In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment.
Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated
services or resources.
The trust issue can be more or less severe depending on the people’s role and entitlement.
What is the potential impact?
OAuth token compromise
The OAuth 2.0 authorization code grant flow is a secure method of authorizing a web application to access a third-party service. After the user
authenticates with the third-party service and grants access, the web application is sent a single-use code. The application must then pass this code
and a client_secret value to the service in order to obtain a usable authentication token.
If the client_secret value is disclosed, anyone who can intercept the single-use code can then exchange it for a valid authentication
token.
Secret storage best practice
It is best practice to avoid hard-coding secrets into an application. This is true even in situations where the secret cannot be kept completely
safe, such as where is must be distributed as part of a client application.
Storing the secret outside of the application code makes it easier to manage which secret is being used. For example, it can help to ensure that a
production secret is not accidentally used during development.
