I an using Django OAuth Toolkit and Django Rest for OAuth authentication for mobile app. For accessing any protected resource client id and secret of the app is required . Where should I store client secret. Storing in APK is unsafe as it can be decompiled. Even obfuscation can be reverse engineered . Then whats the best and safe way to serve client secret to the app.
Related Questions in DJANGO
- Django Admin Panel and Sub URLs Returning 404 Error on Deployment
- How to return HTTP Get request response from models class in Django project
- Issue with Quantity Increment in Django E-commerce Cart
- Can't install Pipenv on Windows
- use dict from python in django html template and also in js
- 'pyodbc.Cursor' object has no attribute 'callproc', mssql with django
- Django socketio process
- Root path analogue in uWSGI as in Uvicorn
- Django - ModuleNotFoundError: No module named 'backend'
- Does Python being a loosely typed programming language make it less secure?
- sorl-thumbnail adds a background color when padding is used
- Can't connect to local postgresql server from my docker container
- Why ProductHunt api dont work with Python?
- why i have to put extra space in before write option selected because it show error if i don't ' option:selected'
- Django Arrayfield migration to cloud sql (Postgresql) not creating the column
Related Questions in OAUTH
- Lambda endpoint for the Google OAuth callback does not recieve the access_token
- Miro oauth api throws error 401 Invalid authorization code
- Error from Identity Provider - OIDC Scope Error
- get refresh token in axios interceptor
- How would single sign-on work for my multi-tenant application?
- How to get OAuth2 Access token from Postman
- How to use Oauth in order to log‑in on .googleapis.com on almost any arbitrary endpoints domains from the web browser?
- How to fix common 500 internal server error when use POST method on NEXTJS
- How to use a different account for OAuth with dbt-core and profiles.yml?
- ASP.NET Core Google external login issue
- Implementing IDP Initiated Flow Using OIDC
- Migration of UseOAuthAuthorizationServer from .Net Framework to .Net8
- Django Allauth Bad Request Error, Error Retrieving Access Token: Invalid Grant
- angular oauth 2 oidc doesn't work with github idp
- Handling oauth in flutter app without browser
Related Questions in DJANGO-AUTHENTICATION
- How can I authenticate a user based on correct/incorrect credentials, but ignore their "is_active" state if I want to handle it separately?
- ByPass Django Basic Auth
- How do I add another gmail account to an existing user
- Django Auth fails, even if user/pass exist in DB
- Auth email in Django
- How to implement a Signup opeartion based on Django buit in authentification system?
- Save the current user when saving a model in Django admin backend
- Django DRF problem with authentication using oauth2
- Google OAuth: How to convert authorization code to access token
- Substitute auth_user model not authenticating properly (Django)
- I am trying to integrate the MLflow UI with an existing Django application that utilizes JWT authentication for user management
- Django can login but can't logout - 405 Method Not Allowed
- ImportError: attempted relative import beyond top-level package in Django while importing from different django apps
- Nginx django failed to redirect auth callback requests to secure https using django-auth-adfs
- Issue in email login with customUser in Django rest framework
Related Questions in DJANGO-REST-AUTH
- Django 403 "detail": "Authentication credentials were not provided." Knox Tokens
- "detail": "Authentication credentials were not provided." when trying to access list view as admin. Django REST framework
- Reject social login if user's email is not public
- Django - Exclude URL from Django REST API Documentation? Using drf-yasg
- Django Rest Auth and Google Auth - Google does not store username and email
- Deserialization/Serialization in Django rest framework and the SOLID principles
- django admin site logging in error: CSRF verification failed. Request aborted
- Django rest auth - Custom validation error is not being caught
- DJANGO REST API - How do I restrict user access to API?
- 404 Error When Verifying Email in Dj-Rest-Auth
- Authenticating with drango rest framework
- Custom authentication backend works but doens't work with Django Rest's Token Authentication
- Reverse for 'password_reset_confirm' not found. 'password_reset_confirm' is not a valid view function or pattern name. Django-rest-auth
- Django rest framework, can not logout
- Django Rest Framework Password Rest Confirm Email not showing Form and returning as none
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
It isn't extremely important to keep the client id hidden, but you are right not to save the client secret somewhere in your app. Exposing it would definitely compromise your security.
In your case, you could set up an OAuth app that uses the Password Grant type (my personal preference), or have your user authenticate with your server which will grant them an expirey access token to use with future requests. These are two different "OAuth flows" that are common for mobile apps.
There's also this awkwardly titled slideshow which I thought had some useful illustrations to describe the use of OAuth with mobile apps.