1

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the client_id and make same request easily. Public clients like mobile app or web app can't guarantee of that is confidential client.

I really want to know how public clients solve this. Such as Facebook mobile app and Google Inbox. They implemented authentication way for themsevles? Drop out OAuth 2.0?

Improve this question

1 Answer 1

Reset to default
1

In short:
client_id and client_secret are used for to authenticate the APP.
username and password are used for to authenticate the user.

It also means double layer protection.

The specification says:

the client MUST authenticate with the authorization server as described in Section 3.2.1.

A client authentication is done by using a client_id and a client_secret value.

Actually the latest paragraph of the section 3.2.1 says

A public client that was not issued a client password MAY use the client_id request parameter to identify itself when sending requests to the token endpoint (e.g. for the purpose of providing end-user context, client usage statistics).

However, it just may. But Google gives a client_id and a client_secret on the developer console when trying to use an API.

If you want to use Resource Owner Password Credentials for an API or a Web authorization you might provide a register page to your clients to register themselves. (I recommend using of Client Credentials flow for API)

If you want to use Resource Owner Password Credentials for a mobile app you might give a standart client_id like AwesomeAPP and a client_secret like Bl**123_Blabla.

Or you may use AwesomeAPP_v1.0 as client_id to track that how many people use which version of the App although it's not the best way. But you may.

Hope this helps...

Improve this answer
2
  • I was just confused. clientID and clientPassword shouldn't be in public clients... Anyway Thank you!
    – BaHwan Han
    Commented Jul 22, 2016 at 14:32
  • I had thought just like you and I agree with you about public clients. However, if we talk about a mobile app client_id and client_secret values will be compiled in the app. Also it had taken my time a lot because of client registration works, learning OAuth 2.0 flows and PassportJS etc. Good luck...
    – efkan
    Commented Jul 22, 2016 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .