Comments (6)
@mislav Thanks for taking the time to write a well detailed answer and explanation. I'm glad to hear that I wasn't missing something simple and this is a design discrepancy between web and client side apps. Also that leaking the client ID and the secret doesn't open up a major vulnerability besides securing that clients are using an authentic app and not an imposter.
from oauth.
Just wanted to leave a note here as I was looking how gh cli does these things and wondered why it has a secret exposed in a source tree with a comment:
Looks like if you use device-flow you don't need clientSecret
anymore as api doesn't require its use thus you don't need to expose it. Thought you get back in same scenario @mislav wrote that you can use any clientId
in your app.
from oauth.
(I'm guessing that you're talking about OAuth secrets. The client ID for any OAuth app is public knowledge.)
That's a great question! The short answer: just embed the "secret" value in your app. Even while compiled/obfuscated, assume that the value will always be trivially extractable from your app (and thus not a secret anymore), but that's fine. We do this in GitHub CLI.
Basically, the concept of an OAuth secret doesn't translate well to client apps, since it was designed with web applications in mind. For their OAuth applications, for example, Google asks each developer to indicate whether an OAuth app is a client app and doesn't provide nor require secrets for those apps, since they cannot possibly remain secret. The rest of the protocol remains the same.
Naturally, all this means that anyone can take your OAuth client ID + secret and pretend that they are your application. That's true, but it isn't such a big risk as it sounds. By the nature of running on the user's machine, client apps are not guaranteed to be tamper-proof anyway.
I guess we should add some docs about this to the README.
from oauth.
oauth-0.8.0.zip
Duplicate of #
from oauth.
Related Issues (20)
- [Question] Interest in adding support for the Microsoft identity platform's OAuth device flow? HOT 3
- #2659
- gh pr checkout 7
- Third party isnt working to well.
- [oauth-0.8.0.tar.gz](https://github.com/cli/oauth/files/6928522/oauth-0.8.0.tar.gz)
- [SAMSUNG_globalcode_of_conduct_2020.pdf](https://github.com/cli/cli/files/7764738/SAMSUNG_globalcode_of_conduct_2020.pdf)
- No worries. We'll try to add a test before this merges ✌️
- ## What's Changed
- Add support for custom strings in Device Flow HOT 1
- Return the optional verification_uri_complete
- Device Flow does not work with JSON Responses HOT 1
- ## What's Changed HOT 1
- Note: I had erroneously committed to `master` instead of to a feature branch before creating this PR — I suppose that may be why I saw this message. Regardless, `gh` didn't help me figure this out, but instead confused me further; so I suppose the message could be clarified.
- @fingolfin Thats seems like a good idea. Will you make the PR ?
- HELLO ITS WORKING WONDERFULL SO HAPPY OVER MY FONE. 10000 ROSES TO YOU YOU SAVE MY LIFE THANK YOU
- Can I create an access token with SSO enabled? HOT 2
- brew install gh
- PollToken should cancel early if the context is canceled HOT 3
- Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oauth.