for some SPA client_secret is not required to be sent for fetching token

[ronak1009]

For the following code:

exports.OAuth2.prototype.getOAuthAccessToken= function(code, params, callback) {
  var params= params || {};
  params['client_id'] = this._clientId;
  params['client_secret'] = this._clientSecret;

For some OIDC clients, the client_secret is not required to be passed. For example, with ORY,
ory doc, the example shows that client_secret is removed.

But for some the others like OKTA, client_secret is required.

I am using passport-js 's strategy @govtechsg/passport-openidconnect with pkce workflow which uses this library. It requires this option.