How to hide Keycloak clientSecret with Flutter and simple_auth_flutter

Viewed 223

I'm trying to integrate Keycloak authentication in my Flutter app using simple_auth_flutter, my problem is that I don't know how not to declare the clietSecret to be passed to simpleAuth.

Here's my example code:

import 'package:simple_auth/simple_auth.dart' as simpleAuth;

Future<void> _logIn() async {

    final String identifier = 'keycloak';

    final String clientId = 'flutter-client';

    final String clientSecret = 'my-long-key-secret-krom-keycloak-admin-panel';

    final String redirectUrl = 'http://10.0.2.2:4180/oauth2/callback';

    final String baseUrl = 'http://10.0.2.2:8090';

    final String realm = 'master';

    simpleAuth.KeycloakApi api = simpleAuth.KeycloakApi(identifier, clientId,
        clientSecret, redirectUrl, baseUrl, realm);

    try {

      var success = await api.authenticate();
      print('Result: ' + success.toString());

    } catch (e) {

      print('Exception: ' + e.toString());

    }
  }

It shows the login page correctly and logs in, but it isn't a good idea to write the clientSecret in cleartext.

Any suggestion of how I should rewrite the code?

0 Answers
Related