Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Understanding OAuth2 and OpenID Connect

polarsparc.com

Post reply on HN
Print view View original

1–10 of 65 posts

Re: Understanding OAuth2 and OpenID Connect

#4

Post by the_af »

The article briefly mentions that the Implicit Grant is a less secure and more simplified version of the Authorization Code grant, but then it doesn't elaborate (or it's possible I missed that bit). In an introductory article such as this, I think it's important to explain why it's less secure -- otherwise the Authorization Code grant seems like an unnecessary complication.

Re: Understanding OAuth2 and OpenID Connect

#5

Post by patmorgan23 »

ratiolat wrote: post #3

The main confusion probably comes from the name Oauth, which seems to suggest that it is about Single Sign On/authentication, while in reality it's about granting site A access to your data at site B.

That's what Oauth is though. Oauth is NOT a single sign-on technology, it's about granting access to data across services. OpenID is a single sign-on protocol built on top of Oauth.

Re: Understanding OAuth2 and OpenID Connect

#7

Post by sjroot »

the_af wrote: post #4

The article briefly mentions that the Implicit Grant is a less secure and more simplified version of the Authorization Code grant, but then it doesn't elaborate (or it's possible I missed that bit). In an introductory article such as this, I think it's important to explain why it's less secure -- otherwise the Authorization Code grant seems like an unnecessary complication.

The implicit grant returns an access token directly upon authorization being granted. By removing the additional network request, it can make your system vulnerable via manipulation of redirect URLs. if you’re implementing an OAuth 2 server, you can address this by validating the provided redirect URLs, but you should be doing that regardless.

My advice is to just always use the auth code grant with the PKCE extension. TLDR of that extension:

1) client generates a “secret key” that it sends with the authorization request. 2) server associates that key with the authorization code it returns to the authorized client 3) client must present that key again in order to exchange the authorization code for the access token.

Prevents the authorization code from being intercepted and abused.

Re: Understanding OAuth2 and OpenID Connect

#8

Post by sjroot »

patmorgan23 wrote: post #5
ratiolat wrote: post #3

The main confusion probably comes from the name Oauth, which seems to suggest that it is about Single Sign On/authentication, while in reality it's about granting site A access to your data at site B.

That's what Oauth is though. Oauth is NOT a single sign-on technology, it's about granting access to data across services. OpenID is a single sign-on protocol built on top of Oauth.

> That’s what Oauth is though.

Splitting hairs but no, Oauth has nothing to do with authentication. An introductory article like this should address the distinction between authentication and authorization in the first section IMO.

Re: Understanding OAuth2 and OpenID Connect

#9

Post by taosx »

I have wasted so much time on oAuth2 and OIDC the past month that I'm building a SaaS around it. (not wasted but took away time from the business)

I would have really liked to use auth0 or other authn services but not a fan of lock-in platforms, I want to export my db without enterprise plans.

The pricing model I'm thinking of is a pay per usage + a commission of the total usage per month.

Thank you @sjroot

Post reply on HN