OAUTH2应用程序中的Google客户端秘密可以访问什么？
我正在实施使用Google客户端ID和Google Client Secret的登录流。我正在考虑Google Client Secret的安全含义，谁应该能够访问它。
当前，客户秘密存储在环境变量中，但是我想知道有什么可以访问此秘密的人可以使用它来确定哪些开发人员应该可以访问此环境变量，并且我是否应该在开发中设置其他OAUTH2应用程序与生产。
I am implementing a login flow which uses the Google Client ID and Google Client Secret. I am considering the security implications of the Google Client Secret and who should be able to have access to it.
Currently the Client secret is stored in an environment variable, but I would like to know what someone with access to this secret could do with it to determine which developers should have access to this environment variable and if I should setup a different OAuth2 application in development vs production.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这取决于您指定的OAUTH应用程序类型。
创建OAuth客户端ID时
但是，还可以选择创建桌面应用程序，这意味着您想在没有自己的服务器的情况下使用OAuth。对于这种情况，Google的文档 say ：：
因此，在这种情况下，将客户秘密包含在您的应用程序中的用户是可以的。
It depends on which type of OAuth application you specified.
When creating an OAuth client ID in Google Cloud (and with that, a client secret), you are asked to specify the type of application you are creating:
If you choose Web App, your client secret should really be secret, as its treated as such by Google and is used to authenticate your own server. You should therefore hide it and especially not include it in open sourced code.
However, there is also the option of creating a Desktop app, which means you want to use OAuth without having your own server. For this case the documentation by Google says:
So in this case it's fine (even required) to include the client secret in your app for your users.
客户端ID和客户端秘密类似于登录和密码。他们使您的应用程序能够请求用户访问其数据的能力。如果您要存储刷新令牌，它也将使用户可以从刷新令牌中创建访问令牌。
Google TOS指出
您不应该与任何人分享。您和您的开发人员只能使用它。
是的，理想情况下，您应该拥有测试和生产客户ID。您的开发人员可以使用测试客户ID，唯一应该使用您的生产验证的项目客户ID是您的生产环境。我将它们存储在某些人中，以便个人分泌商店。
Client id and client secret are similar to a login and password. They give your application the ability to request consent of a user to access their data. If you are storing refresh tokens it would also give the user access to create access tokens from your refresh tokens.
Googles TOS states
You should not be sharing this with anyone. It should only be used by you and your developers.
Yes Ideally you should have a test and production client ids. Test client id can be used by your developers the only one who should be using your production verified project client ids is your production environment. I would store them in some for for secrete store personally.