What I would like to highlight is that it's still quite an achievement to be able at all to authenticate users with dozens of different APIs. Could it be better? Sure. Could it be worse? So much. Just imagine everyone would be cooking completely there own thing, or there being fractions or competing "standards".
Why is OAuth still hard in 2023?
231–240 of 290 posts
Re: Why is OAuth still hard in 2023?
#232I wrote my own OAuth2 implementation (OAuth 2.0 Authorization Code Grant, both client and server side). I share many of the frustrations mentioned in the article.
That said, my first thoughts when looking at the advertised service is that I would be adding a huge external dependency with all the associated problems. That's a big cost, and I don't mean just in monetary value. I now have to rely on the network, as well as an external company with a business model that might or might not work out for them. Said company is likely to get acquired or shut down, none of these outcomes are good for me. Also, external APIs are a pain to maintain (I found that on average an API gets completely rewritten once every 2-5 years, which if you have 5 external APIs means that you will be rewriting one every year).
Also, OAuth has an unpleasantly large interaction surface with the rest of the software.
As a counterpoint, if I could buy a good local OAuth2 library for Clojure (subscription is fine), I probably would.
Re: Why is OAuth still hard in 2023?
#233I wrote my own OAuth2 implementation (OAuth 2.0 Authorization Code Grant, both client and server side). I share many of the frustrations mentioned in the article. That said, my first thoughts when looking at the advertised service is that I would be adding a huge external dependency with all the associated problems. That's a big cost, and I don't mean just in monetary value. I now have to rely on the network, as well…
Does Clojure's "buddy" not work for OAuth2 or something? Last I recall it worked well enough but not sure what your specific requirements are.
Re: Why is OAuth still hard in 2023?
#234Related gripe: Your API doesn't always need OAuth. If I'm using your product as your customer and I directly want to leverage my own product data via your API then I shouldn't be forced to have to implement [your almost invariably non-standard and difficult] OAuth implementation. An API key should be an option or HMAC if the extra security is felt to be warranted, but not the absurdity of needing to go through a clie…
this. im baffled how most platform that has user accounts does not allow provisioning of service accounts so users can easily access their data.
Re: Why is OAuth still hard in 2023?
#235Given that this seems to describe a real problem, why hasn't anyone launched a proxy service that normalizes across the varying implementations? Why should tens of thousands of developers have to discover the particular quirks of an implementation instead of doing it once and re-using the results?
That's what we do at http://nango.dev
Re: Why is OAuth still hard in 2023?
#236As others have said, the main problem is that 1) There is too much flexibility which means that "name" might be "firstname" or "first_name" somewhere, which is why you need so many different implementations and 2) It is very hard to distill the relevant parts from the spec which covers all parts with equal vigour!
We have the same issue with the UK Wiring Regulations, so they produced an "On Site Guide", which covers only the main parts of the main regulations and is about 10th the size. The same could be true of the OAuth spec.
To be fair, OpenId Connect partially addressed both issues by taking a subset of the spec (when used for authentication) and then nailed down what the properties should be and what encryption mechanisms are required to be implemented.
Re: Why is OAuth still hard in 2023?
#237Somewhat offtopic:
HN shows me the name of the submitter, bastienbeurier, in the colour #cd6e00. (Not sure what people call that colour in natural language, as i'm colour-blind.)
What's up with that? The account was created in 2013.
Re: Why is OAuth still hard in 2023?
#238I HATED having to do anyting with oauth back when I did more web work. Think it actually gave me PTSD.
Re: Why is OAuth still hard in 2023?
#239Earlier quoted context omitted.
Yes, multiple. You can implement client credential mode - this means storing a credential and using it to acquire a token from OAuth2/OIDC provider, then using that token as Bearer Token in your API calls. EDIT: I can add that I have implemented client credential mode in what was effectively raw PowerShell and similarly it can be done with curl from any shell script, even pretty dumb ones. Just do a single POST conta…
But let's tell the truth: this is NOT user-friendly. Compare to Negotiate.
Oh boy, Negotiate. The wonderful system that works easily only on Windows.
I love it though, I use it as part of OIDC flows, because then I don't need to directly implement it for every application, I just make them call to Keycloak for it.
Re: Why is OAuth still hard in 2023?
#240Given that this seems to describe a real problem, why hasn't anyone launched a proxy service that normalizes across the varying implementations? Why should tens of thousands of developers have to discover the particular quirks of an implementation instead of doing it once and re-using the results?
oauth-proxy?