如何保护 Oauth 2.0 客户端 ID 和客户端密码
当 Android oauth 2.0 客户端应用程序具有硬编码的客户端 ID 和客户端密钥时.反编译应用程序并检索凭据非常容易.那么提供这些凭证给oauth服务器有什么用.
When an Android oauth 2.0 client application has client ID and client Secret hard-coded in it. it is very easy to decompile the application and retrieve the credentials. Then What is the use of providing these credentials to oauth server.
不建议将 client_id 和 client_secret 硬编码到本机应用程序中，即使用什么在移动应用场景中被称为机密客户端"，正是因为 client_secret 不能保密.
It is not recommended to hard-code client_id and client_secret into a native app i.e. to use what is called a "confidential client" in a mobile app scenario exactly because the client_secret cannot be kept a secret.
原生应用通常是授权服务器的公共客户端"，即没有 client_secret 的应用.安全性来自以下事实:注册了唯一的重定向 URI 以及其他 OAuth 功能，例如 PKCE (https://tools.ietf.org/html/rfc7636) 被应用.
A native app would typically be a "public client" to the Authorization Server i.e. one that does not have a client_secret. Security would come from the fact that a unique redirect URI is registered and additional OAuth features like PKCE (https://tools.ietf.org/html/rfc7636) are applied.
有关为原生应用使用 OAuth 2.0 的一般建议，请参阅:https://tools.ietf.org/html/draft-ietf-oauth-native-apps，特别是安全注意事项:https://tools.ietf.org/html/draft-ietf-oauth-native-apps-10#section-8
For general recommendations on using OAuth 2.0 for native apps see: https://tools.ietf.org/html/draft-ietf-oauth-native-apps, especially the security considerations at: https://tools.ietf.org/html/draft-ietf-oauth-native-apps-10#section-8