# Unsecure settings in blazor while following tutrial **URL:** \ **Category:** Product Feedback\ **Tags:** api, auth0\ **Created:** [June 20, 2023, 9:50am UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583 "2023-06-20T09:50:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![r.alblas](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@r.alblas](https://community.auth0.com/u/r.alblas)\ **Post date:** [June 20, 2023, 9:50am UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/1 "2023-06-20T09:50:01Z")
Hi, To integrate Auth0 with a Blazor Webassembly project, I followed a tutorial, provided by Auth0. It is a clear and good topic but I have some feedback on it. In Blazor it is not possible to keep settings secret in an appsettings.json file. The file is accessible from the browser just by typing appsettings.json behind the domain. When doing this after following the tutorial the ClientId and ClientSecret are not secret anymore. Maybe it is a good idea to adjust the article or add guidance to solve this in a good way. > **[How to Secure Blazor WASM Applications with Auth0](https://auth0.com/blog/securing-blazor-webassembly-apps/)** > > Learn how to secure Blazor WebAssembly applications with Auth0. BTW I am very happy with Auth0 🙂 Kind regards! ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 21, 2023, 3:42pm UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/2 "2023-06-21T15:42:22Z")
Hi @r.alblas, Welcome to the Auth0 Community 😄 Thanks for the feedback! I’ll pass it along to the team that runs our blogs. Also, thank you for the kind words! Glad you are enjoying the product. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 21, 2023, 3:43pm UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/3 "2023-06-21T15:43:17Z")
cc: @andrea.chiarelli ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [June 22, 2023, 9:06am UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/4 "2023-06-22T09:06:00Z")
Hello @r.alblas, Thanks for appreciating my tutorial and for your feedback about security. I have a few observations about your concerns. The tutorial **doesn’t use any client secret**. A Blazor WASM app is a SPA and technically it’s called a _public client_. **You should never use a client secret in a public client**. The app uses the [Authorization Code Flow with PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-proof-key-for-code-exchange-pkce) to get the tokens it needs. For this flow, it only uses the Auth0 domain and the client ID, which are the data stored in the `appsettings.json` file. The Auth0 domain and the client ID **are not considered secrets**. They are public data. Even if you protect the `appsettings.json` file, anyone can analyze the HTTP traffic and obtain them when the app calls the [`/authorize` endpoint](https://auth0.com/docs/authenticate/protocols/oauth#authorization-endpoint). Of course, there are best practices for storing secrets in a production environment. If you are concerned about the Auth0 domain and client ID settings anyway, you may want to use these best practices as well. Here are a couple of articles about [secret management in .NET](https://auth0.com/blog/secret-management-in-dotnet-applications/) and [Azure](https://auth0.com/blog/secrets-access-managed-identities-dotnet/). But keep in mind that you are not actually protecting them. I hope this clarifies. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [June 22, 2023, 12:45pm UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/5 "2023-06-22T12:45:59Z")
Thanks for the response @andrea.chiarelli! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 6, 2023, 12:46pm UTC](https://community.auth0.com/t/unsecure-settings-in-blazor-while-following-tutrial/109583/6 "2023-07-06T12:46:06Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.