API client secrets - Githubissues

calebmer / connect

10 stars 2 forks source link

Open calebmer opened 5 years ago

calebmer commented 5 years ago

Currently anyone can use the API when un-authenticated. We should have API client secrets to make sure only approved clients can use our API.

On web, we should store our client secret in the API proxy. That way it can’t be seen in client side code.
I’m not entirely sure where to put it for native code.

calebmer commented 5 years ago

Even with client side secrets, what’s to stop someone from using the web API proxy? Maybe having this level of protection won’t do anything.

calebmer commented 5 years ago

We should research how Firebase apps securely protect their client secrets before preceding with this.