Re: [keycloak-dev] why authenticate clients?

That's at least one ;) Confidential clients are always going to be more secure, but public clients are a requirement so whatever we can do to make them more secure would be great. At some point confidential clients needs to be exposed to a browser though, and that means they will need some way of securing the public client. Even a http-only cookie is still vulnerable. For example if there's an exploit in the browser, or the hacker gains read access to the file-system, it would be relatively easy to extract the refresh token from the cookie. End of the day there's a few things that are outside of our control: * Exploits in browsers * Hackers that gain access to file-system * Users that don't check the URL (and https certificate) ----- Original Message -----