So I guess I'll be the goose at the party, or whatever the metaphor is for the person who disagrees with the headline. First of all: author complains about spe

So I guess I'll be the goose at the party, or whatever the metaphor is for the person who disagrees with the headline. First of all: author complains about spec and then pitches their in-house (non-free) solution. This is something like https://xkcd.com/927/ https://xkcd.com/927/ in spirit, at least. Second of all: .NET notwithstanding, there's plenty of other decent libraries for handling OAuth. Personally, I use hapijs/bell. Third of all: I like OAuth. I like the way they handle scopes, I like the way I can just authenticate a user by grabbing an identifier from some third-party provider (and link together multiple social logins). I like how I can ask for other stuff via scope grants. I also like how I have lots of control over what my applications do. I can grab the oauth token from [provider] and generate my own token-based authentication system for accessing my API. I can do it all in the client, or I can use a client-server workflow. I can grab refresh tokens and keep the oauth grant alive for longer if needs be (for example: I let my identity tokens expire and only refresh them when the user needs to open the attach file from drive widget, and I do that refresh request on the back end). I'm not super-wild about relying on a single OAuth provider, which is why I typically allow different IdPs, and depending on the project will also do regular username / password, but man I love when I don't have to worry about dealing with authentication. Let google handle "I forgot my password" errors, let me focus on the rest. I have to be careful, as there are pitfalls: you can't do token auth if you're not always on https, since OAuth basically falls down if someone gets on your transport stream. You have to understand how the system works and how to use it. In other words: you have to be a programmer to use it. That's not to say OAuth is perfect. But it by no means has ruined everything. For example: would I rather have a better, more intuitive federated authentication and ID validation system, or would I rather Apple allow multiple browsers on their iOS platform so I can start using modern web tech instead of dealing with mobile safari's foibles? I'd say mobile safari is ruining things far more than OAuth, at least IMO.