1

I am learning laravel 5.4 api authorization chapter. I have a question about password grant tokens. The doc said this is for my other first-party clients. And now I build an api service, it uses OAuth2. Now I want to build my front end website, and I want to use password grant tokens. So in my understanding, like login, I will send an ajax request including username,password,grant_type,client_id,client_secret,scope to /oauth/tokens to get access token. Should I just put client secret in my js code directly? Because if not, I don't know where to store my client secret, someone can help me? Thanks.

Anar Bayramov
  • 11,158
  • 5
  • 44
  • 64
DengDeng
  • 513
  • 2
  • 9
  • 22
  • I think this question should help you: http://stackoverflow.com/questions/24724238/how-do-client-side-js-libraries-for-oauth2-maintain-secure-authentication – cre8 May 08 '17 at 09:26

1 Answers1

0

Laravel Passport requires understanding about OAuth so I think it better to understand it first before using passport.

So in my understanding, like login, I will send an ajax request including username,password,grant_type,client_id,client_secret,scope to /oauth/tokens to get access token

Please take a look at this. enter image description here

Should I just put client secret in my js code directly

Yes. To explain briefly, once you installed laravel passport. It will generate tables in your database, you will use oauth_clients table to store the data for clients.

For simple authentication like getting information, you only need oauth_clients.id, oauth_clients.secret and oauth_clients.redirect data. You can create new data by using php artisan passport:client

I recommend to try it and you will encounter problems soon that can easily be fixed. Goodluck

https://laravel.com/docs/5.4/passport

Vandolph Reyes
  • 622
  • 6
  • 18
  • 2
    Please explain the reasoning for including client secret in front-end javascript code, as every other article / book I have read strongly advises against this for security reasons. – whitwhoa Sep 13 '17 at 16:03
  • 1
    In general, you should NOT include the client secret, not even the client id, in any code (or binaries that can be decompiled) that is delivered to your users/customers/etc. – Johannes Trümpelmann Sep 15 '17 at 09:10