Linkedin OAuth2 Keys

ID

linkedin_oauth2

Severity

high

Vendor

Linkedin

Family

API Token

Description

LinkedIn is an employment-oriented online service that operates via websites and mobile apps. The platform is primarily used for professional networking and career development, and allows job seekers to post their CVs and employers to post jobs.

LinkedIn OAuth2 credentials enable applications to access LinkedIn resources, such as member data.

Security

Any hardcoded LinkedIn Key is a potential secret reported by this detector.

Accidentally checking-in the keys to source control repositories could compromise your LinkedIn account.

Examples

linkedin_client_id = ufmkfj5safdzwz
linkedin_client_secret = 7qn7qw6c6h62n24y

Mitigation / Fix

  1. Remove the Key from the source code or committed configuration file.

  2. Follow your policy for handling leaked secrets, which typically require revoking the secret in the target system(s). Secret revocation can be handled from your Applications Dashboard.

  3. If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.

You should consider any sensitive data in commits with secrets as compromised.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference

https://docs.microsoft.com/en-gb/linkedin/shared/authentication/authentication