3 ms·

> Of course that is if the OAuth provider allows it. That's the catch. Last time I checked, at least Google didn't. So how can you write a (F)OSS email applica

by deng 6y ago

> Of course that is if the OAuth provider allows it. That's the catch. Last time I checked, at least Google didn't. So how can you write a (F)OSS email application for accessing GMail via OAuth2, without putting the secrets into the code (which Google also forbids)?

tptacek 6y ago
Google Mail's OAuth2 instructions discuss this point explicitly.
- diafygi 6y ago
  Have a link?
  - psanford 6y ago
    "The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)"[0] [0]: https://developers.google.com/identity/protocols/oauth2 https://developers.google.com/identity/protocols/oauth2
dwaite 6y ago
The conversation I had with a Google engineer implied the appropriate course of action was to embed the secret. https://github.com/openid/AppAuth-JS/issues/46 https://github.com/openid/AppAuth-JS/issues/46
- deng 6y ago
  The Google engineer should read Google's terms of service which explicitly states that you may not do that (see my reply above).
niftich 6y ago
In this situation, their guidance says to embed the secret, because in this context it's obviously not a secret. Here's the current page [1]; here's the earliest Archive.org snapshot of its one-earlier predecessor page from 2015 [2] -- the advice has been consistent. [1] https://developers.google.com/identity/protocols/oauth2/native-app https://developers.google.com/identity/protocols/oauth2/nati... [2] https://web.archive.org/web/20150520223809/https://developers.google.com/identity/protocols/OAuth2InstalledApp https://web.archive.org/web/20150520223809/https://developer...
- deng 6y ago
  No, Google is not consistent in the slightest, because their terms of service directly contradict this statement: "Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects." From: https://developers.google.com/terms https://developers.google.com/terms

by deng 6y ago

tptacek 6y ago

Google Mail's OAuth2 instructions discuss this point explicitly.

diafygi 6y ago
Have a link?
- psanford 6y ago
  "The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)"[0] [0]: https://developers.google.com/identity/protocols/oauth2 https://developers.google.com/identity/protocols/oauth2

dwaite 6y ago

The conversation I had with a Google engineer implied the appropriate course of action was to embed the secret. https://github.com/openid/AppAuth-JS/issues/46 https://github.com/openid/AppAuth-JS/issues/46

deng 6y ago
The Google engineer should read Google's terms of service which explicitly states that you may not do that (see my reply above).

niftich 6y ago

In this situation, their guidance says to embed the secret, because in this context it's obviously not a secret. Here's the current page [1]; here's the earliest Archive.org snapshot of its one-earlier predecessor page from 2015 [2] -- the advice has been consistent. [1] https://developers.google.com/identity/protocols/oauth2/native-app https://developers.google.com/identity/protocols/oauth2/nati... [2] https://web.archive.org/web/20150520223809/https://developers.google.com/identity/protocols/OAuth2InstalledApp https://web.archive.org/web/20150520223809/https://developer...

deng 6y ago
No, Google is not consistent in the slightest, because their terms of service directly contradict this statement: "Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects." From: https://developers.google.com/terms https://developers.google.com/terms