#oauth

Posts tagged #oauth

1. Article

   OAuth in mobile apps: use PKCE, and stop shipping client secrets in the APK

   Every few months I review a mobile app that ships an OAuth client secret inside the binary. Extracting a string from an APK or IPA takes about ten minutes, so that secret is public the day the app is published. Here is the setup that actually works for native apps. Mobile apps are public clients A public client is one that cannot keep a secret: native apps, single page apps, desktop apps. The OAuth specs say so…

   Fatima Al-SayedSep 11, 20263likes3comments

2. Article

   Where should a browser app keep its tokens? Not localStorage (mostly)

   This question comes up in every code review I do for a new web app, so I am writing the long answer once. The short version For a first-party web app (your frontend talks to your own API): keep the session in an HttpOnly, Secure, SameSite cookie , and do not put long-lived tokens anywhere JavaScript can read them. If you must use OAuth access tokens in the browser, keep the access token in memory and short-lived,…

   Fatima Al-SayedAug 22, 20268likes8comments