Oauth2.0，将client_secret存储在本地存储是否安全

Question

I'm using resource owner password credentials flow or password grant type. I just implemented my own authorization server using Spring Oauth2. So I wonder if it's safe to store client_secret on a local storage (web browser). As far as I understand client_secret has nothing to do with authentication it's just a thing that use to verify a client that can request for an access token (if we want to specify the only client that can request for a token). So if this client_secret is leaked the hacker would need to have valid username/password of a user anyway. There's another flow called implicit which doesn't require a client to store client_secret. Isn't that equivalent to password grant_type with poor client_secret storing since anyone wiht a valid username/password can request for a token anyway.

Answer 1

No, it is not. "Rich" clients cannot keep secrets actually secret. In your case, anyone could open browser dev tools and read the "secret".

The flows you are using are not sure neither. Use authorization-code with PKCE with public clients (those you cannot trust to keep a secret).