Github OAuth2 does not support Client Authentication?

Question

Well, in OAuth2 specification is foreseen cases where you are authenticating in an application that runs fully on the client side (browsers, mobiles, etc.) and so they are incapable of protecting their code/data.

In the memo regarding Security Considerations they say you should not store credentials in our code (for obvious reasons, I think):

https://www.rfc-editor.org/rfc/rfc6819#section-5.3.1

Also, in the memo about native clients, they highly recommend that an authorization server do not require an application secret:

https://www.rfc-editor.org/rfc/rfc8252#section-8.5

So, it should be possible to obtain an access token without using the client secret using a "client" grant type, like this:

https://www.oauth.com/oauth2-servers/mobile-and-native-apps/authorization/

---

Anyway, in the Github documentation, it's stated that the client_secret is mandatory to retrieve the access token:

https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/#2-users-are-redirected-back-to-your-site-by-github

By the official specification, you should be able to achieve this, but I couldn't find a way to achieve that using the Github OAuth, and here is my question:

Is there a way to use Github OAuth getting an access token without using the client_secret?

Answer 1

So, is there a way to use Github OAuth, get an access token without using the client_secret?

Not that I can see, when considering the authorization grant step

The application exchanges that code for the access token.

When the application makes the request for the access token, that request is authenticated with the client secret, which reduces the risk of an attacker intercepting the authorization code and using it themselves.

That means, if an application needs to automate that step on behalf of client, it needs to fetch that secret from a third-party referential, like a vault.

See for instance puppetlabs/vault-plugin-secrets-oauthapp, which is a plugin providing a secure wrapper around OAuth 2 authorization code grant flows, allowing a Vault client to request authorization on behalf of a user and perform actions using a negotiated OAuth 2 access token.
(here, Valut is hashicorp/vault)