[GH-ISSUE #727] How to handle the consumer secret in a mobile app?

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/OAuthSwift#473

kerem commented

2026-03-03 16:48:55 +03:00

Owner

Originally created by @ir-fuel on GitHub (Dec 20, 2024).
Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/727

Description:

OAuth Provider? (Twitter, Github, ..):

Garmin

OAuth Version:

[ X] Version 1a
Version 2

OS (Please fill the version) :

iOS :
OSX :
TVOS :
WatchOS :

Installation method:

Carthage
CocoaPods
Swift Package Manager
Manually

Library version:

head
v2.1.0
v2.0.0
v1.4.1
other: (Please fill in the version you are using.)

Xcode version:

11.4 (Swift 5.2)
11.x (Swift 5.1)
10.x (Swift 5.0)
other: (Please fill in the version you are using.)

As we know, the consumer secret should not be stored on device for a mobile app, but on the server. Is there any easy way of supporting this in this library? If I have to implement the logic that uses this secret on my own server anyway, why use a 3rd party library for the entire process, especially since I can't see how to split up the process here so some parts are handled by my server? The code here assumes the secret is stored in the same place as the key, which would be inside the mobile app.

Thanks

Originally created by @ir-fuel on GitHub (Dec 20, 2024). Original GitHub issue: https://github.com/OAuthSwift/OAuthSwift/issues/727 ### Description: ### OAuth Provider? (Twitter, Github, ..): Garmin ### OAuth Version: - [ X] Version 1a - [ ] Version 2 ### OS (Please fill the version) : - [x] iOS : - [ ] OSX : - [ ] TVOS : - [ ] WatchOS : ### Installation method: - [ ] Carthage - [ ] CocoaPods - [X] Swift Package Manager - [ ] Manually ### Library version: - [ ] head - [X] v2.1.0 - [ ] v2.0.0 - [ ] v1.4.1 - [ ] other: (Please fill in the version you are using.) ### Xcode version: - [X] 11.4 (Swift 5.2) - [ ] 11.x (Swift 5.1) - [ ] 10.x (Swift 5.0) - [ ] other: (Please fill in the version you are using.) As we know, the consumer secret should not be stored on device for a mobile app, but on the server. Is there any easy way of supporting this in this library? If I have to implement the logic that uses this secret on my own server anyway, why use a 3rd party library for the entire process, especially since I can't see how to split up the process here so some parts are handled by my server? The code here assumes the secret is stored in the same place as the key, which would be inside the mobile app. Thanks

kerem referenced this issue

2026-03-03 16:49:52 +03:00

[PR #473] [MERGED] OAuthSwiftCredential conforms to NSSecureCoding #641

Rows
Columns

[GH-ISSUE #727] How to handle the consumer secret in a mobile app? #473