Including Client Secret is security risk

[hatboysam]

I am slightly concerned about the hard-coded client secret included in this repo. I think it would be much better to force users to create their own (although I understand that it is hard-coded for ease of use).

The problem is that this makes it very easy for another application to impersonate this app and gain offline access to a user's account. In the case of Drive files, this can be very sensitive information,

[rakyll]

We should always set the approval_prompt to "force" on

drive/remote.go

Line 63 in 3144e06

fmt.Println("Visit this URL to get an authorization code")

.

Read more about the approval_prompt on https://developers.google.com/accounts/docs/OAuth2WebServer.

Embedding client secret is less of a concern, if the user doesn't give you blanket permissions to skip the consent dialog. So, the client should never ask for a blanket permission.

[hatboysam]

Ah ok I wasn't familiar with the force prompt.

[rakyll]

Reopening.

By default, approval_prompt is set to auto. We should make sure that the prompt is enforced.