6

The company I work for has created an API that is used by mobile devices. I've been reading up on using oAuth for mobile applications and from what I understand it is recommended that you use implicit grant rather than the embedding the secret key in your application.

Why is the implicit flow considered more secure in this case? Isn't this just allowing anyone to access your API regardless of whether they have the secret key or not?

Abe Miessler
  • 8,195
  • 11
  • 49
  • 73
  • 2
    Possible duplicate of https://stackoverflow.com/questions/7522831/what-is-the-purpose-of-the-implicit-grant-authorization-type-in-oauth-2 – Mike Ounsworth Jun 12 '15 at 15:55
  • @MikeOunsworth - it seems like the accepted answer is saying it is just a simpler work flow but possibly less secure. Are you reading it that way? – Abe Miessler Jun 12 '15 at 16:12
  • 2
    [disclaimer: I'm not an oAuth expert, I'm just good at google] - I'm reading it that if your script is running in a browser context which has access to the secret key, then the script can get the secret other ways, so why bother blocking it? – Mike Ounsworth Jun 12 '15 at 16:30

2 Answers2

2

Isn't this just allowing anyone to access your API regardless of whether they have the secret key or not?

Yes, The implicit grant lacks the ability to authenticate the client, which the other grants can do — further introducing attack vectors that the authorization grants, which require a client secret, do not experience.

The use case for implicit grant is authentication of end users and access by client to a resource (possibly owned by the end user) and should be used by SPA Apps (and any other Javascript/User-agent-based app).

If client authentication is important then a different grant must be implemented.

Implicit grant is more secure in the sense that it wouldn't expose the client secret, which can be shared across your internal applications.

Here's a good read on when to use which (OAuth2) grants and OIDC flows https://community.apigee.com/articles/41719/when-to-use-which-oauth2-grants-and-oidc-flows.html

alegria
  • 121
  • 3
1

The primary reason you should not use a secret key is that you cannot trust the device to protect the secret key. You probably understand that the secret key is not safe in a javascript client application because the javascript is usually somewhat easily readable. Likewise, a hacker or thief that gets their hands on a tablet device or smart phone may be able to obtain the binary for your application and extract the secret key from the source code. Secret keys are ideally only used for server to server communication, or for apps internal to your organization.

Rob Kraft
  • 11
  • 1
  • Your last sentence "Secret keys are ideally only used for" should also mention devices where extracting the secret is not practical (typically chip-based devices like TPM chips and smartcards). – WhiteWinterWolf Jul 23 '17 at 09:14
  • Ok but I think the key point in the question is: why implicit grant is considered as secure ? what part of the auth flow provides security ? « Isn't this just allowing anyone to access your API regardless of whether they have the secret key or not? » – Rémi B. Aug 06 '18 at 09:23