3 ms·
This secret is merely the token that allows for new users to sign up. Once you are authenticated, you get a per-user secret that is kept in local storage. Many
by jchanimal 9y ago
This secret is merely the token that allows for new users to sign up. Once you are authenticated, you get a per-user secret that is kept in local storage.
Many signup forms don't even have the equivalent of the first secret. It's purpose is more as a client identifier than a genuine secret. If a malicious client were to grab that published secret, the web service author could rotate keys and put a new secret in the HTML, and rate limit the attacked secret.
- placeybordeaux 9y agoWould you consider my private keys secure if I posted them here and said that I would rotate them as soon as someone uses them in a way I don't like?
- jchanimal 9y agoIt's common for client applications to encode a client secret. Many API client apps use a model like this, for example Firebase calls their equivalent token an API Key. The "secret" in this case is really being used to select a context. So the secret you'd embed in your copy of the app would differ from mine, and it would point to your database, not mine.