Line Messaging OAuth2 Keys

ID

line_messaging_oauth2

Severity

low

Vendor

Line

Family

API Token

Description

Line is a freeware app for instant communications on electronic devices such as smartphones, tablet computers and personal computers. Line users exchange: texts, images, video and audio and conduct free VoIP conversations and video conferences.

OAuth Keys allow to create channel access tokens on a user basis using OAuth2 flow.

Security

Any hardcoded Line Key is a potential secret reported by this detector.

Accidentally checking-in the keys to source control repositories could compromise your Line account.

Examples

LINE_PAY_CHANNEL_ID=1655381461
LINE_PAY_CHANNEL_SECRET=6c2a96b9c537df485a77ecd98b4706bc

Mitigation / Fix

  1. Remove the Key from the source code or committed configuration file.

  2. Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). The client_id is unique and public for a channel. The client_secret can be rotated from the Console.

  3. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.

You should consider any sensitive data in commits with secrets as compromised.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference

https://developers.line.biz/en/docs/messaging-api/overview/