If you like diagrams, I've found that @darutk on Medium has some really good explanations of Oauth2 and OpenID. Example: https://medium.com/@darutk/diagrams-of-all-the-openid-connec...
A guide to Oauth2
21–30 of 55 posts
Re: A guide to Oauth2
#22I'm currently in the middle of implementing an OAuth 2.0 authorization server following the RFC draft of the best current practice [1]. It's been a huge pain navigating all the interlinked (and sometimes contradicting) RFCs around, especially with a distinct lack of resources for actually implementing an authorization server. RFC6749 does not suffice on its own since it says nothing about authentication or tokens pay…
> I'm seriously considering implementing a fully spec-compliant OAuth 2.0 + OpenID Connect Core 1.0 reference server implementation in Typescript
That'd be awesome - I'd appreciate learning from something like that, and I really appreciate Typescript
Re: A guide to Oauth2
#23Im not sure there ever will be a complete complete oauth2 considering everyone who implement it have their own flavor of it.
Re: A guide to Oauth2
#24Earlier quoted context omitted.
Above that I think this is rude to my contacts: You can’t just go and upload random people’s data on plattforms of your choice . I get it – people feel like it is their contacts because they collected them, but they are not. This should be illegal.
Is it even legal to upload contacts under GDPR?
Well, the GDPR doesn't apply to "a natural person in the course of a purely personal or household activity", so they can upload them, assuming they're personal contacts.
For contacts of clients and such, probably yes, since whatever conditions for allowing their processing in Gmail probably also apply to Skype (and vice-versa). But it might not if for some reason the other service offers less security or control over that data.
Re: A guide to Oauth2
#25Earlier quoted context omitted.
Is it even legal to upload contacts under GDPR?
Well, the GDPR doesn't apply to "a natural person in the course of a purely personal or household activity", so they can upload them, assuming they're personal contacts. For contacts of clients and such, probably yes, since whatever conditions for allowing their processing in Gmail probably also apply to Skype (and vice-versa). But it might not if for some reason the other service offers less security or control over…
That makes sense from the uploader side. But can the service store and use data about me because you uploaded it? In this case I have only added my data to Gmail, and never allowed Skype to have it and have not accepted the terms from Skype.
Re: A guide to Oauth2
#26> You want to add all your contacts in Gmail who are in skype Never once in my lifetime I wanted to do that. For any two services.
Really? I wanted to see who I knew when LinkedIn first came out. Likewise when FB was released. Likewise when Twitter came out. Do you use any of those services? If so did you create your contact list from scratch on each? None of my friends are on TikTok AFAICT but if they were I'd want to know.
> I wanted to see who I knew when LinkedIn first came out.
I'm curious, why? I sign up to different services (reluctantly) because I want to communicate with people I can't yet. Occasionally I might have some contacts on two networks, if there's some specific feature I want to use, but it's rare.
Re: A guide to Oauth2
#27If you like diagrams, I've found that @darutk on Medium has some really good explanations of Oauth2 and OpenID. Example: https://medium.com/@darutk/diagrams-of-all-the-openid-connec...
Such great content now hostage to that website, what a pity.
Also look at their nice django-oauth-server: https://github.com/authlete/django-oauth-server
Re: A guide to Oauth2
#28Earlier quoted context omitted.
Really? I wanted to see who I knew when LinkedIn first came out. Likewise when FB was released. Likewise when Twitter came out. Do you use any of those services? If so did you create your contact list from scratch on each? None of my friends are on TikTok AFAICT but if they were I'd want to know.
> I wanted to see who I knew when LinkedIn first came out. I'm curious, why? I sign up to different services (reluctantly) because I want to communicate with people I can't yet. Occasionally I might have some contacts on two networks, if there's some specific feature I want to use, but it's rare.
I wanted to stay in touch as they changed roles. I still do.
> Occasionally I might have some contacts on two networks, if there's some specific feature I want to use, but it's rare.
Are you sure you don't have business contacts who are also in your email address book?
Re: A guide to Oauth2
#29It's worth mentioning that it's a bad idea to invalidate refresh_token grants ever during the lifetime of an authorization. I've seen APIs do this immediately upon sending the response to the token endpoint, which makes the system unusable due to the frequency of network transmission errors that would result in having to contact the resource owner to grant access again. Even an expiry after days and years is only likely to result in more support requests to the API maintainer without increasing security enough to justify it.
The reason this bad practice is common is that it is allowed by the spec in https://tools.ietf.org/html/rfc6749#section-6 as an optional action to take on refresh grants. Please, do not do this.
Re: A guide to Oauth2
#30Are there similar posts like this for UI best practices for implementing OAuth 2.0 as an authorization server? I've been looking for guides on how best to display the scopes and client details to the user, but I've basically had to rely on other authorization servers themselves for inspiration (Google, Github, etc.).
Has anyone written a blog post about OAuth authorization server UI design?