CODEWITHSUNDEEP
securityspring-securityoauthoauth-2.0spring-security-oauth2
Shashank Gutha
Shashank Gutha

Reputation: 145

How to Secure Oauth 2.0 Client ID and Client Secret

When an Android oauth 2.0 client application has client ID and client Secret hard-coded in it. it is very easy to decompile the application and retrieve the credentials. Then What is the use of providing these credentials to oauth server.

Upvotes: 1

Views: 1600

Answers (1)

Hans Z.
Hans Z.

Reputation: 54118

It is not recommended to hard-code client_id and client_secret into a native app i.e. to use what is called a "confidential client" in a mobile app scenario exactly because the client_secret cannot be kept a secret.

A native app would typically be a "public client" to the Authorization Server i.e. one that does not have a client_secret. Security would come from the fact that a unique redirect URI is registered and additional OAuth features like PKCE (https://www.rfc-editor.org/rfc/rfc7636) are applied.

For general recommendations on using OAuth 2.0 for native apps see: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-native-apps, especially the security considerations at: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-native-apps-10#section-8

Upvotes: 5

Related Questions