Store client secret hashed in persistent store

go-oauth2 / oauth2

OAuth 2.0 server library for the Go programming language.

https://pkg.go.dev/github.com/go-oauth2/oauth2/v4

MIT License

3.3k stars 563 forks source link

Store client secret hashed in persistent store #162

Open legal-spot opened 3 years ago

legal-spot commented 3 years ago

Hello, I have correctly implemented RedisStore for OAuth2 server implementation based on this library. However, checking Redis, I noticed the client_id and secrets are being stored in plain text. How can I force the library to store secrets securely (by hashing them with an algorithm such as SHA-1, SHA-256, Bcrypt, etc?

om26er commented 1 year ago

is there an interface that I could implement to check the secret that the client sends ? Right now it has to be saved as plain text and that's not ideal