{"action":"created","issue":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/517","labels_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/517/labels{/name}","comments_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/517/comments","events_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/517/events","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/517","id":57809860,"number":517,"title":"Mobile App :. client_secret storage for authorization_code grant type ","user":{"login":"metasection","id":4357688,"avatar_url":"https://avatars.githubusercontent.com/u/4357688?v=3","gravatar_id":"","url":"https://api.github.com/users/metasection","html_url":"https://github.com/metasection","followers_url":"https://api.github.com/users/metasection/followers","following_url":"https://api.github.com/users/metasection/following{/other_user}","gists_url":"https://api.github.com/users/metasection/gists{/gist_id}","starred_url":"https://api.github.com/users/metasection/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metasection/subscriptions","organizations_url":"https://api.github.com/users/metasection/orgs","repos_url":"https://api.github.com/users/metasection/repos","events_url":"https://api.github.com/users/metasection/events{/privacy}","received_events_url":"https://api.github.com/users/metasection/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-16T14:24:28Z","updated_at":"2015-02-16T14:56:16Z","closed_at":null,"body":"**This OAuth2 Server is completely awesome.**  Thanks to bshaffer and the community!  \r\n\r\nNeed some advice...\r\n\r\nI am sure this question has been asked / answered (a million times).  Unfortunately, I can't seem to find a scheme that allows our mobile app to securely handle the client_secret.  \r\n\r\n**Is there a definitive solution for storage .or. issuance of the client_secret?**\r\n\r\n- I have read various articles that say that they client_secret should not be \"shipped\" with the mobile app because it is easily discovered.\r\n- I have read other articles that say you can \"ship\" the client_secret as long as it is obfuscated.\r\n- Further, there are other articles that say you should get the client_secret from the server and have the ability to rotate / reissue, if necessary.\r\n\r\nI understand that the client_secret is not actually granting access to any resource and this \"probably\" isn't a problem.  Unfortunately, our client is concerned.  \r\n\r\nAny guidance would be greatly appreciated.  Thank you."},"comment":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/comments/74519909","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/517#issuecomment-74519909","issue_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/517","id":74519909,"user":{"login":"dashohoxha","id":1495805,"avatar_url":"https://avatars.githubusercontent.com/u/1495805?v=3","gravatar_id":"","url":"https://api.github.com/users/dashohoxha","html_url":"https://github.com/dashohoxha","followers_url":"https://api.github.com/users/dashohoxha/followers","following_url":"https://api.github.com/users/dashohoxha/following{/other_user}","gists_url":"https://api.github.com/users/dashohoxha/gists{/gist_id}","starred_url":"https://api.github.com/users/dashohoxha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dashohoxha/subscriptions","organizations_url":"https://api.github.com/users/dashohoxha/orgs","repos_url":"https://api.github.com/users/dashohoxha/repos","events_url":"https://api.github.com/users/dashohoxha/events{/privacy}","received_events_url":"https://api.github.com/users/dashohoxha/received_events","type":"User","site_admin":false},"created_at":"2015-02-16T14:56:16Z","updated_at":"2015-02-16T14:56:16Z","body":"If your mobile app is built with jQuery Mobile, there is no place to hide the client_secret, it will be public. (I cannot speak for native iPhone/Android apps because I have no experience with them.) I think that this is not terribly bad thing, there are no bad implications etc., but I do think that the protocol should not ask for a 'client_secret' when it is actually useless and pointless.\r\n\r\nIn my mobile app (http://fjalori.fs.al/) I have actually implemented a proxy oauth2 authorization. This a bit of tricky solution, I haven't seen it somewhere else, but I think that it can be useful for others too. The idea is that the mobile application (which cannot have a redirect_uri, necessary for the authorization_code grant type), calls a server-side application to handle the authentication/authorization, and that server-side application hands over the token back to the mobile app after the process is done.\r\n\r\nTrying to explain it by words maybe seems a bit abstract, but if you see the code maybe you get a better idea:\r\n - https://github.com/B-Translator/vocabulary-jquery/blob/master/lib/oauth2_token.js#L239-256\r\n - https://github.com/B-Translator/vocabulary-jquery/blob/master/js/config.js#L11\r\n - https://github.com/dashohoxha/oauth2_login/blob/7.x-1.x/oauth2_login.module#L144-148\r\n"}}