oidc-client-ts icon indicating copy to clipboard operation
oidc-client-ts copied to clipboard

Published 20 hours ago • verified publisher icon authts

Configure "client_secret" without exposing it

Open johnnypea opened this issue 2 years ago • 1 comments

How can one configure "client_secret" without exposing it to the browser?

As I understand I need a "window" to call signinRedirect and signinCallback methods.

Thank you.

johnnypea avatar Aug 15 '23 09:08 johnnypea

when you run this library within the browser its not possible to hide/not expose the client_secret, thus do not use that, use the code flow with PKCE! When your code is running on the mobile app or desktop app, then its a different story...

pamapa avatar Aug 15 '23 15:08 pamapa