We’re trying to write automated smoke tests against our platform, and as part of that effort we want to automate logging into auth0.
We’re using a standard ‘username-password’ connection in auth0 and using Authorization Code flow to log in.
We’ve been able to get it to work, but only if I pass the clientsecret as part exchanging the authorization code for an access token. I don’t understand why, because our mobile application is able to do this without the client secret.
that’s because for Native app is using Authorization Code Flow with PKCE flow whereas regular webapp is using Authorization Code flow. This differentiation is because regular webapps are server-side apps so they don’t expose the source code whereas Native apps are not developers control so they need additional security with PKCE flow.
What is the actual problem with sending client secret with the request?
Thank you for your reply. You are correct, i’m trying to execute Authorization Code flow with PKCE. Maybe it helps if I explain our use case a bit better.
I want to write an automated testsuite that can be executed automatically (by a build server for example) or manually from a developer’s machine against a running environment. Especially for developers, I don’t want client secrets lying around that have access to our testing / production accounts.
I have configured my application in auth0 to be native (or spa) but that doesn’t make any difference.
In a different bit of code, I used a system browser component to get an access token. This seems to work fine without a client secret.
So, in my test I’m trying to simulate exactly what the browser / mobile app is doing. If a user with a browser is able to get an access token, why isn’t my test able to do the same thing? As far as I can tell (using fiddler to sniff traffic), I’m executing the same requests that the browser is doing.