0

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification.

I can't understand why the secret is needed along with the temporal credentials. Secret is sent with the token itself. So if someone other than the app can get the token he can get the secret as well. right? So what is the reason for adding a secret?

1 Answer 1

1

Secret is sent only once from OAuth provider to app's server via SSL connection and then stored on app's site never leaving it later, while open part of token travels from a client to app's site with each request (leave alone session caching for now). SSL is designed to resist sniffing, being implemented properly and employing latest strong algorithms, so without compromising SSL algorithms, SSL certification scheme or app's site itself (perhaps, the weakest link...), it's not practically possible to obtain secret and forge fake request from unauthorised clients.

1
  • Thanks "Secret is sent only once from OAuth provider to app's server via SSL connection and then stored on app's site never leaving it later, while open part of token travels from a client to app's site with each request" - I understand now. Thank you again!
    – ABH
    Nov 25, 2013 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .