Ask HN: Why is OAuth still hard in 2023?

#1

Post by MorL » Fri, May 26, 2023, 11:02 PM UTC

Why do you think OAuth remains challenging even in the current technological landscape? Just yesterday, I came across a post discussing CVE-2023-28131, a vulnerability that has impacted hundreds of websites.

How can we address the recurring vulnerabilities and make OAuth more user-friendly and secure?

Re: Ask HN: Why is OAuth still hard in 2023?

#2

Post by greenviad » Fri, May 26, 2023, 11:07 PM UTC

CVE-2023-28131 was published in April.

But yes, great question

I think OpenId solves some of the issues, at least for authentication, not authorization.

Re: Ask HN: Why is OAuth still hard in 2023?

#3

Post by aviCC » Fri, May 26, 2023, 11:15 PM UTC

greenviad wrote: post #2

CVE-2023-28131 was published in April. But yes, great question I think OpenId solves some of the issues, at least for authentication, not authorization.

Actually, the CVE-2023-283131 vulnerability was published with the full details just two days ago. In April Expo published a short post but without too much technical information. You can find more details about CVE-2023-283131 in the link I shared here:

https://salt.security/blog/a-new-oauth-vulnerability-that-ma....

Thank you for bringing up the distinction, and I agree that OpenID can help address some of the issues, but not all of them...

Re: Ask HN: Why is OAuth still hard in 2023?

#4

Post by stop50 » Sat, May 27, 2023, 5:05 AM UTC

aviCC wrote: post #3

greenviad wrote: post #2

CVE-2023-28131 was published in April. But yes, great question I think OpenId solves some of the issues, at least for authentication, not authorization.

Actually, the CVE-2023-283131 vulnerability was published with the full details just two days ago. In April Expo published a short post but without too much technical information. You can find more details about CVE-2023-283131 in the link I shared here: https://salt.security/blog/a-new-oauth-vulnerability-that-ma... . Thank you for bringing up the distinction, and I agree that OpenID can help address some of the iss…

Could SAML solve them in your eyes?