0

Trying to allow a CLI to "login" via web browser and obtain an access token for the user's account, similar to how gcloud and github's CLI do it. I realize it'll be using the OAuth Authorization Code flow.

But what about the client_secret? I've found out that github cli just doesn't care about exposing it, and it's right there in the source code: https://github.com/cli/cli/blob/6a8deb1f5a9f2aa0ace2eb154523f3b9f23a05ae/internal/authflow/flow.go#L25-L26

Why is this not a problem? or is it?

Improve this question
3
  • Github's stance on their client secret: docs.github.com/en/rest/guides/…
    – schroeder ♦
    Nov 30, 2022 at 12:44
  • assuming i read that correctly, that seems to be for a user's own OAuth app... one whose client is meant to be running on the backend (i.e. private client). Github CLI, though, is a public client that anyone can run on their machine, and they're clearly not following their own advice regarding the client_secret in this case.
    – Sam
    Nov 30, 2022 at 14:58
  • Not all client-secrets expose something that is sensitive. Sometimes it just grants (revocable) access to the true authentication function.
    – schroeder ♦
    Nov 30, 2022 at 16:45

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .