Live data from Hacker News

Why is OAuth still hard in 2023?

nango.dev

211–220 of 290 posts

Re: Why is OAuth still hard in 2023?

#211

Earlier quoted context omitted.

> In all honesty, though, "I have to look at the provider's documentation to determine like 4 URLs to add to a configuration" is not that wild of a thing? How much friction is too much friction? If it's something dumb/simple like grabbing a JWKS URL and an "issuer" URL, and then doing JWT validation, sure. Maybe you need to make a weird bespoke request to some other endpoint. Maybe you need to implement some uncommon…

...what? The server generates the auth code and redirects the user agent to your callback. You exchange that code with the IDP (over HTTPS which yeah that's its own nest of wormy trust) to get back a token. They can't inject a token because you don't get the token from them, just the one time code. If it's opaque you introspect it to validate or you just validate the JWT signature after pulling the keys from the JWKS…

Oh, thank you for reminding me of the well-known endpoint, was having trouble finding it in the OAuth RFCs but I wonder if it's pulled in elsewhere.

> They can't inject a token because you don't get the token from them, just the one time code.

that's not correct in the most common flow? The most common flow involves the user agent providing the information via a GET, so they can theoretically provide a token.

The reason the state parameter is important is because without it, a malicious actor can make a link that goes directly to your system's "oauth step finalized" step, but with their credentials. (Pedantic attack: service has slack push notifications integration, through OAuth. Attacker creates link like https : //service/connect-slack-finalize?token=token-to-attackers-slack that victim clicks on. Without using state, the service will just take the token and stick it into some slack integration. now attacker's slack is getting messages for the victim's account on the service. Cookies mean that the victim's thing is accepted immediately).

Re: Why is OAuth still hard in 2023?

#212
post #120

Earlier quoted context omitted.

In my experience with OAuth, one of the principle issues is that it's less a protocol and more a skeleton of a protocol. Actually go to the core RFCs for OAuth, and you realize that basically everything is implementation-dependent. You somehow register with the provider as a client (out of band and completely implementation-dependent). Then you ask them to log you in by sending a request to an implementation-dependen…

And this is why there's five "log in with X" buttons on every webapp, but no "tell us your IdP and we'll send you there"; let alone any kind of magical "we'll take your email address and check the DNS record of the domain to figure out who your IdP is, and then send you there." Not because the "figuring out who to OAuth with from DNS" part would be hard to design; but because there's no way to "autodiscover" all thos…

Yes because embedded XMLDsig is great! I've never seen a SAML implementation that worked reliably across IDPs outside of Java, honestly.

Re: Why is OAuth still hard in 2023?

#213
post #162

Tangentially related: what do you use today to make authn/z work for your web sites/applications where you only do first party login (i.e. you don't do social login etc.)? Create a `users` table in your database and implement the logic on your own? Or proxy to stuff like Ory Kratos and act as a translation layer through a network call?

Auth0.com

Re: Why is OAuth still hard in 2023?

#214
post #211

Earlier quoted context omitted.

...what? The server generates the auth code and redirects the user agent to your callback. You exchange that code with the IDP (over HTTPS which yeah that's its own nest of wormy trust) to get back a token. They can't inject a token because you don't get the token from them, just the one time code. If it's opaque you introspect it to validate or you just validate the JWT signature after pulling the keys from the JWKS…

Oh, thank you for reminding me of the well-known endpoint, was having trouble finding it in the OAuth RFCs but I wonder if it's pulled in elsewhere. > They can't inject a token because you don't get the token from them, just the one time code. that's not correct in the most common flow? The most common flow involves the user agent providing the information via a GET, so they can theoretically provide a token. The rea…

That's something that isn't OAuth2 or your end point is accepting something insane.

Are you talking about the PKCE variant of authorization code flow which is what replaces implicit flows in native apps and SPAs? Because those use code_challenge and code_verifier fields, not the state field. If you're doing all that in the state field with signed nonces you really should move to PKCE.

Re: Why is OAuth still hard in 2023?

#215
post #62
post #57

Earlier quoted context omitted.

Right. Do all of those dumb dialogs that allow you to sign in using your Google account, import data from one cloud to another, add integrations from third party providers to other apps… they are all solving problems you don’t have? OAuth is one of that pieces of infrastructure that power lots of things without people even noticing them, but don’t bode well with armchair engineers.

I'm an application develop who uses oauth, but it's only one in many authentication systems I've used, and certainly one of the worst.

Which highlights the very problem I was talking about, considering OAuth is an authorization protocol, not one for authentication…

Re: Why is OAuth still hard in 2023?

#216
It’s hard because the concepts of authentication and authorization are simple to abstract but hard to keep separate at a technical level. It’s actually super powerful once you futilely attempt to craft your own system that keeps the concerns separate.

Oauth is authz

But do get in “the door” you need OIDC + PKCE auth code grant.. or authn

Re: Why is OAuth still hard in 2023?

#217
post #14

OAuth sucks. It's one of the worst abstractions of our time. It's incredibly easy to implement some half assed spaghetti and call it "standard OAuth".

An abstraction that allows a landscape of experimentation and learning on an interrupt based general purpose machine? What a bunch of thoughtless assholes!

Re: Why is OAuth still hard in 2023?

#219
post #210

Earlier quoted context omitted.

> In all honesty, though, "I have to look at the provider's documentation to determine like 4 URLs to add to a configuration" is not that wild of a thing? How much friction is too much friction? If it's something dumb/simple like grabbing a JWKS URL and an "issuer" URL, and then doing JWT validation, sure. Maybe you need to make a weird bespoke request to some other endpoint. Maybe you need to implement some uncommon…

One thing I could imagine here is a signature flow happening from the sender side where they sign the nonce + the token, to avoid forgery. I don't know what the signature validation looks like in that model though (if you request a public key from the provider, are you requesting that at every request flow? If you're not, now you're adding a request to every normal, non-malicious validation flow) > Maybe you need to…

My apologies about "to know if your post-redirect-uri is getting spoofed" and then my example exploit; I was misremembering and forgetting the authorization-code step.

If you're only implementing a "client", then yeah, you can probably get away with never caring about inspecting the token. But if you're implementing a "resource server", then you'll need to, and it's all implementation-defined (but overwhelmingly that implementation is "it's a JWT").

Re: Why is OAuth still hard in 2023?

#220
post #90
post #79

Is there any good way to do OAuth on a headless system? I want to be able to run batch jobs without a browser involved. There's OAuth for devices but that has limited real world use.

Yes, multiple. You can implement client credential mode - this means storing a credential and using it to acquire a token from OAuth2/OIDC provider, then using that token as Bearer Token in your API calls. EDIT: I can add that I have implemented client credential mode in what was effectively raw PowerShell and similarly it can be done with curl from any shell script, even pretty dumb ones. Just do a single POST conta…

But let's tell the truth: this is NOT user-friendly. Compare to Negotiate.
Post reply on HN