Damus
Alex Gleason profile picture
Alex Gleason
@Alex Gleason
Setting up a server just to proxy an OAuth client_secret is security masturbation. You let everyone use that endpoint anyway. So it's better to just hardcode it.
1❤️2
Technical Debt · 27w
Trying to play the devil’s advocate here, maybe it can make some sense if you’re rolling out multiple deployment environments and want to be able to reuse the build and can’t lookup env vars for whatever reason. And/or if you don’t 100% control the oauth server and it has some arbitrary BS w...