# Security risk with authentication method being none

**URL:** <https://community.auth0.com/t/security-risk-with-authentication-method-being-none/132657>\
**Category:** Get Help\
**Tags:** admin-management, dashboard\
**Created:** [April 23, 2024, 8:04pm UTC](https://community.auth0.com/t/security-risk-with-authentication-method-being-none/132657 "2024-04-23T20:04:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![johannesk.hage](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/johannesk.hage/32/48801_2.png) [@johannesk.hage](https://community.auth0.com/u/johannesk.hage)\
**Post date:** [April 23, 2024, 8:04pm UTC](https://community.auth0.com/t/security-risk-with-authentication-method-being-none/132657/1 "2024-04-23T20:04:47Z")

</div>

I’m trying to make the flutter sample application work, and to do this i had to change the authentication method from “Client secret (Post)” to “None”. It works but wont this be a security risk? How can i make it work when authentication method is Client secret (Post)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 24, 2024, 3:50pm UTC](https://community.auth0.com/t/security-risk-with-authentication-method-being-none/132657/3 "2024-04-24T15:50:34Z")

</div>

Hello @johannesk.hage welcome to the community!

> [@johannesk.hage](#):
>
> It works but wont this be a security risk? How can i make it work when authentication method is Client secret (Post)

Which sample app are you working with? When `token_endpoint_auth_method` is set to `none` , it means that the client is not required to authenticate itself at the token endpoint. This is typically used for [public clients](https://auth0.com/docs/get-started/applications/confidential-and-public-applications), which do not have a means to securely store credentials. A public client could be a browser-based application (like a single-page application) that cannot securely maintain a secret.

On the other hand, when `token_endpoint_auth_method` is set to `post` , it indicates that the client must use the client credentials (client ID and client secret) sent in the request body to authenticate itself with the token endpoint. This is a common method for clients that can securely store secrets, such as server-side applications.

Hope this helps to clarify!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 8, 2024, 3:51pm UTC](https://community.auth0.com/t/security-risk-with-authentication-method-being-none/132657/4 "2024-05-08T15:51:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.