There are a myriad of references to how to generate
ClientSecret to register an app when working with the SharePoint appmodel. However, I can't seem to find any good documentation explaining exactly how these are used.
The fact that it is called "secret" seems to indicate that it is probably used in some fashion to secure communications between SharePoint and the app.
However, I am a bit confused as to where this is used in the communication process and how to securely manage the id and secret.
I primarily work with provider-hosted apps.
Is the secret used for encryption? For token signing? Should it only be known to the publisher of the app? Or only to the environment where the app is installed? Or is it a shared secret between the both provider and SharePoint installation environment? If the latter, then how is it managed so that different installations for different companies don't leak the secret?