client_secret.json file is used in the OAuth 2.0 authorization flow for the Google Drive API (example).
If I include
client_secret.json in my Java application, access the JAR contents is extremely easy. So, should I worry? I have no way to make this file "secret".
What wrong can be done with this information? A final user has to grant access to my application in order to access his Google Drive files.
Update: It seems that two cases can be analyized.
- What can be done only with
This was the intention of my first question. The only thing I can think of is that if a user links his account to my app it can exhaust my Free quota for the Drive API (1,000,000,000 requests/day).
- Someone access stored credentials for a user (
StoredCredentialfile, in the example) plus
I guess this is the worst case, since that "someone" can act as my app in the user account.
Update 2: Google docs can be found here: Using OAuth 2.0 for Installed Applications
The client ID and client secret obtained from the Developers Console are embedded in the source code of your application. In this context, the client secret is obviously not treated as a secret.