使用Windows Azure服务获取客户端机密

Question

I am building a Windows Store App which provides users to authenticate themselves via authentication providers such as Facebook , Live , Twitter etc.

I am using Windows Azure Mobile Service to facilitate my authentication. For certain authentication provider (such as twitter) I am storing the Client ID and secret in the app and using them to facilitate the authentication.

Can I obtain the Client Secret by passing details to Azure Service so that I don't need to store then in my app.

Thanks in advance.

Answer 1

Don't store any secrets in the application. Apps can be "reverse-engineered" and their code retrieved, after which the secrets would be no more. The best place to store secrets is in the back-end, and in the case of Azure Mobile Services, the application settings is a good way to do so.

If you want to access the twitter id and secret (ie, the "consumer key" and "consumer secret") which you set in the identity tab of the portal, you don't need to create new app settings for that, they're exposed in the config object (see the section titled "The mobile service configuration" in this post for more information).