From fad8f7b148d78f314cf9fc0689dd3d00969fb092 Mon Sep 17 00:00:00 2001 From: Emelia Smith Date: Thu, 16 May 2024 17:13:58 +0200 Subject: [PATCH] Only return client_secret for confidential clients --- app/serializers/rest/credential_application_serializer.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/serializers/rest/credential_application_serializer.rb b/app/serializers/rest/credential_application_serializer.rb index 0532390c9a5..d4faedb848c 100644 --- a/app/serializers/rest/credential_application_serializer.rb +++ b/app/serializers/rest/credential_application_serializer.rb @@ -8,7 +8,7 @@ class REST::CredentialApplicationSerializer < REST::ApplicationSerializer end def client_secret - object.secret + object.secret if object.confidential? end # Added for future forwards compatibility when we may decide to expire OAuth