CODEWITHSUNDEEP
identityserver4identityserver3
walid
walid

Reputation: 17

identity server use client secret from javascript

I'm using identity server 3 and want to know if there is any risk using client secret from JavaScript to be able to use Password token grant.

Edit answer from Scott Brady

Then you'll also know that the implicit flow returns an access token and that the ROPC flow is insecure and deprecated. By stealing a client secret, other apps can impersonate your app, making phishing very simple. Your token endpoint becomes a public endpoint that anyone can use to validate your user's credentials https://www.scottbrady91.com/OAuth/Why-the-Resource-Owner-Password-Credentials-Grant-Type-is-not-Authentication-nor-Suitable-for-Modern-Applications

Upvotes: 1

Views: 748

Answers (1)

Scott Brady
Scott Brady

Reputation: 5598

If it's JavaScript running in the browser, then your secret is not secret anymore.

JavaScript running in the browser is considered a public client. The implicit flow was explicitly designed for your scenario.

Upvotes: 1

Related Questions