3 ms·

This seems relevant...[1] I've implemented OAuth once or twice, but it's painful, and I've been hesitant to recommend it as a login or security method both beca

• je42 10y ago
  Actually oauth2 is straight forward to implement. The different flows all have a purpose. Obviously, when confronted with a protocol and implement it without library; you have to read and understand the spec. I think the flows are fairly stripped down and only do the minimum amount and in order to fulfill their respective use case. Obviously the authentication-code flow is the most complex one. However, I don't see how to make it simpler than it already is and still keep it secure. A well tested and reviewed library and usage guidelines should help to remove possible security flaws. I think that the major area where the ecosystems of the different platform can improve. But that's not an issue of OAuth2 but an issue of the communities providing OAuth2 implementations. The article you are referring to has quiet strong expectations from the OAuth2 specification; which it cannot fulfill. Until there is a better specification, I would stick to OAuth2. I believe it is quiet workable and I believe the de-facto standard for authentication at this moment.