Web Security · Middle · Question 55 of 75

Why shouldn't a browser app hold an OAuth client secret?

1Because secrets expire every minute
2Because client secrets are too long for JavaScript strings
✓Correct answer: Anything in the browser is public, so a SPA is a public client and must rely on PKCE instead

Explanation

Confidential clients run on a server. If a SPA needs that level, a backend-for-frontend can hold the secret and the tokens.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.