Yes, this is correct behavior. You need to log in to Gmail in order to validate your OAuth request. (This is true for both 1.1 and 2.0 versions).
Please note that you are not giving your credentials to the application, but only to Gmail's web interface using web browser, in return it returns a secret that is used by application to login.