hackforla / hackforla/peopledepot
Technical Debt (security): Implement client_secret in login
Open
complexity: missing
dependency
draft
feature: infrastructure
PII: FALSE
role: back end
s: kb
s: PD team
size: 5pt
- Dominant language
- Python
- Stars
- 14
- Forks
- 37
- Avg merge
- 9d 15h
- Merged PRs (30d)
- 5
Description
### Dependency
- [x] #241
- [ ] #324
### Overview
For #241, we decided to disable a security feature of OAuth2 authentication in order to get backend login to a working state. It should be implemented correctly in order to protect the backend against that class of attacks.
### Action Items
- [ ] create an app client in the cognito user pool that contains `client_secret`
- [ ] implement a solution in PD that can successful authenticate against cognito using the `client_secret` value
### Resources/Instructions
- [what is the purpose of `client_secret`](https://security.stackexchange.com/questions/225397/what-is-the-purpose-of-the-oauth2-client-secret)?
Contributor guide
Assessment
This issue has not been assessed yet.