Client Secret, Refresh Token, Access Token are stored in plaintext about oauth2 HOT 3 CLOSED

I'm also wondering the same thing. If I'm not mistaken Spring Boot security also stores these as plain text (CMIIW). Not sure why. Is it by design? But as you said in RFC6819, it says these credentials needs to be hashed or encrypted..

This is the current check

func (m *Manager) GenerateAccessToken(gt oauth2.GrantType, tgr *oauth2.TokenGenerateRequest) (accessToken oauth2.TokenInfo, err error) {
	cli, err := m.GetClient(tgr.ClientID)
	.....
	} else if tgr.ClientSecret != cli.GetSecret() { //here it is
		err = errors.ErrInvalidClient
		return
	}
        .....

And I have an idea for adding a custom secretHandler to the manager:

type ValidateClientSecretHandler func(rawSecret, hashedSecret string) (isValid bool)

So, we can use it by:

func (m *Manager) GenerateAccessToken(gt oauth2.GrantType, tgr *oauth2.TokenGenerateRequest) (accessToken oauth2.TokenInfo, err error) {
	cli, err := m.GetClient(tgr.ClientID)
	.....
	} else if m.ValidateClientSecretHandler(tgr.ClientSecret, cli.GetSecret()) {
		err = errors.ErrInvalidClient
		return
	}
        .....

from oauth2.

You can already do this:
Server already has a method called SetClientInfoHandler
ClientInfoHandler is this:
ClientInfoHandler func(r *http.Request) (clientID, clientSecret string, err error)

You can implement your own ClientInfoHandler that would return the encrypted secret from the request.

The default handler is this:

func ClientBasicHandler(r *http.Request) (string, string, error) {
	username, password, ok := r.BasicAuth()
	if !ok {
		return "", "", errors.ErrInvalidClient
	}
	return username, password, nil
}

so you can implement your own

func MyClientBasicHandler(r *http.Request) (string, string, error) {
	username, password, ok := r.BasicAuth()
	if !ok {
		return "", "", errors.ErrInvalidClient
	}
	return username, MyEncrypter(password), nil
}

// ....
server.SetClientInfoHandler(MyClientBasicHandler)

Good luck

from oauth2.

That doesn't cover everything, unfortunately. For example, bcrypt, which is a good and common choice for hashing passwords, is generally implemented so it doesn't produce a deterministic output; it generates a random salt as part of the algorithm. So you can't reproduce the same hash given the same password (short of trying many times, of course), but have to instead check a password by passing it and the original hash directly to a comparison function.

from oauth2.