Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for Python made easy

github.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: OAuth for Python made easy

#11

Post by jrussbowman »

dtwwtd wrote: post #10
jrussbowman wrote: post #9

If you're looking for a more full stack framework in python, tornado has had support for oauth since it's release. It's implementation does rely on the tornado ioloop though, so it's not something you can easily just pull and use elsewhere.

It's really easy to use too. I recently extended the base implementation for a service that it didn't support and it took me very little time.

I put some time into it a couple years ago before my 2nd kid was born. I've always wanted to go back and work on making it a bit easier to use. One of the things I'd love to do is get rid of it being so tied to request handlers so you can use it more seamlessly in apps.

Re: OAuth for Python made easy

#12

Post by marquis »

zalew wrote: post #4

to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers... ? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oau…

https://github.com/hasgeek/lastuser was the least painless method in my experience but I never tried any non-lastuser clients with it so I can't comment on library compatibility.

Re: OAuth for Python made easy

#13

Post by idan »

I wish the author had contributed to existing efforts (https://github.com/idan/oauthlib) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working towards OAuth2. The idea is to have one de-facto reference OAuth implementation for python instead of a few confusingly different choices, because the differences are really hard to spot for anybody who hasn't spent some time cuddling up with the RFC.

Doing OAuth signing logic correctly is pretty finicky. Requests is great, and we provide a shim layer for it, but it's silly to reimplement the underlying request signing logic for requests, urllib3 or what-have-you. And what happens when you need a server-side implementation for verifying signatures? It makes more sense to do the tricky logic in a separate, testable library than tying it to one representation of an HTTP request.

Having said all this, anybody willing to wade into this mess and write something is my kind of crazy. Respect.

Re: OAuth for Python made easy

#14

Post by whalesalad »

idan wrote: post #13

I wish the author had contributed to existing efforts ( https://github.com/idan/oauthlib ) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working toward…

Look at the examples and docs on the oauthlib library. It's like Java. SkeletonValidator(RequestValidator) ??? This is totally the opposite of pragmatism, and one of the main reasons I've moved away from Python and build most things in Ruby now.

After doing Django for 5 years, the nail in the coffin was when I wanted to simply access a users me object from their facebook graph timeline. Riddle me that. In ruby-pragmatism land it's a gem and a line or two of code away, thanks to the awesome Koala library.

Kenneth Reitz's recent requests library is the first refreshing and pragmatic python tool I have seen in a long time. This oauth library shares the same friendly and straightforward interface too. The docs and examples are directly clear and directly in front of you. It's simple and pragmatic.

The stars on the repo's speak for themselves ... rauth has over 700 stars, whereas oauthlib has considerably less than half of that. I'm not trying to tell you that you suck, because I admire your work quite a lot, but I think these days developers want simple and pragmatic.

Re: OAuth for Python made easy

#15

Post by llambda »

idan wrote: post #13

I wish the author had contributed to existing efforts ( https://github.com/idan/oauthlib ) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working toward…

First, I believe rauth existed prior to your library: rauth is over a year old now. (Or maybe existed at around the same time; regardless as you'll see below, contributing to your project wouldn't have made sense for us.)

Second, you're trying to solve a different problem than rauth solves: we needed a library that provided for the practical, de facto implementation of OAuth 1.0/a and 2.0 as well as Ofly which allowed us to consume provider APIs. This is exactly what rauth does. It loosely wraps Requests, which means you get to basically use Requests that also happens to handle real-world OAuth providers as a consumer. I don't think it's really fair to call this "silly": it's clearly filled a hole in the ecosystem for some people.

If you want to consume an OAuth provider, rauth tries to give you a simple interface to do so with. It's almost as easy as using Requests. You might even say, it's OAuth for Humans. (Sorry, Kenneth. :)

Edit: to be clear, rauth is about pragmatic simplicity, about a clean API that's pleasant to work with. It's a client for OAuth modeled around the fact and philosophy of Requests. Vis-à-vis everything else I've seen, this is in pretty stark contrast to existing libraries.

Re: OAuth for Python made easy

#16

Post by zalew »

marquis wrote: post #12
zalew wrote: post #4

to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers... ? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oau…

https://github.com/hasgeek/lastuser was the least painless method in my experience but I never tried any non-lastuser clients with it so I can't comment on library compatibility.

it doesn't have any docs and even from the page I have no idea what it actually does, it doesn't look like an oauth provider (?)

Re: OAuth for Python made easy

#17

Post by zalew »

peter_l_downs wrote: post #8
zalew wrote: post #4

to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers... ? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oau…

Not much has changed. I'm currently working to open source an implementation I worked on that's compliant with the finalized version of the spec. The most up-to-date implementation I've seen in the open is https://github.com/hiidef/oauth2app , which implements draft 16.

thanks, looks sane.

Re: OAuth for Python made easy

#18

Post by trtg »

llambda wrote: post #15
idan wrote: post #13

I wish the author had contributed to existing efforts ( https://github.com/idan/oauthlib ) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working toward…

First, I believe rauth existed prior to your library: rauth is over a year old now. (Or maybe existed at around the same time; regardless as you'll see below, contributing to your project wouldn't have made sense for us.) Second, you're trying to solve a different problem than rauth solves: we needed a library that provided for the practical, de facto implementation of OAuth 1.0/a and 2.0 as well as Ofly which allowe…

Thanks for your work on rauth, I've been using it for a long time and I'm hoping to update my projects to use the latest version to pick up requests 1.x support some time soon.

Re: OAuth for Python made easy

#19

Post by dtwwtd »

jrussbowman wrote: post #11
dtwwtd wrote: post #10

Earlier quoted context omitted.

It's really easy to use too. I recently extended the base implementation for a service that it didn't support and it took me very little time.

I put some time into it a couple years ago before my 2nd kid was born. I've always wanted to go back and work on making it a bit easier to use. One of the things I'd love to do is get rid of it being so tied to request handlers so you can use it more seamlessly in apps.

Yeah it would be great to be able to make API requests using the helper methods from outside of a request handler. As it is, it isn't that difficult to do it otherwise but it's just more code duplication.

Re: OAuth for Python made easy

#20

Post by trtg »

NelsonMinar wrote: post #2

Does it work? I tried to do some OAuth in Python a couple of years back and it was a total disaster; four competing libraries, none of which worked. But that was a long time ago and I don't think this Rauth library even existed when I last looked.

Yes it definitely works and does so more easily than any alternative I've tried. I've used it to interface quickly to something like 20 different APIs at this point.
Post reply on HN