This could have used a crudely animated .gif to pull it all together. Or even a slide show or something.
An illustrated guide to OAuth
51–60 of 65 posts
Re: An illustrated guide to OAuth
#52I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
Fantastic comment from an earlier posting https://news.ycombinator.com/item?id=35720336
“… one of the principle issues is that it's less a protocol and more a skeleton of a protocol.”
Re: An illustrated guide to OAuth
#53This is well written and helped me understand quite a bit. I think a pkce edition would be appreciated considering how prevalent and recommended it is.
Here’s a description of all the major flows of OAuth 2.0, along with a visual description of PKCE (and the attack it prevents)
Re: An illustrated guide to OAuth
#54Re: An illustrated guide to OAuth
#55I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
Yes, 100% agreed. I launched and worked on OAuth 2.0 at Okta for ~5 years and spent most of my time showing people how to do it well and (gently) finding the holes and mistakes in their implementations. Sure, we were selling "OAuth as a Service" but most had introduced usability problems (at minimum) and gaping security vulns (at worst). For a deep dive, check out Aaron Parecki's book: https://oauth2simplified.com/ -…
What is your opinion on token response type and/or id_token for oidc being part of the fragment of redirect uri? I have noticed that apple only supports "code" response type, which is the most secure way. Downside is that it requires a back channel and a second request to be made, but i cannot imagine a use case where this would be a problem as I don't see a pure Single-Page Application having any use for this in a any way, except purely rendering some protected data in a different format, which seems like a silly use case.
Re: An illustrated guide to OAuth
#56> anyone can see what URLs you are visiting
this is not correct with HTTPS (query params are not part of the plain text)
Re: An illustrated guide to OAuth
#57I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
In case it helps you, I found this overview helpful: https://metacpan.org/dist/LWP-Authen-OAuth2/view/lib/LWP/Aut...
Clearly written by someone who was also frustrated by the experience (:
Re: An illustrated guide to OAuth
#58Also agree with some of the comments here that majority of articles about OAuth are incredibly verbose, but really hard to actually implement without concrete examples.
I personally think having Curl requests as part of the examples would solve this problem.
Re: An illustrated guide to OAuth
#59I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
I also don't understand the reason but this is my experience on 80% of the internet basically. Articles that purport to share how to do something then spend most of the article talking about stuff I don't care about, then we finally get to the complicated part then they skip some detail or use some library that I don't want to use and then they're just like "bam it's done! woo"
Those articles are just using the same examples (often verbatim) from the official docs. It's obvious that the authors haven't actually developed anything themselves.
There may be a lot of quality material out there, and it's just hidden under the mountain of low effort scraped, copied & AI content
Re: An illustrated guide to OAuth
#60I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
A while ago, I set out to understand OAuth properly and built a fully compliant authorisation server on SvelteKit, following all relevant RFCs, simply by… reading them all. When you get used to the technical writing, it’s actually pretty straightforward—most of them actually document the endpoint structure and payloads, error codes, and so on. After that, the most complicated part is organizing your code to be modula…
100% agree.
Did the same back in early OAuth2 days, before main platforms got libraries and support (we were transitioning from OpenId 2.0, not yet OIDC ). OAuth2 spec is surprisingly straightforward and readable, couplet with basic understanding of ABNF that is used in all RFCs - it was a joy to read and implement. And this understanding also stuck with me for many years and helped massively in my career :).