OAuth 2.0 and the Road to Hell

#1

Post by dho » Thu, Jul 26, 2012, 8:06 AM UTC

OAuth 2.0 and the Road to Hell
hueniverse.com

Re: OAuth 2.0 and the Road to Hell

#2

Post by jaequery » Thu, Jul 26, 2012, 8:48 AM UTC

somewhat, shocking. i guess i'll be moving away from Oauth, feels like a relief and scary at the same time. what are some good alternatives?

Re: OAuth 2.0 and the Road to Hell

#3

Post by rendezvouscp » Thu, Jul 26, 2012, 8:55 AM UTC

It saddens me to see OAuth 2.0 in this state. As someone who’s made really minor contributions to 2.0 (and thus listed as a contributor in the spec), I have been really looking forward to it being finished and ready for production use (where production use means no more drafts). I stopped following the mailing list last year because most of the threads seemed all too familiar or out of my realm of knowledge to contribute (read: enterprisey).

I run a 1.0a service provider and write clients against it. I’m thinking about wading through the current 2.0 draft, picking out the relevant parts to small startups with an API, and publishing a post about how to implement the sane parts of the 2.0 spec.

Re: OAuth 2.0 and the Road to Hell

#4

Post by rmoriz » Thu, Jul 26, 2012, 8:58 AM UTC

jaequery wrote: post #2

somewhat, shocking. i guess i'll be moving away from Oauth, feels like a relief and scary at the same time. what are some good alternatives?

there are no popular alternatives. Either you are super smart and design one from scratch… or you stick with OAuth and hope that some of the addressed problems will be resolved.

Re: OAuth 2.0 and the Road to Hell

#5

Post by huragok » Thu, Jul 26, 2012, 9:02 AM UTC

rmoriz wrote: post #4

jaequery wrote: post #2

somewhat, shocking. i guess i'll be moving away from Oauth, feels like a relief and scary at the same time. what are some good alternatives?

there are no popular alternatives. Either you are super smart and design one from scratch… or you stick with OAuth and hope that some of the addressed problems will be resolved.

We need an open open-auth for the proleteriat by the proletariat!

Re: OAuth 2.0 and the Road to Hell

#6

Post by georgemcbay » Thu, Jul 26, 2012, 9:10 AM UTC

Design by committee fails again.

Maybe next time it'll work!

Re: OAuth 2.0 and the Road to Hell

#7

Post by abarth » Thu, Jul 26, 2012, 9:19 AM UTC

Something similar is happening to HTML5 in the W3C: http://blog.whatwg.org/html-and-html5

Re: OAuth 2.0 and the Road to Hell

#8

Post by rmc » Thu, Jul 26, 2012, 9:26 AM UTC

jaequery wrote: post #2

somewhat, shocking. i guess i'll be moving away from Oauth, feels like a relief and scary at the same time. what are some good alternatives?

Just stick with 1.0a?

Re: OAuth 2.0 and the Road to Hell

#9

Post by kmfrk » Thu, Jul 26, 2012, 9:52 AM UTC

rmc wrote: post #8

jaequery wrote: post #2

somewhat, shocking. i guess i'll be moving away from Oauth, feels like a relief and scary at the same time. what are some good alternatives?

Just stick with 1.0a?

And if you use Python, rauth will make the experience much easier: https://github.com/litl/rauth/#readme.

Re: OAuth 2.0 and the Road to Hell

#10

Post by Zash » Thu, Jul 26, 2012, 9:54 AM UTC

https://en.wikipedia.org/wiki/Second-system_effect strikes again?