RangelReale/osin — pull request #27 by mrkhingston (2014-09-22 09:21:50+00:00)
Title: Allow client_secret to be ommitted from requests if configured in the cl...

...ient settings

Sorry - I stuffed up the pull request I had created for this change, so here is just the client change, without my merge commits. Below is the original pull request comment.

RangelReale - any comment on these changes?

Thanks for your work on the library so far. This is just a small change I need to ensure that I can keep the client secret out of my mobile application. So for that client only I will be needing to set the RequiresSecret configuration to false. (FWIW, the mobile app is going to be using password authentication only). Other clients will continue to work as usual.

I suppose you're already across why a client would want to keep the secret private and the mentions of this in the spec. If not then most of what I know about the reasoning behind keeping the client secret out of mobile and desktop applications is summarised well here:

http://stackoverflow.com/questions/19615372/client-secret-in-oauth-2-0
and here:
http://salesforce.stackexchange.com/questions/14009/whats-the-benefit-of-the-client-secret-in-oauth2

"Web apps use client secrets because they represent huge attack vectors. Let us say that someone poisons a DNS entry and sets up a rogue app "lookalike", the juxtapose might not be noticed for months, with this intermediary sucking up tons of data. Client secrets are supposed to mitigate this attack vector. For single user clients, compromise has to come one device at a time, which is horribly inefficient in comparison. While true that they are marginally less secure, they're still required to use TLS (avoids man-in-the-middle) and request-body posting (avoids logs)."