Is it safe to include OAuth Client_ID and Client_Secret inside Chrome Extension?

10 views

Skip to first unread message

shariq ahmed

unread,

6:23 PM (2 hours ago) 6:23 PM

to Chromium Extensions

Hello

First time developing a Chrome extension and wondering if it is safe to include OAuth client id and client secret inside the chrome extension? As far as I know, user's can view the source code and any other files/assets bundled inside the chrome extension.

The chrome extension is tied to the user's google account and needs some permissions/authorizations to do its job.

I have specified a redirect URI in the OAuth 2.0 Client I have created for this chrome extension in GCP. The redirect URI looks something like this:
https://<my-chrome-extension-id-here>.chromiumapp.org/

What are some other, better alternatives, if copying the ID and Secret is a bad idea.