Hacker News Reader

Comment by deng | Hacker News Reader

> Of course that is if the OAuth provider allows it.

That's the catch. Last time I checked, at least Google didn't. So how can you write a (F)OSS email application for accessing GMail via OAuth2, without putting the secrets into the code (which Google also forbids)?

View on HN

In this situation, their guidance says to embed the secret, because in this context it's obviously not a secret. Here's the current page [1]; here's the earliest Archive.org snapshot of its one-earlier predecessor page from 2015 [2] -- the advice has been consistent.

[1] https://developers.google.com/identity/protocols/oauth2/nati... [2] https://web.archive.org/web/20150520223809/https://developer...

No, Google is not consistent in the slightest, because their terms of service directly contradict this statement:

"Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects."

From: https://developers.google.com/terms

The conversation I had with a Google engineer implied the appropriate course of action was to embed the secret.

https://github.com/openid/AppAuth-JS/issues/46

The Google engineer should read Google's terms of service which explicitly states that you may not do that (see my reply above).

Google Mail's OAuth2 instructions discuss this point explicitly.

Have a link?

"The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)"[0]

[0]: https://developers.google.com/identity/protocols/oauth2

Reply on news.ycombinator.com