Skip to content
OAuth 2.0 Client Credentials Misuse in Public Apps
blog.sentry.security | blog | #appsec | #mobile-security | #authentication | #oauth | #client-credentials | #pkce
Summary
Why the OAuth 2.0 client credentials grant is unsafe for public clients: secrets embedded in SPAs and mobile apps are easily extractable, enabling app impersonation; use Authorization Code with PKCE.
- Published
- Collected