Sep 12, 2018
0
Level 8
API Question: can I store oauth client_secret on server instead of sending it from the frontend client so everyone can see it?
I am building a client that will consume api. Using Laravel and vuejs for this. Backend is it's own app and frontend client is its own app that will run on vuejs.
Right now when I want to login user to the backend I have to send this data from client:
form: {
'grant_type' : 'password',
'username': '[email protected]',
'password': 'pass1234',
'provider': 'student',
'client_id': "2",
'client_secret' : 'fXz4bILqz5CnDjFCvXpw7RZWLgWXxsTa0LN1'
}
How smart or dangerous is it to save secret in client like this? Now everyone can see it, can they use this in some way? And if its dangerous how is everyone else doing it? If you are not sending secret from the client, then where do you keep it?
Please or to participate in this conversation.