I'm not pretty sure, but if my app is enabled to Client Side Flow Authentication, then anyone with my client ID (easily found for being embedded or by sniffing the initial request) would be able to ask for new access tokens for users that had already allowed my app.

If I'm right in this assumption, than wouldn't Client Side Flow expose a big security vulnerability? Which point am I missing? How would I make it more secure without needing to create a server to deal with authentication?

  • good question. i have the similar question: if i want to write an js-application, that should use client-id key, and i want to share it to others like source code. (linux os family), what should i do? Dec 21, 2012 at 12:42
  • It's exactly my problem, a JS application. If you're using explicit flow to authenticate it will be no problem, because your server will hold the secret key. But if you use Client Side Flow than your Client ID (that is everything needed to authenticate) will be available. I'm starting to believe there is no way to secure in these terms.
    – Caio Cunha
    Dec 21, 2012 at 13:06
  • maybe some obfuscation? but i don't think that it will help Dec 21, 2012 at 13:36


You must log in to answer this question.

Browse other questions tagged .