{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/758","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/758/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/758/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/758/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/758","id":240590266,"number":758,"title":"Resource owner password for mobile app","user":{"login":"Herz3h","id":1900696,"avatar_url":"https://avatars3.githubusercontent.com/u/1900696?v=4","gravatar_id":"","url":"https://api.github.com/users/Herz3h","html_url":"https://github.com/Herz3h","followers_url":"https://api.github.com/users/Herz3h/followers","following_url":"https://api.github.com/users/Herz3h/following{/other_user}","gists_url":"https://api.github.com/users/Herz3h/gists{/gist_id}","starred_url":"https://api.github.com/users/Herz3h/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Herz3h/subscriptions","organizations_url":"https://api.github.com/users/Herz3h/orgs","repos_url":"https://api.github.com/users/Herz3h/repos","events_url":"https://api.github.com/users/Herz3h/events{/privacy}","received_events_url":"https://api.github.com/users/Herz3h/received_events","type":"User","site_admin":false},"labels":[{"id":360533744,"url":"https://api.github.com/repos/thephpleague/oauth2-server/labels/Question","name":"Question","color":"0052cc","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-07-05T09:26:13Z","updated_at":"2018-02-19T18:14:09Z","closed_at":"2018-02-19T18:14:09Z","author_association":"NONE","body":"Hello,\r\n\r\nI have a mobile application (created by myself) which requires Login + Password, i've read the documentation and it says that if it's a First party native app i should use Resource owner password grant flow, but this would mean i store the client_secret in my mobile app.\r\n\r\nI don't understand why is this advised ? Isn't the client_secret supposed to not be readable (which it is in a native mobile app) ?\r\n\r\nI ask this also, because i read that mobile app should go with authorization (with pkce) code or implicit flow.\r\n\r\nCould you clarify this please ?\r\n\r\nThanks in advance!"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/366769039","html_url":"https://github.com/thephpleague/oauth2-server/issues/758#issuecomment-366769039","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/758","id":366769039,"user":{"login":"Sephster","id":1457058,"avatar_url":"https://avatars1.githubusercontent.com/u/1457058?v=4","gravatar_id":"","url":"https://api.github.com/users/Sephster","html_url":"https://github.com/Sephster","followers_url":"https://api.github.com/users/Sephster/followers","following_url":"https://api.github.com/users/Sephster/following{/other_user}","gists_url":"https://api.github.com/users/Sephster/gists{/gist_id}","starred_url":"https://api.github.com/users/Sephster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sephster/subscriptions","organizations_url":"https://api.github.com/users/Sephster/orgs","repos_url":"https://api.github.com/users/Sephster/repos","events_url":"https://api.github.com/users/Sephster/events{/privacy}","received_events_url":"https://api.github.com/users/Sephster/received_events","type":"User","site_admin":false},"created_at":"2018-02-19T18:14:09Z","updated_at":"2018-02-19T18:14:09Z","author_association":"MEMBER","body":"Hi @Herz3h - apologies for the delay in responding to you. [This page](https://oauth2.thephpleague.com/authorization-server/which-grant/) might help you to decide which grant you need to use. \r\n\r\nIf I am understanding correctly, you have created both the API and the mobile client. Because you are the creator of the mobile app, it is assumed that there is a higher level of trust in this app so you can use the Password Grant with a degree of confidence that the credentials will not be leaked as both the client and the server are within your control.\r\n\r\nThe resources @raarts has listed should help inform your decision but as per the original OAuth spec, the password grant is designed for such situations.\r\n\r\nI hope this is of some assistance and apologies for the delay in responding"}}
{"actor":{"display_login":"Sephster"}}