Why are Certificates more secure than Secrets?

Question

When using OAuth2, why Certificates are more secure than using Secrets?
If an eavesdropper steals the JWT isn't the same stealing the Secret?

Answer 1

Hello @DANILO BATISTA DE QUEIROZ , the main reasons of why Certificates are more secure than Secrets would be:

1. Certificate assertions are usually short-lived (Eg. 5 to 10 minutes) so if even if intercepted they will provide only limited use. Secrets on the other hand tend to be long-lived.
2. Secrets are symmetric keys so both client and server need to know about it. With certificates only the client needs to be able to use the private key w/o reading it (which is usually handled by the OS cryptographic system) while the server only needs to know the public key for validation thus you won't need to transmit/share the private key/secret. With a secret you will have to both share and transmit it.

Access tokens are usually short-lived (max 1 hour by default). Secrets, again, are usually long lived. Also, access tokens are issued to only 1 client while a secret can be used to issue several access tokens for several clients.

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.