The post says this is Hydra based. Authentik has been listing CF as a customer for a while now. I thought the new announcement might have something to do with that but down look like it.
OAuth for all
151–160 of 174 posts
Re: OAuth for all
#152Re: OAuth for all
#153Earlier quoted context omitted.
What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.
I wouldn't call it a nightmare. It's a well documented design choice
Well, my nightmare involves a lawyer waving documents towards my face.
Re: OAuth for all
#154Earlier quoted context omitted.
i mean. fair trade?
No, consolidation within the tech industry has never been good for workers or open source development. For someone who considers themselves as part of the open source community I've been extremely disappointed how anti-worker and pro-corporation you come across. Don't worry you aren't unique in this regard, many other nonworking dev influencers say similar things: never championing for workers but somehow always cham…
> has never been good for workers
Having your workers in-house whole other businesses/industries is also not good for workers, because the problem space of that grants their actual employment won't get the required attention.
Re: OAuth for all
#155Author of Ory Hydra here! Very cool to see this blog post and technical description! I never would have thought this piece of software would secure the internet companies in the world :) Also great to see that the 2.x version performs so well for you! The CPU use is ridiculously small for that scale! We have a commercial variant that‘s even faster, if you ever run into trouble. If anyone here is interested in providi…
appreciate all your work Hydra, Kratos and my favorite small RBAC lib - ory/ladon
Re: OAuth for all
#156This is basically about OAuth for accessing a Cloudflare account, not a CF-hosted generic 'Login' type stuff for custom apps
Yeah, I was originally thinking of the latter and generally interested as to what they were providing.
Re: OAuth for all
#157I used to manage a self hosted instance of the identity server framework for dotnet that ran several billions of requests per month, my experience managing OAuth and OpenID Connect at that scale was that it was pretty much a solved problem with relatively low maintenance *(it was a critical core service at our org, with heavy compliance, but our team was maybe 3 people taking care of it? it is still up and well to th…
Is that the identity server for dotnet that has been converted into a commercial product and costs a huge pile of money to use (lite starts at almost 6000$ per year): https://duendesoftware.com/pricing
Re: OAuth for all
#158Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…
I run Codex in multiple disposable sandboxes and OAuth is such a fucking pain. I vibe-coded a project which just stores/allocates/shuffles codex auth.json files around. I have a codex instance that I manually authenticate multiple times with browser OAuth, then copy that auth.json in a store from where it's distributed to the sandboxes. And sandbox codex sometimes refreshes the authorization, so when that happens I n…
Yeah I was doing some similar stuff. I think I tried copying the auth file for codex or claude and even that didn't work - the tokens were somehow tied to some machine identifiers just to make it even more annoying. Claude Code has long lived oauth tokens which were working well for me, but then it turns out you can't use Remote Control if you use those, so I had to go back to the standard oauth web login trash everytime I spin up a new devbox. At every step the enterprise auth mindset makes my life more difficult by assuming I'm running some clownshow with bad code fully open to the internet unable to secure an API key, and gives me no way to just say "no thanks, i accept the increased risk ” and opt out of their junk.
Re: OAuth for all
#159Mixed fealings cause the full context should include plans on both Authorization and Authentication flows at least withing Cloudflare ecosystem. No github examples Anyway good start in the right direction from Cloudflare, yet still long way to go especially compare to the full Ory's offering its built on. Ory's Kratos handles identity, login, registration, recovery, MFA... https://github.com/ory IMHO full scope shoul…
Having recently gone through this exercise with our IAM vendor to secure our MCP service, OAuth DCR scares me in that context. With redirect flows, which are usually what you're using when you're plugging your MCP into an agent, the spec says nothing about how to secure that. I really don't want to allow just anybody to register a client with an arbitrary callback. That's opening us up to phishing. Register your client with a malicious callback url and then trick users into clicking a link that initiates that flow. Our legitimate idp will authenticate them and then send then hand their access tokens off to an attacker.
The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.
Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.
Re: OAuth for all
#160Earlier quoted context omitted.
That’s exactly the point. Wrangler, being cloudflare’s primary CLI tool, is a microcosm of exactly the problem GP was articulating: it’s focused way more on adding new commands than improving existing ones. Many products, even supposedly “GA” ones, still lack basic operability via wrangler because instead of finishing building out its capabilities to manage existing services, they prioritized adding rudimentary suppo…
Nah, you don't get to claim they don't work on improving their products, and then handwave away actual updates to it with "yeah but those aren't the improvements I wanted". That's just life and priorities. Abandoning something, and not making the changes you want to see are entirely different things.
You're arguing against a point I did not make. I observed that Cloudflare prioritizes expanding to new products over making improvements to existing ones. I did not claim they do not improve their products.
There are numerous examples, such as Cloudflare claiming Workflows had reached "GA" status before offering a way to delete workflows... not via wrangler, not the dashboard, not the API. They eventually added this many months after declaring it "GA", with no upfront disclaimers, just the capability silently missing.
If they want to move fast and break things (and they do, as their numerous, "CEO declares an emergency" outages have evidenced) they can — but they need to be honest in their communication about the production readiness of their new products.
That is not "life and priorities": it is poor communication/judgement from an infra company, and misleading advertising at worst. I choose to believe it's the former.