How to keep client secret for OAuth2 login to Parse server secure?

Question

I want to enable users in my macos app to be able to securely login to my Parse Server using third-party Oauth2 login. I have been searching for the best approach to do this, but still have some problems. If I understand correctly, logging in requires:

1. Enable oauth in my Parse server config file (for twitter, google etc).
2. Get the access token to the provider (e.g. twitter) using a client side OAuth login. I am currently using OAuthSwift.

3. Login to Parse using the provided access token (from 2) as suggested in the swift example provided here, i.e.

   [[PFUser logInWithAuthTypeInBackground:provider authData:authData] continueWithBlock:^id(BFTask<id> *task) {
    return task;
   }];
   

This login approach requires the use of the client key and client secret for each provider. How can I safely store these keys-secrets on my Parse server and access them programmatically? Should I use PFConfig and access them during runtime? Is that safe? Or is there something I am doing very wrong here? If anyone has a better approach or an example as to how I should enable OAuth login I would appreciate it (since I am on macos I can not use TwitterUtils and FacebookUtils).

Answer 1

No secret key should ever be used on your client. The client key can be considered "public", and is actually optional (though recommended).

Your secret key should only be stored on your server, preferably as a config/env variable (Note: NOT PFCONFIG). Any use of it should be on your server, and you can create a cloud code function that will use the key as needed and return necessary values to your client. The client should call this, receive a key you need, and then use it appropriately.

Although I'm also not familiar with a client secret key in general? This is the first I've seen of it. I wonder if you've misunderstood any documentation?