OAuth for all • Hacker News Board

Re: OAuth for all

#51

Post by aeneas_ory » Thu, Jun 25, 2026, 7:50 AM UTC

Author of Ory Hydra here! Very cool to see this blog post and technical description! I never would have thought this piece of software would secure the internet companies in the world :) Also great to see that the 2.x version performs so well for you! The CPU use is ridiculously small for that scale! We have a commercial variant that‘s even faster, if you ever run into trouble.

If anyone here is interested in providing their own oauth, IAM, rebac permissions, API keys, agent security - check out our open source & commercial products at https://github.com/ory and https://www.ory.com/

Re: OAuth for all

#52

Post by Avery29 » Thu, Jun 25, 2026, 7:51 AM UTC

OAuth is great when you actually need user delegation. For simple server-to-server API access, scoped keys with rotation, audit logs, and fast revocation are often a much better developer experience.

Re: OAuth for all

#53

Post by utopiah » Thu, Jun 25, 2026, 7:57 AM UTC

swyx wrote: post #42

utopiah wrote: post #35

Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.

i mean. fair trade?

It's a good move for them but it's problematic for anybody who cares about a decentralized Internet.

Re: OAuth for all

#54

Post by firasd » Thu, Jun 25, 2026, 7:58 AM UTC

This is basically about OAuth for accessing a Cloudflare account, not a CF-hosted generic 'Login' type stuff for custom apps

Re: OAuth for all

#55

Post by aeneas_ory » Thu, Jun 25, 2026, 7:59 AM UTC

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

OAuth2 is complex and often not the right tool. I wrote Ory Hydra and also a blog post when OAuth2 is/is not a good idea: https://www.ory.com/blog/oauth2-openid-connect-do-you-need-u...

For API Keys we just launched Ory Talos (https://github.com/ory/talos) - a perfect alternative for when OAuth2 is too much for the use case.

There are use cases and security concerns that legitimize using OAuth2 - with specs like DPoP you can make these flows more secure. In my view the use cases presented here is a good one for OAuth2, but it certainly doesn’t make sense everywhere - complexity makes system harder to secure.

Re: OAuth for all

#56

Post by miguelspizza » Thu, Jun 25, 2026, 8:01 AM UTC

What’s ironic about this is they technically already shipped a looser version. The entire cf api is exposed as an MCP server which supports OAuth and dynamic client registration.

Not sure why they don’t just support DCR or CIMD for this too

Re: OAuth for all

#57

Post by badgersnake » Thu, Jun 25, 2026, 8:07 AM UTC

RVuRnvbM2e wrote: post #49

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

It's the worst delegated authorisation system except for all the others that have been tried from time to time.

The original OpenID was fine.

Re: OAuth for all

#58

Post by breakingcups » Thu, Jun 25, 2026, 8:21 AM UTC

utopiah wrote: post #35

Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.

Cloudflare is one of the most expensive providers out there once you step out of the basics. Look at their video streaming.

Re: OAuth for all

#59

Post by jpc0 » Thu, Jun 25, 2026, 8:29 AM UTC

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

> I just want a damn API key, I keep it a secret and revoke if necessary and don't need 10000 layers of auth bullshit tangled up in every layer of every platform

Then implement that on your app... You are just generating a random key and storing a hash + salt.

Auth is hard only applies to auth for many users. For your own auth this is dead simple and made even simpler if you use a half decent framework...

If you are really worried about the implementation being insecure throw one of the many moderately frontier models at it, they are really not bad at finding issues in an auth system that simple.

Re: OAuth for all

#60

Post by dist-epoch » Thu, Jun 25, 2026, 8:32 AM UTC

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

I run Codex in multiple disposable sandboxes and OAuth is such a fucking pain. I vibe-coded a project which just stores/allocates/shuffles codex auth.json files around. I have a codex instance that I manually authenticate multiple times with browser OAuth, then copy that auth.json in a store from where it's distributed to the sandboxes. And sandbox codex sometimes refreshes the authorization, so when that happens I need to send that auth.json back to the central store. Madness.

One good thing GitHub Copilot has it that you can just give it a GH_TOKEN that is valid for 6 months and stop this browser login nonsense.