REQUEST_ATTRIBUTE_ACCESS_TOKEN_REQUEST, Boolean.TRUE);
            if (extractor.isPresent()) {
                val ext = extractor.get();
                return ext.getResponseType() != OAuth20ResponseTypes.DEVICE_CODE;
            }
            return true;
        }
        
        if (extractor.isPresent()) {
            val ext = extractor.get();
            return ext.requestMustBeAuthenticated();
        }
        return false;
    }
Is the client requesting is a OAuth "public" client?
An OAuth "public" client is one that does not define a secret like a mobile application.

@param request  the request
@param response the response
@return true/false
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/OAuth20HandlerInterceptorAdapter.java