4 ms·
Yes, CAS is primarily for that usecase, but could you explain what stops Facebook (or some other current oauth provider) from running a CAS server and enabling
by hardwaresofton 11y ago
Yes, CAS is primarily for that usecase, but could you explain what stops Facebook (or some other current oauth provider) from running a CAS server and enabling me to register a callback URL and using it to authenticate a user visiting my site?
Maybe I'm misunderstanding something fundamental
- jldugger 11y agoWell, I mean, a lot of the complaints about OAuth2 revolve around how the system was designed for high scalability over security; OAuth tokens never expire. Beyond that, I'd have to think a bit. I haven't studied OAuth2 in sufficient detail really.