Store client secret securely

后端 未结 5 541
说谎
说谎 2020-12-16 05:43

I know that a public client shouldn\'t use a client secret because, no matter how much you obfuscate it, it won\'t be protected from reverse engineering.

But, the

5条回答
  •  再見小時候
    2020-12-16 06:01

    This article suggests these options, from less to more secure:

    1. Store in cleartext

    2. Store encrypted using a symmetric key

    3. Using the Android Keystore

    4. Store encrypted using asymmetric keys

    Probably, using a combination of #4 and some way to univocally identify the device would be secure enough

提交回复
热议问题