Home/ Questions/Q 6158167
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T20:54:42+00:00

I’m looking at the oauth implementation twitter proposes here: https://dev.twitter.com/docs/auth/oauth and oauth libraries like

  • 0

I’m looking at the oauth implementation twitter proposes here:

https://dev.twitter.com/docs/auth/oauth

and oauth libraries like signpost:

http://code.google.com/p/oauth-signpost/

they both talk about using the client secret during the oauth flow, which means for my client application, I’d need to store the secret in the application itself. This is probably risky as someone could grab the secret out of my app. Are there any methods around storing the secret within my app? Am I misunderstanding the oauth flow?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There are no ways of storing client credentials in a native or JavaScript application without making them practically public. Also, putting those credentials on a proxy server and having the client talk to the server (so that the credentials are not exposed) doesn’t really solve anything either. Now you have a problem of authenticating the client to the proxy.

    The right solution is to have special support for native applications provided by the OAuth service. OAuth 2.0 uses pre-registered redirection URIs and other techniques to accomplish a reasonable client identity verification for such clients.

    • 0