Pabreetzio/BotWars — pull request #12 by Pharylon (2014-11-02 14:07:03+00:00)
Title: Oauth changes

This change moves the Oauth stuff into the Web.Config file and invalidates the need for that Secrets.cs file I created. In this case, we'll just use Azure's secure App Settings to store the id and secret.

I've put the "dev" version of the id/secret into the web.config so we can test with it. This isn't really dangerous since the way Github handles it's Oauth, it will only send callback verification to the address specified when the app was set up. For dev, that's set to localhost, so to exploit this, an attacker would need to have a webserver running on the target's machine (at which point, really, an attacker can do a lot worse). Plus, we're not asking for any permissions that you can really do anything malicious with anyway.

For production, Patrick will enter the production key/secret into the Azure web portal. That's great for us, because it ensures the key isn't even in a file on his local computer, so it can never accidentally leak into source control.