Why do we need to store client secret as oppose to good security practice?

[avicoder]

Describe the bug

In the security guidelines mentioned https://docs.microsoft.com/en-us/linkedin/shared/authentication/client-credentials-flow?context=linkedin/context it has been clearly stated to not share the client secret but his flutter SDK requires it, doesn't it impacts the security?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[d3xt3r2909]

Hi,

first of all, thank you for pointing this out and sorry for the late reply on this.

Secondly its more topic for the discussions than for the issue.

Thirdly I believe that this is more topic for LinkedIn guys, as I didn't create (unfortunately) this platform, neither documentation for it because as you can see they are a little bit contradicting ..

Anyhow, client_secret is used to generate access token (which is the main purpose of this lib) and of course, this library is open source - which means that you can look at how your client_secret is used.

In any case, if you have a better solution or idea, you can open a feature request with an idea of how to implement it without it, or even better to contribute to the project. I would be even more than happy to approve it.

I'm converting this to discussion.

[avicoder]

How about using widgets instead?

[d3xt3r2909]

Can you elaborate a little bit more please as I didn't understand your proposal. How widgets could help us to avoid sending client_secret to API which is required to have this property?