使用Python在桌面应用程序中安全分发OAuth 2.0 client_secret

本文介绍了使用Python在桌面应用程序中安全分发OAuth 2.0 client_secret的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我一直在寻找有关如何设计和创建自己的桌面应用程序(或已安装的应用)在Python中要求向Google提供OAuth 2.0授权流，并找到了Google提供的以下存储库: https://github.com/googlesamples/oauth-apps-for-windows (用C#编码，但无论如何设计都应该相同).

I was looking for some best practices sample code about how to design and create my own desktop app (or installed app) in Python requiring OAuth 2.0 Authorization flow to Google, and found this repository provided by Google : https://github.com/googlesamples/oauth-apps-for-windows (coded in C#, but anyway the design should be the same).

深入研究代码时，我很惊讶地看到client_secret明确地直接嵌入到了源代码中(请在此处查看:"> https://github.com/googlesamples/oauth-apps-for-windows/blob/e79f1575b5457617 /OAuthConsoleApp/OAuthConsoleApp/Program.cs#L47 ).

When diving into the code, I was surprised to see that the client_secret was directly embedded, in clear, into the source code (take a look here : https://github.com/googlesamples/oauth-apps-for-windows/blob/e79f1575b5858c5f617d29f2435a93996e4248c5/OAuthConsoleApp/OAuthConsoleApp/Program.cs#L47).

我在有关已安装的应用程序"的Google Developers文档中找到了这个:

此外，我不知道为什么Android或iOS应用程序在控制台生成的OAuth客户端ID中不包含此client_secret，而其他本机应用程序(台式机)应该包含.

Also, I don't know why Android or iOS applications does not include this client_secret in the OAuth Client ID generated from the console, and other native applications (desktop) should.

在许多网站上，我还发现应将客户机密保存为机密……，正如其名称所暗示的那样.

And I have also found in many websites that the client secret should be kept ... secret, as its name implies.

我已经阅读了本机应用程序的不同RFC(我认为是最可靠的来源)，并发现这很有用:

I have read the different RFCs for native apps (most reliable source I believe) and found this useful :

https://tools.ietf. org/html/draft-ietf-oauth-native-apps-12#appendix-A :

不假定本机应用程序客户端可以保守秘密.如果机密分发到同一本机应用程序的多个安装中，则不应将其视为机密.请参阅第8.5节.

但是我想确保我理解正确.

But I'd like to be sure I understand correctly.

因此，从Google API控制台生成其他"应用程序类型的OAuth客户端ID后，可以直接将客户端密码嵌入我的应用程序中吗?这样做真的没有安全问题吗?这样的帖子:如果攻击者可以做什么他获得了应用程序的client_secret吗?谈到安全问题，所以我有点迷失了.

So, after generating the OAuth Client Id for "other" application type from the Google API Console, is it ok to embed the client secret directly in my app? Is there really no security issues by doing this? This SO post : What the attacker could do if he obtains application's client_secret? talks about security issues, so I'm a little bit lost.

使用 google-auth-oauthlib 可以避免从头开始实施OAuth协议，我安全地分发以下代码(****值不会明显混淆):

Using google-auth-oauthlib to avoid implementing OAuth protocol from scratch, can I distribute safely the following code (**** values will not be obfuscated obviously) :

from google_auth_oauthlib import flow

# generated from Google API Console ("other" application)
client_config = {
  "installed": {
    "client_id": "****.apps.googleusercontent.com",
    "client_secret": "****", # is it safe?
    "project_id": "****",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "redirect_uris": [
      "urn:ietf:wg:oauth:2.0:oob"
    ]
  }
}

scopes = ['https://www.googleapis.com/auth/books'] # example
appflow = flow.InstalledAppFlow.from_client_config(client_config, scopes=scopes)
appflow.run_console()
credentials = appflow.credentials

# some code requesting Google APIs for the required scopes

如果恶意用户找到了client_secret，他该怎么办?

If a malicious user found the client_secret, what can he do with this?

verifier

使用Python在桌面应用程序中安全分发OAuth 2.0 client_secret

问题描述

推荐答案