{"action":"created","issue":{"url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/383","labels_url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/383/labels{/name}","comments_url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/383/comments","events_url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/383/events","html_url":"https://github.com/DarkFenX/Pyfa/issues/383","id":111510076,"number":383,"title":"CREST Fitting Support","user":{"login":"blitzmann","id":3904767,"avatar_url":"https://avatars.githubusercontent.com/u/3904767?v=3","gravatar_id":"","url":"https://api.github.com/users/blitzmann","html_url":"https://github.com/blitzmann","followers_url":"https://api.github.com/users/blitzmann/followers","following_url":"https://api.github.com/users/blitzmann/following{/other_user}","gists_url":"https://api.github.com/users/blitzmann/gists{/gist_id}","starred_url":"https://api.github.com/users/blitzmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blitzmann/subscriptions","organizations_url":"https://api.github.com/users/blitzmann/orgs","repos_url":"https://api.github.com/users/blitzmann/repos","events_url":"https://api.github.com/users/blitzmann/events{/privacy}","received_events_url":"https://api.github.com/users/blitzmann/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/DarkFenX/Pyfa/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-14T22:46:47Z","updated_at":"2015-10-15T03:24:27Z","closed_at":null,"body":"CCP FoxFour just release documentation on this today, see https://github.com/ccpgames/eveonline-third-party-documentation/commit/1ff6d7ac56c4b1c66b0e39155b502dfb7ec0336c\r\n\r\nThis issue will keep track of current progress. "},"comment":{"url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/comments/148271343","html_url":"https://github.com/DarkFenX/Pyfa/issues/383#issuecomment-148271343","issue_url":"https://api.github.com/repos/DarkFenX/Pyfa/issues/383","id":148271343,"user":{"login":"narthollis","id":67732,"avatar_url":"https://avatars.githubusercontent.com/u/67732?v=3","gravatar_id":"","url":"https://api.github.com/users/narthollis","html_url":"https://github.com/narthollis","followers_url":"https://api.github.com/users/narthollis/followers","following_url":"https://api.github.com/users/narthollis/following{/other_user}","gists_url":"https://api.github.com/users/narthollis/gists{/gist_id}","starred_url":"https://api.github.com/users/narthollis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/narthollis/subscriptions","organizations_url":"https://api.github.com/users/narthollis/orgs","repos_url":"https://api.github.com/users/narthollis/repos","events_url":"https://api.github.com/users/narthollis/events{/privacy}","received_events_url":"https://api.github.com/users/narthollis/received_events","type":"User","site_admin":false},"created_at":"2015-10-15T03:24:27Z","updated_at":"2015-10-15T03:24:27Z","body":"Proxy / Web Service:\r\n\r\nSource | Action | Destination\r\n------ | ------ | -----------\r\nPyfa | Get Token | Web Service\r\nWeb Service | Redirect (with client id) | EVE SSO\r\nEVE SSO | Redirect (with auth code) | Web Service\r\nWeb Service | Get Token (with auth code, client id, and client secret) | CREST\r\nWeb Service | Return (with Token) | Pyfa\r\n\r\nThe problem here is that for the web service to be even equal to storing the secret in the install, the application needs to prove in some way that it is allowed to request a token.\r\n\r\nAnd so you are again in the position of having to store a secret in the application, just this time its a web service secret instead.\r\n\r\nThere is no good solution to the client secret problem. You can obfuscate the secret however you want, but even a heavily obfuscated secret in a compiled C/C++ application is going to be fairly easy to retrieve.\r\n\r\nThe opening page of the Google OAuth2 documentation states it quite clearly:\r\n> Installed apps are distributed to individual machines, and it is assumed that these apps cannot keep secrets.\r\n\r\nIt further states toward the end of the overview:\r\n> The client ID and client secret obtained from the Developers Console are embedded in the source code of your application. In this context, the client secret is obviously not treated as a secret.\r\n\r\nThe best thing that can be done is for the Pyfa client to have access to the smallest scope the makes sense for it to have, in this case simply fitting read/write.\r\n\r\nOAuth was never really written with desktop applications in mind, so these are the problems we run into."}}