#44 front end JavaScript library with key obfuscated

OWASP · Mar 23, 2022 · 6f192d6 · 6f192d6
1 parent ff94b7e
commit 6f192d6
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 9 deletions.
diff --git a/src/main/resources/explanations/challenge15.adoc b/src/main/resources/explanations/challenge15.adoc
@@ -1,8 +1,8 @@
 === Docker COPY and WORKDIR
 
-When we start new project usually we are focus on new feature implementation than on security aspect.
-Sometimes Single Page Application or mobile application need to access information for themselves rather than on behalf of a user.
-For this purpose OAuth provides the `client_credentials` flow to get access token.
-In such situation it's easy to store client secrets in front-end or mobile application code.
+When we start a new project usually we are focused on new feature implementation than on the security aspect.
+Sometimes Single-Page apps or mobile apps need to access information for themselves rather than on behalf of a user.
+For this purpose, OAuth provides the `client_credentials` flow to get access token.
+In such a situation, it's easy to store client secrets in front-end or mobile application code.
 
-What about looking for it in the Development Tools in browser?
+What about looking for it in the Development Tools in the browser?
diff --git a/src/main/resources/explanations/challenge15_hint.adoc b/src/main/resources/explanations/challenge15_hint.adoc
@@ -1,6 +1,6 @@
 You can solve this challenge by the following steps:
 
-1. Open main page in the Chrome browser
+1. Open the main page in the Chrome browser
 2. Open development tools:
 - select Network tab
 - find request with path `/token`

diff --git a/src/main/resources/explanations/challenge15_reason.adoc b/src/main/resources/explanations/challenge15_reason.adoc
@@ -1,4 +1,4 @@
-*Why using Single-Page Application or Mobile application to put client secret in is a bad idea*
+*Why using Single-Page apps or Mobile apps to put client secret in is a bad idea*
 
-As you can tell by now, you can easily detect any secret that stored within a Single Page Application or Mobile application.
-To prevent such situation Authorization Code Flow with Proof Key for Code Exchange (PKCE) is used.
+As you can tell by now, you can easily detect any secret that is stored within a Single-Page app or mobile app.
+To prevent such a situation Authorization Code Flow with Proof Key for Code Exchange (PKCE) is used.