search

songkick / oauth2-provider

Simple OAuth 2.0 provider toolkit
MIT License
528 stars 148 forks source link

Encrypted Client Secret #3

Closed HiroProt closed 13 years ago

HiroProt commented 13 years ago

Any particular reason why you encrypt client secrets? Pretty much all the OAuth sites I've see allow the developer to see their secret later on, e.g. to configure a new client implementation

jcoglan commented 13 years ago

Client secrets are effectively passwords, and the OAuth spec states that they should be treated with the same care as user passwords. This means they should be stored using an irreversible hash, should not be transmitted without encryption.

If the developer loses their secret I think the provider should generate a new one for them rather than displaying the existing one.