Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification.

I can't understand why the secret is needed along with the temporal credentials. Secret is sent with the token itself. So if someone other than the app can get the token he can get the secret as well. right? So what is the reason for adding a secret?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Secret is sent only once from OAuth provider to app's server via SSL connection and then stored on app's site never leaving it later, while open part of token travels from a client to app's site with each request (leave alone session caching for now). SSL is designed to resist sniffing, being implemented properly and employing latest strong algorithms, so without compromising SSL algorithms, SSL certification scheme or app's site itself (perhaps, the weakest link...), it's not practically possible to obtain secret and forge fake request from unauthorised clients.

share|improve this answer
    
Thanks "Secret is sent only once from OAuth provider to app's server via SSL connection and then stored on app's site never leaving it later, while open part of token travels from a client to app's site with each request" - I understand now. Thank you again! –  Aruna Herath Nov 25 '13 at 13:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.