OAuth 2.0 finalized

http://dickhardt.org/2012/10/oauth-2-0/

by michaelfairley • 14 years ago

55 16 14 years ago

mcav• 14 years ago

And yet, here we are, with OAuth still a complex behemoth and everyone doing login with Facebook, Twitter, or a poorly-implemented homegrown login system.

kinofcain• 14 years ago

Facebook and Twitter login are OAuth 2.0 and OAuth 1.0, respectively. Perhaps you mean OpenID?

kmontrose2• 14 years ago

Facebook's implementation of OAuth 2.0 differs from the (now final) spec.

It's mostly trivial things last I looked (comma delimited scopes instead of space delimited, `expires` instead of `expires_in`, and so on). Glancing over the final spec, seems headers are preferred now (which is almost always dumb IMO, but that's a whole separate rant) and Facebook only does query strings.

Looks as though the spec bloated a bit, though there's probably still a sane-ish kernel worth implementing in there compared to OAuth 1.0a.

nailer• 14 years ago

OAuth 1 was a behemoth. OAuth 2 is simple.

1. Get a login URL. Send people here to log in.

2. Receive an auth token if the user clicked allow on the login page

3. Swap the auth token for access and renewal tokens.

Optional 4: Maybe renew if you expire.

Torn• 14 years ago

So is the following critique out of date? http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell...

j-kidd• 14 years ago

I always feel that Hammer was the one holding things back. This article kind of confirms that.

wsc981• 14 years ago

I don't know if he was holding things back. I believe he wanted OAuth 2.0 to be as simple as possible, which wouldn't make the spec very flexible, but it would be easy to implement correctly.

I believe the committee had a lot of different ideas about how certain problems should be approached and instead of choosing 1 solution they either decided to keep some things open for the implementer or allowed several solutions to a problem as part of the spec.

anuaitt• 14 years ago

If anyone wants to use Google Oauth2 with flask and User session management we have Open sourced the project: https://github.com/GrexIt/flask-login-oauth2

bagosm• 14 years ago

Now that's a blog name that I sense will come strong given enough time and care.

sabret00the• 14 years ago

Finally. Now if only more Android app developers would rely on an open OAuth model rather than forcing users to use the stock browser.

digeridoo• 14 years ago

I wish that for OAuth 3 they would make it such that client and server can separately sign the request and you don't have to share keys between the two. That would be a great security enhancement.

OAuth 2.0 finalized

Related Stories