title: Hashed client secrets for the client credentials OAuth 2 flow in Apache CXF
body: <p>I'm attempting to implement the Client Credentials flow of OAuth 2.0 to secure a RESTful service, using Apache CXF (version 2.7.12).</p>
  
  <p>My only client (for now) will be trusted to keep the key and secret confidential - I'm aware of the considerations around that.</p>
  
  <p>My question is how I should store the client secret on the authorisation server. In my mind, the 'client secret' is effectively a password, and thus should be salted and hashed. However, CXF's AccessTokenService, which does the comparison between the stored secret and the value passed in on the request, only does a String.equals() comparison, and doesn't seem to give me any hook where I can provide a different mechanism.</p>
  
  <p>This means that I would need to store the client secret in plain text in order to compare it against the plain text value from the request, without a slightly hacky alternative.</p>
  
  <p>Am I missing some obvious functionality that would let me hash the incoming value before the comparison, or am I being overly-cautious with the client secret? Maybe I'm wrong to treat it like a password?</p>