Why is OAuth still hard in 2023?
nango.dev
Why is OAuth still hard in 2023?
1–10 of 290 posts
Re: Why is OAuth still hard in 2023?
#2Because it's too flexible, and allows the OAuth provider to choose which features they support. That puts all the complexity on the client to support every possible implementation.
Re: Why is OAuth still hard in 2023?
#3Thank you for "asking" and have the luck of appearing in the first page in HN. I am sure many here wonder why. There are more complex pieces of software that find a way to abstract the problem in a nice interface.
Re: Why is OAuth still hard in 2023?
#4[flagged]
Re: Why is OAuth still hard in 2023?
#5It's a turd, if you want poor security you should make things so complicated that half the implementers have no idea what they are doing. We should have a kind of LD50 for specs: How much feature cruft do you need for 50% of the test subjects to die.
Re: Why is OAuth still hard in 2023?
#6Because "OAuth" is not a thing, it's a label you can glue on any wild-and-wacky authentication mechanism someone hacks together. It is structurally impossible for OAuth to ever become "easy".
Re: Why is OAuth still hard in 2023?
#7We have a joke about this at Zapier -- don't be an oauth butt!
"We support standard oauth butttt..."
Re: Why is OAuth still hard in 2023?
#8OAuth is easy in 2023. The problem is that OAuth does essentially nothing of interest by itself. It's a way to pass scoped access tokens.
That's it. That's the end of the spec.
If you want to do anything with those tokens, you need to implement against other APIs the provider makes available. Unless all of those APIs are also standardized, it means implementing a bunch of stuff for each integration. And now things are no longer easy.
Re: Why is OAuth still hard in 2023?
#9Example: What is the purpose of OAuth having specifications for redirect URI allowlist AND PKCE?
None. They are entirely duplicative features.
But ... reason, reason, reason ... they both exist, and are going to exist, forever.
EDIT: I should say, PKCE is a functional superset of redirect URI allowlist.
Re: Why is OAuth still hard in 2023?
#10OAuth is easy in 2023. The problem is that OAuth does essentially nothing of interest by itself. It's a way to pass scoped access tokens. That's it. That's the end of the spec. If you want to do anything with those tokens, you need to implement against other APIs the provider makes available. Unless all of those APIs are also standardized, it means implementing a bunch of stuff for each integration. And now things ar…
OAuth is a way to obtain scoped access tokens.
And if you read the article, you would have something of substance to contribute on that topic, whether it is easy or hard or otherwise.