Including Client Secret is security risk about drive

[rakyll]

We should always set the approval_prompt to "force" on

drive/remote.go

Line 63 in 3144e06

fmt.Println("Visit this URL to get an authorization code")

.

Read more about the approval_prompt on https://developers.google.com/accounts/docs/OAuth2WebServer.

Embedding client secret is less of a concern, if the user doesn't give you blanket permissions to skip the consent dialog. So, the client should never ask for a blanket permission.

[hatboysam]

Ah ok I wasn't familiar with the force prompt.

[rakyll]

Reopening.

By default, approval_prompt is set to auto. We should make sure that the prompt is enforced.