Improve security of entity client secrets by making them only available at creation time

[andrewpai]

Improve security of entity client secrets by making them only available at creation time

Problem

Client secrets for entities are retrievable after creation. This means it is possible for an attacker that has obtained the right access to access client secrets.

Solution

Store entity client secrets in a hashed or other form, such that the original value cannot be retrieved and must be stored by the client software.

Alternatives/workarounds

None

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.