Webauth checks the http origin so it only gives the code to the correct website, taking the human out of the decision loop.

It's very vaguely similar to TLS connections with mutual authentication, you can't normally MITM/proxy it.