The complexities of OAuth make me want to go solve an NTLM double-hop problem with a three headed dog.
Why are we seeing so many implementation mistakes? Is OAuth simply too difficult?
Why are we seeing so many implementation mistakes? Is OAuth simply too difficult?
Developer Quits OAuth 2.0 Spec, Calls It 'a Bad Protocol' - https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec...
"OAuth 2.0 and the Road to Hell" - https://news.ycombinator.com/item?id=4294959
When Facebook, Twitter, Github, etc. all got burned at various points in time with their OAuth implementations, you have to start looking for the common denominator.
Can we just stop using oauth entirely, then? There's got to be something better.
> Keep in mind that when OAuth 2.0 was published in 2012, the iPhone 5 was brand new, the latest browser from Microsoft was Internet Explorer 9, single-page apps were called “AJAX apps”, and CORS was not yet an established W3C standard.
* it's a framework for authorization, with at least 8 different ways of using it (https://fusionauth.io/docs/v1/tech/core-concepts/modes has more)
* authentication is not most folks core competency
OpenID Connect gives a mandated list of steps for verification.
Facebook Connect really only is supported via usage by an official SDK. If you are using an implementation that reverse engineered support for Facebook Connect rather than using the official SDK, you are on your own.