Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

I'm not pretty sure, but if my app is enabled to Client Side Flow Authentication, then anyone with my client ID (easily found for being embedded or by sniffing the initial request) would be able to ask for new access tokens for users that had already allowed my app.

If I'm right in this assumption, than wouldn't Client Side Flow expose a big security vulnerability? Which point am I missing? How would I make it more secure without needing to create a server to deal with authentication?

share|improve this question
    
good question. i have the similar question: if i want to write an js-application, that should use client-id key, and i want to share it to others like source code. (linux os family), what should i do? –  gaussblurinc Dec 21 '12 at 12:42
    
It's exactly my problem, a JS application. If you're using explicit flow to authenticate it will be no problem, because your server will hold the secret key. But if you use Client Side Flow than your Client ID (that is everything needed to authenticate) will be available. I'm starting to believe there is no way to secure in these terms. –  CaioToOn Dec 21 '12 at 13:06
    
maybe some obfuscation? but i don't think that it will help –  gaussblurinc Dec 21 '12 at 13:36
add comment

You must log in to answer this question.

Browse other questions tagged .