Safe way to use Salesforce OAuth
===

I am about to start developing a Chrome extension based on Salesforce API. And I have a server  between the client and Salesforce as an agent. The server saves the user's access token and refresh token.

Is that safe?

Can the attacker get the client_id and initiate his/her own implicit auth flow?