how to avoid hard-coding of client credentials in browser(front-end) for external web application when posting to SharePoint Online

Question

I am able to successfully upload a file from external web application(SAP UI5, a javascript based framework) to SharePoint Online using SharePoint REST services. I have registered the app as a 'SharePoint Add-In' in Azure ACS and set the 'App permission requests' by allowing 'app-only policy'.

I have the generated 'client-id & client secret' credentials with me which i hardcoded in my web application while making Ajax POST request in order to authenticate and get the access token(that is required to make REST calls to SPO).

There is no server-side code, so all code is written/implemented in front-end, I want to know if there is a way to directly get access token in our application without passing the client credentials?

Can we pass the client credentials somewhere in SPO instead of hardcoding in the application or is there any other option like installing client certificate etc to authenticate instead of user/password ?

Answer 1

If you're doing this in JavaScript, no method is going to hide the secrets from the end user. I'd recommend adding a server-side component to the solution where you could do that (e.g. a web site running in Azure that leverages Azure KeyVault to retrieve secrets).