Using Hashicorp Vault for storage of client id and secret in OAuth2 Password Flow

Question

I am new to Hashicorp Vault. I was hoping to secure my client id and secret for an OAuth2 Password Flow using Hashicorp Vault. Each time my backend REST API is called, it requires the client id and secret, as well as the user credentials of username and password. How would I do this in a secure way and only let my app pass this without disclosing this in my javascript client?

Thanks.

John

Answer 1

If I read your question correctly, you have a Javascript application that calls your own (REST) backend service. That call is secured using a client id, client secret, username ánd password. That raises a couple of issues:

client id and secret, as well as the user credentials of username and password

That seems like the wrong approach to take: an OAuth-secured resource (your REST backend service) should not require a username and password. Logging in the user is done in the authorization server.

Try starting with reading the OAuth2-spec (RFC 6749) or the DigitalOcean tutorial for a comprehensive overview.

How would I do this in a secure way and only let my app pass this without disclosing this in my javascript client?

You can't: client secrets cannot be protected in a client-controlled application because an evil client can reverse-engineer your application (or read your javascript). What you have is called a "public client", i.e. a client that cannot keep its secret confidential. In this case, you don't use client secrets. Try starting with this question or the introduction to oauth2 client types.