7sb5x (7sb5x) asked a question.
We have developers that occasionally attempt to include the client secret in their native apps because they claim they can't get OAuth/OIDC working without it. There's a warning in the Okta UI that cautions against this. After days of searching around, everything I've read says that that is not secure and poses a threat, but nothing I've read actually gives an example of how this can be exploited.
Maybe I'm just not grasping the explanations, but what real-world scenario is there where, if someone has the client ID and client secret but not the user's credentials, they are able to do nasty deeds? Does the threat assume that they've compromised an account, created a fake app, and then impersonate the user on the fake app? Or is there a situation where you can make a call with just the client ID and client secret and collect information? So far when I've tried to do that, Okta just replies saying the access token is missing, a token you'd obtain by using user credentials.
Sorry if I'm being dense, but I want to be able to advise our devs with a concrete answer instead of just "It's a bad idea. Don't do it."
Hello Erik,
Here is the reply from our Security Team listed below.
The intention of the client secret is for the web application to communicate securely (think master password) with the authorization server. If the client secret is leaked then an attacker could communicate with the authorization directly as the application server and the authorization server would trust it. What an attacker can do depends on the scope of the token and what actions the token is granted to do. Think of it as leaking your private keys.
Impact is outlined here: https://tools.ietf.org/html/rfc6819#section-4.1.1