OAuth Private Consumer vs "Non-private" consumer

[rap_serenergy]

I am trying out the OAuth2 authentication for building a CLI for various build and test automation.

When creating the oauth consumer I came across the "This is a private consumer " checkbox

The help text states:

"Installable applications that ship their OAuth consumer credentials as part of the application should not be marked as private."

I am using the Authorization Code Grant flow and would be distributing the oauth client secret with the CLI tool internally in our company, so I guess I should leave the "private consumer" checkbox unchecked.

But I can't figure out what difference the private flag actually makes?

If the secret and a refresh token was leaked from a device, it seems I can still use these to get an access token.

Best regards

Rasmus

[bain · Accepted solution]

Setting it to private stops "Client Credentials Grant" or the so called 2-LO flow. In this flow knowing the the Consumer ID and Consumer Secret means that an attacker can access the user or team the consumer is installed into. No user involvement is needed. No user session is needed. 

The "Client Credentials Grant" (aka code) and "Implicit Grant flows" are 3-LO flows. The option does not affect these flows. In these flows you need:

1. Consumer ID
2. Consumer Secret 
3. User session (aka user logged into https://bitbucket.org).

It's relatively easy to get Consumer ID and Consumer Secret out of the client. However, getting the User session is much harder. In the end if the attacker is able to get the session they don't need OAUTH because they already have access.

REF: https://developer.atlassian.com/cloud/bitbucket/oauth-2/