I am developing a native app that needs to access protected resources using OAuth 2. There is a business requirement so that a user has to enter his credentials manually as rarely as possible and the best way to achieve that is to use an authentication flow with a refresh token. Retrieving refresh tokens requires a client secret which by OAuth design should not be stored in a native app.

I know there are flows that don't use client secret e.g. with public clients, but I wasn't able to implement them within the technology stack I use.

My question is: how bad is it to still use client secret in an app if refresh token is well secured and there is a small chance of it being leaked? For attacker knowing the secret doesn't achieve much in this case, does it?

  • In a similar situation, I was advised to use Identity Server. Apparently the "hybrid flow" can solve the issue. – S.L. Barth - Reinstate Monica Apr 4 '17 at 20:23
  • OAuth2 doesn't force you to use a client secret; you can request a offline_access scope, which will also give you a refresh_token, together with the access token. – ndrix Apr 4 '17 at 22:24
  • Why you don't use redirect_uri for authentication of public clients? – Eloy Roldán Paredes Oct 13 '18 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.