61–65 of 65 posts
where is the "session fixation" / token hijacking attack graphic? The history of 1.0 and the rush to put out OAuth 1.0a I will always remember. The year was 2008 and us yammer engineers implemented this new best practice auth system. It went live. And then suddenly a few days later someone in the office proved how the hijack was possible.
Why is that relevant. We are at OAuth 2.0. who cares about what's been 17 years ago?
I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
Earlier quoted context omitted.
I am implementing oauth server with open id provider capabilities. I agree with what you sad, that is my experience as well.
So how are you guys finding this illustrated guide, is it any good?
Like OP was writing, if you are looking at implementing an authorization server, this is not very useful. Even if you are a developer looking to understand how to get authorized to interact with a resource server or authenticate a user, I'd argue that this is not enough. The author clarifies that in the conclusion, but then it's essentially the reader who has to figure out what details are missing and where to get them.
I am implementing oauth right now, along with oidc. I must say that for such a simple concept, getting to the facts that help me to actually implement it is insanely hard. I have no idea why but everywhere i look it just seems like it only scratches the surface and you get no tangible information that you can use to actually implement it in code. I ended up mostly browsing the specs and grok was insanely helpful to e…
Yes, 100% agreed. I launched and worked on OAuth 2.0 at Okta for ~5 years and spent most of my time showing people how to do it well and (gently) finding the holes and mistakes in their implementations. Sure, we were selling "OAuth as a Service" but most had introduced usability problems (at minimum) and gaping security vulns (at worst). For a deep dive, check out Aaron Parecki's book: https://oauth2simplified.com/ -…
IMO OAuth2 is very poorly designed. It has several structural issues: "Connect this OAuth provider" hijack your main account, redirect hijack allows to leak either auth codes through Referrer or access_token through #hash passing, "state" CSRF token is optional and usually ignored etc I have an old writeup on that and solution to it https://sakurity.com/oauth - better analyze it with LLM if interested in authorizatio…
Your comments are so highly abbreviated as to be nearly impossible to understand. I suspect that unintelligibility is leading to it being heavily downvoted. The addition of the comment about LLMs isn't really helping.