Viewing profile — vwpolo3

That looks like a mistake in the doc: - https://oauth.net/articles/authentication/ - https://tools.ietf.org/html/rfc6749 - The OAuth 2.0 Authorization Framework

It explains why OAuth2 is hard to use and does not solve login, registration, sessions, profile management, mfa, and proposes another solution. It’s all open source! :)

The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give …

Don't forget Ory: https://github.com/ory

There are already true open source alternatives on the horizon such as https://github.com/ory It is about time for a new generation of identity systems in my opinion. This acquisit…

Don't implement your own, there's tons of open source that can do that, for example https://github.com/ory/hydra

Without upgrade, this might be exploited through package managers able to fetch from Git URLs (so NPM, Go Modules, and others).

Ory | Open Source Software Engineer (Go, React) | FULLTIME | ONSITE in Munich Germany We build stuff for an emerging cloud infrastructure. It's security, zero trust, hardcore bulle…

The problem is that online news sources are (almost) all the same - low budget, second tier silos of mostly trainee journalists. They have an emphasis on clicks and outrage and con…

Username + Password with a cookie store is much better understood and harder to get wrong than implementing a full OIDC suite (server + client). If you're talking federated login, …

Sorry, but following a standard for federation is not a substitute for building a log in system, which is what most people want when building "a web app".

Yes, not only on a roadmap but in high priority and under active development (not in the public eye yet)

The blog posts and discussion was long ago (the video is 6 years old). Since then, that particular author acknowledged that (iirc) OpenID Connect solves many of the things he criti…

Yes, implementing both OAuth2 as well as OIDC according to spec is a significant development effort and countless teams and companies fail at pushing through, shipping incomplete o…

While not explicitly mentioned, PKCE is supported! And yes, that draft was an important guide during implementation.

It leaves the implementation of the login (enter /password, ...) and consent (may application X have access to your pictures?) flows up to the developers using HTTP Redirection flo…