I'm currently passing a Raw JSON file to the constructor of my PublicClientApplication() for MSAL as shown below:
auth_config.json
{
"client_id" : "<CLIENT_ID_FROM_https://apps.dev.microsoft.com>",
"authorization_user_agent" : "WEBVIEW",
"redirect_uri" : "<CLIENT_ID_FROM_https://apps.dev.microsoft.com>://auth",
"authorities" : [
{
"type": "AAD",
"audience": {
"type": "AzureADandPersonalMicrosoftAccount"
}
}
]
}
Currently, I have the app id from azure hard coded into this json file. That would mean this is unsecure right? because if someone decompiles the apk, they could easily get my Azure App ID. Is there any risk to having the app ID exposed? because if there isn't I guess this might not be much of a problem.
Anyway, if ever it is a problem, is there a way to secure this? The constructor only accepts the Resource ID (Int) so I can't pass a JSON object to it directly. I was thinking maybe editing the json in runtime and somehow creating another raw resource json file that isn't persisted but i don't know if thats possible and thus why I'm asking here.