3766487 - Removing client_secret from Composable Storefront configuration

A development team using Composable Storefront looks for a way to remove the client_secret value that is stored in the Composable Storefront configuration files under authConfig.authentication. The motivation is typically a security concern around having credentials present in the frontend codebase.

The team often takes the following path:

• Reads the OAuth2 documentation section that describes public clients in the context of brute force protection.
• Imports an OAuth client into OAuthClientDetails with an empty clientSecret value.
• Removes the client_secret line from the Composable Storefront configuration files.
• Attempts to authenticate against the authorization server using either Resource Owner Password Flow or Authorization Code Flow.

The setup does not work, and the team observes that the documented configuration which removes client_secret cleanly is described only for newer versions of the backend.

• SAP Commerce Cloud
• Composable Storefront

SAP Commerce Cloud, Composable Storefront, client_id, client_secret, clientSecret, public client, OAuthClientDetails, authConfig, authentication, OAuth, OAuth2, OAuth 2.0, OAuth 2.1, Authorization Code Flow, Resource Owner Password Flow, PKCE, Custom Login Page, authorizationCodeFlowByDefault, JDK 17, JDK 21, 2211-jdk21, authorizationserver, oauth/token, oauth/authorize, OCC_BACKEND_BASE_URL_VALUE, Cloud Portal, hcs_common, security, frontend credentials, codebase, environment configuration , KBA , CEC-SPA , SAP Commerce Cloud Spartacus , How To