Totally insecure??

I see this example in the docs:

const ui = SwaggerUIBundle({...})

// Method can be called in any place after calling constructor SwaggerUIBundle
ui.initOAuth({
    clientId: "your-client-id",
    clientSecret: "your-client-secret-if-required",
    realm: "your-realm",
    appName: "your-app-name",
    scopeSeparator: " ",
    additionalQueryStringParams: {test: "hello"}
})

clientSecret: “your-client-secret-if-required”,

Client secret? In the JS? That is sent to the user’s browser?

Can someone please explain to me how this could ever be secure? As far as I understand it, the client secret is meant for server-to-server communication, where the client secret is safe from prying eyes on the server. But if you are doing auth from the browser (as Swagger is doing) you should, AFAIK, never have a client secret in there.

I think we should remove this line from the docs. The client secret should never be used in combination with web-based apps. It’s for server-to-server communication.

[Download]

@webron I think showing people how to shoot themselves in the foot isn’t wise. The client_secret should simply never be in an HTML page. Period. So why do we show it in an example?

[webron]

@Download Sorry for taking so long, but thanks for the advice. I’ve added a warning to it in the documentation, keep the feedback coming.