Security issue

[robcalcroft]

How is this secure? You're client_id and client_secret are exposed in bundle.js

[baptadn]

It uses password grant type, we can't get token without valid credential. But if you want hide the client id and secret you can add them on the fly within your Nginx conf:

location ~ ^/oauth/v2/token$ {
      try_files $uri /$app$is_args$args&client_id=CLIENTID&client_secret=CLIENTSECRET;
}

[mxmzb]

Isn't this a client bundle? You can't hide client secret in environment if the environment is the users browser. Am I mistaken?