CODEWITHSUNDEEP
javaspringspring-securityoauth-2.0spring-security-oauth2
ikryvorotenko
ikryvorotenko

Reputation: 1423

Proper place for oAuth2 clientId & clientSecret

I'm working on my web application which supports the oAuth2 authentication with third-part services. So i have my clientId and clientSecret keys, which i use to authorize my application.

I'm using Spring security oAuth dependency and configure all that in props. And so here's the problem: as i understand, keeping these information in classpath props in unsafe. From the other side, i'm looking for a solution which allows to get my application up and running from the box without any third-part props/configs (so i don't like the idea to put these props on environment side)

I'm wondering if there are any best practices of keeping clientId and clientSecret keys?

Upvotes: 1

Views: 941

Answers (1)

Olga Khylkouskaya
Olga Khylkouskaya

Reputation: 495

At Salesforce we stored sensitive information in properties in encrypted way. For example:

sensitive.property=ENC(2sfs25D!==)

When an app starts it reads those properties, identifies which ones are encrypted and decrypts them. It is possible to add custom logic to spring default @value readings for example.

Depending on your company security guidelines use appropriate encryption algorithm. For example Scrypt: https://mvnrepository.com/artifact/com.lambdaworks/scrypt

int SCRYPT_N_PARAM = 65536;
int SCRYPT_R_PARAM = 8; 
SCryptUtil.scrypt(str, SCRYPT_N_PARAM, SCRYPT_R_PARAM, 1);

Upvotes: 1

Related Questions