1

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com.

Similarly, reddit takes me here, which has client_id=705819728788-b2c1kcs7tst3b7ghv7at0hkqmtc68ckl.apps.googleusercontent.com

These values remain the same across different requests. To my inexperienced eye, these look like the API keys that Quora and reddit obtained from Google for authentication purposes, but I suspect that this is not the case.

What is going on here?

Improve this question

1 Answer 1

Reset to default
1

This is the client_id used by oauth, which in some configurations indeed can be public.

See: https://www.oauth.com/oauth2-servers/client-registration/client-id-secret/

The client_id is a public identifier for apps. Even though it’s public, it’s best that it isn’t guessable by third parties, so many implementations use something like a 32-character hex string

The client_secret should remain secret:

The client_secret is a secret known only to the application and the authorization server. It is essential the application’s own password.

The configurations in which a client_id is reflected back to the user is in the following situations:

  • Single-page app
  • Mobile or native app

The authentication flow is in these cases mostly handled in client side code and by redirects to the authorization server. In other situations the authentication is mostly handled on the server side in which case the client_secret is used.

For single-page, mobile or native apps the documentation advises not to use the client_secret at all.

Improve this answer
3
  • 1
    Thanks for the pointers. So the fact that e.g. Twitter urges its registered apps to keep also their consumer keys secret is merely a design choice by Twitter, which doesn't accomodate SPAs/mobile apps in the same way Google or facebook do?
    – Cornelius Brand
    Jul 26, 2022 at 13:48
  • Twitter supports different versions of oAuth, and with oAuth2 they allow different app types to be selected as well. From the Twitter documentation: If you have selected an App type that is a confidential client you will be provided with a “Client Secret” under “Client ID” in your App’s keys and tokens section. So like other oauth2 applications twitter too allows situations where the client_id can be public.
    – Christiaan
    Jul 26, 2022 at 13:54
  • See this link: developer.twitter.com/en/docs/authentication/oauth-2-0/… Specifically the section "Confidential Clients"
    – Christiaan
    Jul 26, 2022 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .