3 ms·
> What makes you think you can’t issue per-Client, client secrets at install time? IIRC I want to implement e.g. Github auth in my app I have one secret for my
by throwaway290 4y ago
> What makes you think you can’t issue per-Client, client secrets at install time?
IIRC I want to implement e.g. Github auth in my app I have one secret for my dev account, last I checked you couldn't just generate a client ID for every user... And with that in mind I can't be sure an attacker doesn't extract the "secret" from my app, then direct unsuspecting users to the prompt and intercepts their access keys.
- SgtBastard 4y agoSure, these are limitations of GitHub’s implementation. There’s nothing in the spec that describes GitHub’s implementation of an Authorization server as one-client-key-per-app-binary as being a requirement (but I can see the convenience for the AS implementer). GP asked how to approach a (presumably) from scratch implementation compliant with OAuth 2.0. I provided him with one. Please don’t straw man my comments.
- throwaway290 4y agoI asked, and this is my use case. I don't know what other common scenarios for OAuth2 implementation in a native app you'd expect, except for handling authenticating with major systems like Google, Github and so on... Thanks though.