Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth.io - OAuth that just works.

oauth.io

Post reply on HN
Print view View original

21–30 of 54 posts

Re: OAuth.io - OAuth that just works.

#21

Post by EGreg »

IanChiles wrote: post #15
_frog wrote: post #12

There's no shortage of simple OAuth consumer libraries out there, what I really want to see is a simple way to set up my app as an OAuth _provider_. As far as I know there's nothing out there to make that simple yet.

Or even if there was a simple, detailed guide on what your own OAuth needs to do to be secure - and a basic overview of how to implement it (not language specific, just concept-wise).

The TLDR version is: use https and OAuth 2.0, and this guide: https://github.com/Mashape/mashape-oauth/blob/master/FLOWS.m...

Re: OAuth.io - OAuth that just works.

#22

Post by tlrobinson »

spion wrote: post #3

I wish this existed before. For node.js stacks that support connect/express based middleware, we wrote oauth-flow instead https://github.com/doxout/node-oauth-flow The idea is to point the user to your oauth-flow route and they will complete the oauth flow. your middleware will then be called with req.oauth containing all received oauth credentials and the url containing all the original parameters.

There's also http://everyauth.com/ and http://passportjs.org/ for node.js

How does yours compare to those?

Re: OAuth.io - OAuth that just works.

#23

Post by jsmeaton »

enjo wrote: post #4
spicyj wrote: post #2

The most confusing thing to me about this page was the changing provider names. I was looking at the page and could tell that something was changing but it took me about 15 seconds to figure out what it was.

Hah.. I actually read this comment first and I was STILL just staring at my screen completely dumfounded. I'd see the little animation on the right update, and then something else would change. It was mystifying.

Made it really hard for me to focus on the content. I know exactly what was changing, and it wasn't that much, but it took a really long time (in comparison) to read the examples.

Re: OAuth.io - OAuth that just works.

#24

Post by _frog »

EGreg wrote: post #18
_frog wrote: post #12

There's no shortage of simple OAuth consumer libraries out there, what I really want to see is a simple way to set up my app as an OAuth _provider_. As far as I know there's nothing out there to make that simple yet.

Sure there is. http://framework.qbix.com does it out for you out of the box. But then again, we haven't launched it yet, so I apologize... but reach out to me if you want early access. However I should say that our framework takes a different philosophy. We believe that web apps shouldn't have to ask for OAuth access at all just to personalize the experience for you. They can ask the provider to display to you your n…

"The Q framework is not released under an open source license. It is only for Qbix developers."

Re: OAuth.io - OAuth that just works.

#25

Post by 6thSigma »

There is a little too much changing text going on in my opinion. It was difficult to read the sample code because my eyes kept jumping to the changing text all over the screen.

Edit: It looks like you changed the intervals. Much better now.

Re: OAuth.io - OAuth that just works.

#26

Post by 15charusername »

EGreg wrote: post #21
IanChiles wrote: post #15

Earlier quoted context omitted.

Or even if there was a simple, detailed guide on what your own OAuth needs to do to be secure - and a basic overview of how to implement it (not language specific, just concept-wise).

The TLDR version is: use https and OAuth 2.0, and this guide: https://github.com/Mashape/mashape-oauth/blob/master/FLOWS.m...

Why Oauth2? I've read about it being less secure http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell... but would like to hear the case for it.

Re: OAuth.io - OAuth that just works.

#27

Post by EGreg »

_frog wrote: post #24
EGreg wrote: post #18

Earlier quoted context omitted.

Sure there is. http://framework.qbix.com does it out for you out of the box. But then again, we haven't launched it yet, so I apologize... but reach out to me if you want early access. However I should say that our framework takes a different philosophy. We believe that web apps shouldn't have to ask for OAuth access at all just to personalize the experience for you. They can ask the provider to display to you your n…

"The Q framework is not released under an open source license. It is only for Qbix developers."

Currently that is true, contact us if you want to try it out

Re: OAuth.io - OAuth that just works.

#28

Post by ctide »

thyb wrote: post #7
yuliyp wrote: post #6

I wish there was more there than a mailing list signup and a teaser. What is it you're actually showing HN? Some animations?

yes it's maybe more a kind of ASK HN if this API could interest people as we are finalizing it

What's the difference between what you want to provide and Singly (singly.com)?

Re: OAuth.io - OAuth that just works.

#29

Post by thyb »

jsmeaton wrote: post #23
enjo wrote: post #4

Earlier quoted context omitted.

Hah.. I actually read this comment first and I was STILL just staring at my screen completely dumfounded. I'd see the little animation on the right update, and then something else would change. It was mystifying.

Made it really hard for me to focus on the content. I know exactly what was changing, and it wasn't that much, but it took a really long time (in comparison) to read the examples.

Alright, listening to your feedback it seems the animation was too much of a distraction, so we removed it. Thank you for your feedback!

Re: OAuth.io - OAuth that just works.

#30

Post by EGreg »

15charusername wrote: post #26
EGreg wrote: post #21

Earlier quoted context omitted.

The TLDR version is: use https and OAuth 2.0, and this guide: https://github.com/Mashape/mashape-oauth/blob/master/FLOWS.m...

Why Oauth2? I've read about it being less secure http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell... but would like to hear the case for it.

Well if you implement OAuth 2 properly, you'll prevent session fixation and hijacking attacks, and with https you will also prevent man-in-the-middle attacks.

The hueniverse guy was one of the people drafting the standard and as far as I can tell he laments that the providers can return a "bearer token" instead of a "mac token". That means the token is sent on every request to the provider, and without https it can be intercepted. But with https everything is fine!

OAuth 1.0 didn't rely on https to prevent MITM attacks an instead used the "mac token" to sign each request to the provider, along with an increasing timestamp/nonce to prevent replay attacks.

http://www.codinghorror.com/blog/2012/02/should-all-web-traf...

Post reply on HN